reciproka-ops/profiles/reciproka-forgejo.nix

118 lines
3.2 KiB
Nix
Raw Normal View History

# Nix configuration for the Reciproka Forgejo service
2021-10-07 02:13:48 +00:00
{
2022-08-15 07:32:25 +00:00
config,
pkgs,
lib,
...
}: let
flake = builtins.getFlake (toString ../.);
nixpkgsUnstable = flake.inputs.nixpkgsUnstable;
forgejo = nixpkgsUnstable.legacyPackages."${pkgs.system}".forgejo;
in {
2021-10-07 02:13:48 +00:00
services.gitea = {
enable = true; # Enable Forgejo
appName = "Reciproka Kolectiva: Forgejo Service"; # Give the site a name
2021-10-07 02:13:48 +00:00
database = {
2022-08-15 07:32:25 +00:00
type = "postgres"; # Database type
passwordFile = config.age.secrets.forgejo.path;
2021-10-07 02:13:48 +00:00
};
domain = "reciproka.dev"; # Domain name
rootUrl = "https://reciproka.dev/"; # Root web URL
2022-08-15 07:32:25 +00:00
httpPort = 3002; # Provided unique port
package = forgejo; # a soft fork of gitea
2021-10-07 02:13:48 +00:00
settings = let
2022-08-15 07:32:25 +00:00
docutils = pkgs.python37.withPackages (ps:
with ps; [
docutils # Provides rendering of ReStructured Text files
pygments # Provides syntax highlighting
]);
service.DISABLE_REGISTRATION = true;
2021-10-07 02:13:48 +00:00
in {
mailer = {
ENABLED = true;
FROM = "fonto@reciproka.dev";
2021-10-07 02:13:48 +00:00
};
repository = {
DEFAULT_BRANCH = "consensus";
};
service = {
REGISTER_EMAIL_CONFIRM = true;
};
"markup.restructuredtext" = {
ENABLED = true;
FILE_EXTENSIONS = ".rst";
RENDER_COMMAND = "${docutils}/bin/rst2html.py";
IS_INPUT_FILE = false;
};
ui = {
DEFAULT_THEME = "forgejo-auto"; # Set the default theme
THEMES = "forgejo-auto,forgejo-light,forgejo-dark,auto,arc-green,gitea";
2021-10-07 02:13:48 +00:00
};
};
};
systemd = {
services = {
gitea = {
# Ensure gitea starts after nixops keys are loaded
after = ["gitea-dbpass-key.service"];
wants = ["gitea-dbpass-key.service"];
};
};
};
2021-10-07 02:13:48 +00:00
services.postgresql = {
2022-08-15 07:32:25 +00:00
enable = true; # Ensure postgresql is enabled
2021-10-07 02:13:48 +00:00
authentication = ''
local gitea all ident map=gitea-users
'';
2022-08-15 07:32:25 +00:00
identMap =
# Map the gitea user to postgresql
2021-10-07 02:13:48 +00:00
''
gitea-users gitea gitea
'';
2022-08-15 07:32:25 +00:00
ensureDatabases = ["gitea"]; # Ensure the database persists
2021-10-07 02:13:48 +00:00
ensureUsers = [
{
2022-08-15 07:32:25 +00:00
name = "gitea"; # Ensure the database user persists
ensurePermissions = {
# Ensure the database permissions persist
2021-10-07 02:13:48 +00:00
"DATABASE gitea" = "ALL PRIVILEGES";
"ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES";
};
}
];
};
services.nginx = {
2022-08-15 07:32:25 +00:00
enable = true; # Enable Nginx
2021-10-07 02:13:48 +00:00
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
2022-08-15 07:32:25 +00:00
virtualHosts."source.jfdic.org" = {
enableACME = true; # Use ACME certs
forceSSL = true; # Force SSL
locations."/" = {
return = "301 https://reciproka.dev$request_uri";
};
};
virtualHosts."reciproka.dev" = {
# Forgejo hostname
2022-08-15 07:32:25 +00:00
enableACME = true; # Use ACME certs
forceSSL = true; # Force SSL
locations."/".proxyPass = "http://localhost:3002/"; # Proxy Forgejo
2021-10-07 02:13:48 +00:00
};
};
security.acme = {
acceptTerms = true;
certs = {
"reciproka.dev".email = "admin@reciproka.co";
"source.jfdic.org".email = "admin@reciproka.co";
2021-10-07 02:13:48 +00:00
};
};
2022-08-15 07:32:25 +00:00
users.groups.keys.members = ["gitea"]; # Required due to NixOps issue #1204
2021-10-07 02:13:48 +00:00
}