From e755c43d5a99fefe01a319a1c44f862496039412 Mon Sep 17 00:00:00 2001
From: Tom Hubrecht <tom@hubrecht.ovh>
Date: Mon, 24 Jul 2023 09:50:57 +0200
Subject: [PATCH] storage01/forgejo: Init on git.dgnum.eu

---
 machines/storage01/_configuration.nix         |   1 +
 machines/storage01/forgejo.nix                | 101 ++++++++++++++++++
 .../secrets/forgejo_database-password-file    |  27 +++++
 machines/storage01/secrets/secrets.nix        |   3 +-
 4 files changed, 131 insertions(+), 1 deletion(-)
 create mode 100644 machines/storage01/forgejo.nix
 create mode 100644 machines/storage01/secrets/forgejo_database-password-file

diff --git a/machines/storage01/_configuration.nix b/machines/storage01/_configuration.nix
index f9ff469..e9f6f6f 100644
--- a/machines/storage01/_configuration.nix
+++ b/machines/storage01/_configuration.nix
@@ -12,6 +12,7 @@ let
 
   # List of services to enable
   enabledServices = [
+    "forgejo"
   ];
 in
 
diff --git a/machines/storage01/forgejo.nix b/machines/storage01/forgejo.nix
new file mode 100644
index 0000000..9c7c14e
--- /dev/null
+++ b/machines/storage01/forgejo.nix
@@ -0,0 +1,101 @@
+{ config, lib, pkgs, dgn-lib, ... }:
+
+let
+  inherit (dgn-lib)
+    setDefault;
+
+  port = 3000;
+  host = "git.dgnum.eu";
+in
+
+{
+  services.gitea = {
+    enable = true;
+
+    user = "git";
+    package = pkgs.forgejo;
+    stateDir = "/var/lib/git";
+
+    appName = "forgejo: DGNum's git instance";
+
+    database = {
+      type = "postgres";
+      user = "git";
+      passwordFile = config.age.secrets."forgejo_database-password-file".path;
+    };
+
+    settings = {
+      server = {
+        ROOT_URL = "https://${host}/";
+        DOMAIN = host;
+        HTTP_ADDRESS = "127.0.0.1";
+        HTTP_PORT = port;
+        APP_DATA_PATH = "/var/lib/git/data";
+      };
+
+      service = {
+        EMAIL_DOMAIN_WHITELIST = "dgnum.eu";
+
+        DISABLE_REGISTRATION = false;
+      };
+
+      log.LEVEL = "Warn";
+
+      ui.THEMES = "forgejo-auto,forgejo-light,forgejo-dark";
+
+      actions = {
+        ENABLED = true;
+        DEFAULT_ACTIONS_URL = "https://gitea.com";
+      };
+
+      mailer = {
+        ENABLED = false;
+        FROM = "git@infra.dgnum.eu";
+        MAILER_TYPE = "smtp";
+        SMTP_ADDR = "kurisu.lahfa.xyz";
+        SMTP_PORT = 465;
+        IS_TLS_ENABLED = true;
+        USER = "web-services@infra.dgnum.eu";
+      };
+    };
+
+    # Dump configuration
+    # dump = {
+    #   enable = false;
+    #   type = "tar.xz";
+    #   file = "gitea.bk";
+    # };
+
+    # mailerPasswordFile = config.age.secrets."_ht-mail.pwd".path;
+  };
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts.${host} = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:${toString port}";
+      };
+    };
+  };
+
+  users.users.git = {
+    description = "Git Service";
+    home = "/var/lib/git";
+    useDefaultShell = true;
+    group = "git";
+    isSystemUser = true;
+  };
+
+  users.groups.git = { };
+
+  dgn-secrets.options = [
+    (setDefault { owner = "git"; } (builtins.filter
+      (lib.hasPrefix "forgejo")
+      config.dgn-secrets.names))
+  ];
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}
diff --git a/machines/storage01/secrets/forgejo_database-password-file b/machines/storage01/secrets/forgejo_database-password-file
new file mode 100644
index 0000000..06ce2fa
--- /dev/null
+++ b/machines/storage01/secrets/forgejo_database-password-file
@@ -0,0 +1,27 @@
+age-encryption.org/v1
+-> ssh-ed25519 rHotTw VROWia1UGxKvLi+SZ2grFqfUi10BGbBWKrSmi4Iw01U
+wFFoxP9MrADS3Wl34L0CjsaoTSy7JHJ4t4w2N52mBKU
+-> ssh-ed25519 cvTB5g Ev1w1VPlQKBwOB/yYpEg6w/g1eGN190lwP8mMpq75Xc
+FUfyIDYZ/cxPtywZw+OgNpRhSISP6muWTF/8hEtSLOg
+-> ssh-ed25519 Wu8JLQ FoYe+iG0zFzw7Mc9wtudLPqdnsZWLNyd/gbw1TahQz8
+0nRkMbgV3QXrw1+sQG3vRaFWBitrotoJB+1nyqCWhM8
+-> ssh-ed25519 jIXfPA U+PEeBy1vXu1leN0P+5ps4LlStESvHTb11zOaM0yPDI
+UjB+PPMuc9209bHi5gKvkbSa7ZcWsu6JWy8s6E1jJDQ
+-> ssh-ed25519 QlRB9Q i2KcBk2W0AmvnZF3AcV1GlWQ473qTDvn/rrH3kIRIik
+6HMK0d5NnA25xfrKFO91Rb9FDbU7zPJbUdLet3L7WaU
+-> ssh-rsa krWCLQ
+j/BIE/IyHE9+zrAVQW+50A25UIZW9h/plLsuKJ82gcCkPmNUSLDHmlTxLvLg9qpR
+oanp5V5zbuJj1iRy4IuWRKszx2IBFAor9MoDS93QieccjRYkuFPGLroUWolODJ5X
+eP6F2lhjBMDFbNCOCWdL4p66MtDy9ZNDVMUKYA8aXaOU/oPxr4VwkVkoHJeGOTje
++aJ3tKse/QdvT7vVHCutYGZoYhuWyI1LUFRIXdkeoqmY1RnF43kdui84a//quJT2
+iBPgZ4HLezbf6MTp9Gi2RmcVPVViAxLWXWH8GYKMI51TsWLHYrPszcpqwM7B+m14
+AnD/J6srq08SnZYIsg+wOg
+-> ssh-ed25519 /vwQcQ IZwQ56Xm+BnDhBZ7EzjWLiWAa5Iw3C3x4Fp/roWmRXE
++O8Jd341LtyLc2+DzKrtpN25iJbmboaLDlPvMYxphtQ
+-> ssh-ed25519 0R97PA p0QpsWsYTms12BQitqWSAHRcAFNNN1zzPuSFnW/ocxU
+Ze+Z1S5KFUJ5/YCSGPnl8wvSpiPhVR8QzthLRuyRJnY
+-> IC-grease -KhJ+=P Z5S .wB
+vZm9JOMOQRAl3+KxelQniW7O1BwQmeSpSNGjY12oY/xVue5LOpqjxDC63jpYJHoG
+izw
+--- NB/JS3Ab3dw33pEARrn+OwGLmtwcqBg/VVc1FX3yhrc
+K¥ïtM€q±œûÐkñm²µ¹y~âµñȇØ#ö
Œó/îô‡U
:¾û“>xà^¨š[Í!jg þ
\ No newline at end of file
diff --git a/machines/storage01/secrets/secrets.nix b/machines/storage01/secrets/secrets.nix
index b7de844..31bf8ca 100644
--- a/machines/storage01/secrets/secrets.nix
+++ b/machines/storage01/secrets/secrets.nix
@@ -1,7 +1,8 @@
 let
   lib = import ../../../lib { };
-  publicKeys = lib.getNodeKeys "web01";
+  publicKeys = lib.getNodeKeys "storage01";
 in
 
 lib.setDefault { inherit publicKeys; } [
+  "forgejo_database-password-file"
 ]