98 lines
2.3 KiB
Nix
98 lines
2.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
self,
|
|
...
|
|
}: let
|
|
unit = "gitea";
|
|
cfg = config.server.services.${unit};
|
|
domain = "${cfg.subdomain}.${config.server.infra.www.url}";
|
|
in {
|
|
config = lib.mkIf cfg.enable {
|
|
age.secrets.giteaCloudflared.file = "${self}/secrets/giteaCloudflared.age";
|
|
|
|
server.infra = {
|
|
fail2ban.jails.unit = {
|
|
serviceName = "${unit}";
|
|
failRegex = ''
|
|
.*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).*
|
|
from <HOST>
|
|
'';
|
|
};
|
|
|
|
postgresql.databases = [
|
|
{database = unit;}
|
|
];
|
|
};
|
|
|
|
services = {
|
|
cloudflared = {
|
|
enable = true;
|
|
tunnels.${cfg.cloudflared.tunnelId} = {
|
|
credentialsFile = cfg.cloudflared.credentialsFile;
|
|
default = "http_status:404";
|
|
ingress."${domain}".service = "http://localhost:${toString cfg.port}";
|
|
};
|
|
};
|
|
|
|
gitea = {
|
|
enable = true;
|
|
appName = "cnix code forge";
|
|
|
|
database = {
|
|
type = "postgres";
|
|
socket = "/run/postgresql";
|
|
name = "gitea";
|
|
user = "gitea";
|
|
createDatabase = false;
|
|
};
|
|
|
|
lfs.enable = true;
|
|
|
|
settings = {
|
|
cors = {
|
|
ENABLED = true;
|
|
SCHEME = "https";
|
|
ALLOW_DOMAIN = domain;
|
|
};
|
|
|
|
log.MODE = "console";
|
|
|
|
mailer = {
|
|
ENABLED = false;
|
|
MAILER_TYPE = "sendmail";
|
|
FROM = "noreply+adam@cnst.dev";
|
|
SENDMAIL_PATH = "/run/wrappers/bin/sendmail";
|
|
};
|
|
|
|
picture.DISABLE_GRAVATAR = true;
|
|
|
|
repository = {
|
|
DEFAULT_BRANCH = "main";
|
|
DEFAULT_REPO_UNITS = "repo.code,repo.issues,repo.pulls";
|
|
DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
|
|
};
|
|
|
|
indexer.REPO_INDEXER_ENABLED = true;
|
|
|
|
oauth2_client = {
|
|
ENABLE_AUTO_REGISTRATION = true;
|
|
ACCOUNT_LINKING = "auto";
|
|
};
|
|
|
|
server = {
|
|
DOMAIN = domain;
|
|
LANDING_PAGE = "explore";
|
|
HTTP_PORT = cfg.port;
|
|
ROOT_URL = "https://${domain}/";
|
|
};
|
|
|
|
security.DISABLE_GIT_HOOKS = false;
|
|
service.DISABLE_REGISTRATION = true;
|
|
session.COOKIE_SECURE = true;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|