infrastructure/machines/nixos/storage01/forgejo.nix

# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{
  config,
  nixpkgs,
  lib,
  ...
}:

let
  port = 3000;
  host = "git.dgnum.eu";

  bannedUserAgentPatterns = [
    "Trident/"
    "Android\\s[123456789]\\."
    "iPod"
    "iPad\\sOS\\s"
    "iPhone\\sOS\\s[23456789]"
    "Opera/[89]"
    "(Chrome|CriOS)/(\\d\\d?\\.|1[01]|12[4])"
    "(Firefox|FxiOS)/(\\d\\d?\\.|1[01]|12[012345679]\\.)"
    "PPC\\sMac\\sOS"
    "Windows\\sCE"
    "Windows\\s95"
    "Windows\\s98"
    "Windows\\sNT\\s[12345]\\."
  ];
in
{
  services = {
    forgejo = {
      enable = true;

      user = "git";
      package = nixpkgs.nixos.unstable.forgejo;
      stateDir = "/var/lib/git";

      database = {
        type = "postgres";
        user = "git";
        name = "git";
      };

      settings = {
        DEFAULT = {
          APP_NAME = "Forge git de la DGNum";
        };

        actions = {
          ENABLED = true;
          DEFAULT_ACTIONS_URL = "https://gitea.com";
        };

        admin = {
          DEFAULT_EMAIL_NOTIFICATIONS = "enabled";
          SEND_NOTIFICATION_EMAIL_ON_NEW_USER = true;
        };

        log.LEVEL = "Warn";

        mailer = {
          ENABLED = true;
          FROM = "git@infra.dgnum.eu";
          PROTOCOL = "smtps";
          SMTP_ADDR = "kurisu.lahfa.xyz";
          SMTP_PORT = 465;
          USER = "web-services@infra.dgnum.eu";
        };

        session = {
          SESSION_LIFE_TIME = 24 * 3600 * 7;
          GC_INTERVAL_TIME = 24 * 3600 * 7;
        };

        server = {
          ROOT_URL = "https://${host}/";
          DOMAIN = host;
          HTTP_ADDRESS = "127.0.0.1";
          HTTP_PORT = port;
          APP_DATA_PATH = "/var/lib/git/data";
          OFFLINE_MODE = false;
        };

        service = {
          EMAIL_DOMAIN_ALLOWLIST = "dgnum.eu,*";
          EMAIL_DOMAIN_BLOCKLIST = "*.shop,*.online,*.store";
          ENABLE_NOTIFY_MAIL = true;

          DISABLE_REGISTRATION = false;
          REGISTER_EMAIL_CONFIRM = true;
        };

        ui.THEMES = "forgejo-auto,forgejo-light,forgejo-dark";

        "cron.cleanup_actions".ENABLED = true;
        "cron.delete_old_actions".ENABLED = true;
        "cron.git_gc_repos".ENABLED = true;
        "cron.update_checker".ENABLED = false;
      };
      secrets.mailer.PASSWD = config.age.secrets."forgejo-mailer_password_file".path;
    };
  };

  dgn-web.simpleProxies.forgejo = {
    inherit host port;
  };

  services.nginx = {
    appendHttpConfig = ''
      map $http_user_agent $badagent {
        default 0;
        ${lib.concatMapStringsSep "\n" (pattern: ''
          ~${pattern} 1;
        '') bannedUserAgentPatterns}
      }
    '';
    virtualHosts.${host}.locations."/".extraConfig = ''
      if ($badagent) {
        access_log /var/log/nginx/abuse.log;
        return 403;
      }
    '';
  };

  users.users.git = {
    description = "Git Service";
    home = "/var/lib/git";
    useDefaultShell = true;
    group = "git";
    isSystemUser = true;
  };

  users.groups.git = { };

  age-secrets.matches."^forgejo-.*$" = {
    owner = "git";
  };

  dgn-backups.jobs.forgejo.settings.paths = builtins.map (dir: "/var/lib/git/${dir}") [
    "custom"
    "data"
    "repositories"
    ".ssh"
  ];
  dgn-backups.postgresDatabases = [ "git" ];
}