feat(ops/nixos): Add module for configuring Gerrit for the repo

ops/nixos/camden/default.nix

@@ -9,6 +9,8 @@ in lib.fix(self: {
   imports = [
     ../modules/depot.nix
     ../modules/hound.nix
+    ../modules/monorepo-gerrit.nix
+    "${pkgs.nixpkgsSrc}/nixos/modules/services/web-apps/gerrit.nix"
   ];
   depot = depot;
 
@@ -108,7 +110,6 @@ in lib.fix(self: {
     (with depot; [
       fun.idual.script
       fun.idual.setAlarm
-      third_party.honk
       third_party.pounce
     ]) ++
 
@@ -230,6 +231,11 @@ in lib.fix(self: {
       group = "nginx";
       webroot = "/var/lib/acme/acme-challenge";
       postRun = "systemctl reload nginx";
+      extraDomains = {
+        "cl.tvl.fyi" = null;
+        "code.tvl.fyi" = null;
+        "cs.tvl.fyi" = null;
+      };
     };
   };
 
@@ -395,6 +401,18 @@ in lib.fix(self: {
         }
       '';
     };
+
+    virtualHosts.gerrit = {
+      serverName = "cl.tvl.fyi";
+      useACMEHost = "tvl.fyi";
+      forceSSL = true;
+
+      extraConfig = ''
+        location / {
+          proxy_pass http://localhost:4778;
+        }
+      '';
+    };
   };
 
   # Timer units that can be started with systemd-run to set my alarm.

ops/nixos/modules/monorepo-gerrit.nix

@@ -0,0 +1,16 @@
+# Gerrit configuration for the TVL monorepo
+{ pkgs, config, lib, ... }:
+
+{
+  services.gerrit = {
+    enable = true;
+    listenAddress = "[::]:4778"; # 4778 - grrt
+    serverId = "4fdfa107-4df9-4596-8e0a-1d2bbdd96e36";
+    settings = {
+      core.packedGitLimit = "100m";
+      log.jsonLogging = true;
+      log.textLogging = false;
+      # TODO: gitweb config
+    };
+  };
+}

third_party/default.nix

@@ -58,6 +58,7 @@ let
       fira-mono
       fontconfig
       freetype
+      gerrit
       gettext
       glibc
       gmock