feat(refactor): WIP refactor server modules

2025-10-12 21:07:30 +02:00
parent 57cb48a11c
commit d2bd385367
43 changed files with 1004 additions and 1414 deletions
--- a/modules/server/services/gitea/default.nix
+++ b/modules/server/services/gitea/default.nix
@@ -0,0 +1,108 @@
+# "inspired" by @jtojnar <3
+{
+  config,
+  lib,
+  self,
+  ...
+}: let
+  unit = "gitea";
+  cfg = config.server.services.${unit};
+in {
+  config = lib.mkIf cfg.enable {
+    age.secrets = {
+      giteaCloudflared.file = "${self}/secrets/giteaCloudflared.age";
+    };
+
+    server.infra = {
+      fail2ban = {
+        jails = {
+          gitea = {
+            serviceName = "gitea";
+            failRegex = ''.*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>'';
+          };
+        };
+      };
+    };
+
+    services = {
+      cloudflared = {
+        enable = true;
+        tunnels.${cfg.cloudflared.tunnelId} = {
+          credentialsFile = cfg.cloudflared.credentialsFile;
+          default = "http_status:404";
+          ingress."${cfg.url}".service = "http://localhost:${toString cfg.port}";
+        };
+      };
+
+      ${unit} = {
+        enable = true;
+        appName = "cnix code forge";
+
+        database = {
+          type = "postgres";
+          socket = "/run/postgresql";
+          name = "gitea";
+          user = "gitea";
+          createDatabase = false;
+        };
+
+        lfs = {
+          enable = true;
+        };
+
+        settings = {
+          cors = {
+            ENABLED = true;
+            SCHEME = "https";
+            ALLOW_DOMAIN = cfg.url;
+          };
+          log = {
+            MODE = "console";
+          };
+          mailer = {
+            ENABLED = false;
+            MAILER_TYPE = "sendmail";
+            FROM = "noreply+adam@cnst.dev";
+            SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
+          };
+          picture = {
+            DISABLE_GRAVATAR = true;
+          };
+          repository = {
+            DEFAULT_BRANCH = "main";
+            DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
+            DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
+          };
+          indexer = {
+            REPO_INDEXER_ENABLED = true;
+          };
+          oauth2_client = {
+            ENABLE_AUTO_REGISTRATION = true;
+            ACCOUNT_LINKING = "auto";
+          };
+          server = {
+            DOMAIN = cfg.url;
+            LANDING_PAGE = "explore";
+            HTTP_PORT = cfg.port;
+            ROOT_URL = "https://${cfg.url}/";
+          };
+          security = {
+            DISABLE_GIT_HOOKS = false;
+          };
+          service = {
+            DISABLE_REGISTRATION = true;
+          };
+          session = {
+            COOKIE_SECURE = true;
+          };
+        };
+      };
+    };
+
+    server.infra.postgresql.databases = [
+      {
+        database = "gitea";
+      }
+    ];
+  };
+}