diff --git a/profiles/gitea.nix b/profiles/gitea.nix index db84acb..fbe56e5 100644 --- a/profiles/gitea.nix +++ b/profiles/gitea.nix @@ -1,9 +1,10 @@ # NixOps configuration for the hosts running Gitea - -{ config, pkgs, lib, ... }: - { - + config, + pkgs, + lib, + ... +}: { services.gitea = { enable = true; # Enable Gitea appName = "mcwhirter.io: Gitea Service"; # Give the site a name @@ -26,8 +27,8 @@ ENABLED = true; FROM = "gitea@mcwhirter.io"; }; - repository = { DEFAULT_BRANCH = "consensus"; }; - service = { REGISTER_EMAIL_CONFIRM = true; }; + repository = {DEFAULT_BRANCH = "consensus";}; + service = {REGISTER_EMAIL_CONFIRM = true;}; "markup.restructuredtext" = { ENABLED = true; FILE_EXTENSIONS = ".rst"; @@ -45,18 +46,22 @@ authentication = '' local gitea all ident map=gitea-users ''; - identMap = # Map the gitea user to postgresql + identMap = + # Map the gitea user to postgresql '' gitea-users gitea gitea ''; - ensureDatabases = [ "gitea" ]; # Ensure the database persists - ensureUsers = [{ - name = "gitea"; # Ensure the database user persists - ensurePermissions = { # Ensure the database permissions persist - "DATABASE gitea" = "ALL PRIVILEGES"; - "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES"; - }; - }]; + ensureDatabases = ["gitea"]; # Ensure the database persists + ensureUsers = [ + { + name = "gitea"; # Ensure the database user persists + ensurePermissions = { + # Ensure the database permissions persist + "DATABASE gitea" = "ALL PRIVILEGES"; + "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES"; + }; + } + ]; }; services.nginx = { @@ -65,18 +70,21 @@ recommendedOptimisation = true; recommendedProxySettings = true; recommendedTlsSettings = true; - virtualHosts."source.mcwhirter.io" = { # Gitea hostname + virtualHosts."source.mcwhirter.io" = { + # Gitea hostname enableACME = true; # Use ACME certs forceSSL = true; # Force SSL locations."/".proxyPass = "http://localhost:3002/"; # Proxy Gitea }; - virtualHosts."git.mcwhirter.io" = { # Hostname to be redirected + virtualHosts."git.mcwhirter.io" = { + # Hostname to be redirected enableACME = true; # Use ACME certs forceSSL = true; # Force SSL locations."/".proxyPass = "http://localhost:3002/"; # Proxy Gitea globalRedirect = "source.mcwhirter.io"; # Redirect permanently to the host }; - virtualHosts."code.mcwhirter.io" = { # Hostname to be redirected + virtualHosts."code.mcwhirter.io" = { + # Hostname to be redirected enableACME = true; # Use ACME certs forceSSL = true; # Force SSL locations."/".proxyPass = "http://localhost:3002/"; # Proxy Gitea @@ -93,6 +101,5 @@ }; }; - users.groups.keys.members = [ "gitea" ]; # Required due to NixOps issue #1204 - + users.groups.keys.members = ["gitea"]; # Required due to NixOps issue #1204 }