1
0
Fork 0
nix-configuration/modules/services/forgejo.nix

132 lines
4.3 KiB
Nix
Raw Normal View History

{
pkgs,
config,
lib,
...
}:
let
cfg = config.aux.system.services.forgejo;
cli-cfg = config.services.forgejo;
forgejo-cli = pkgs.writeScriptBin "forgejo-cli" ''
#!${pkgs.runtimeShell}
cd ${cli-cfg.stateDir}
sudo=exec
if [[ "$USER" != forgejo ]]; then
sudo='exec /run/wrappers/bin/sudo -u ${cli-cfg.user} -g ${cli-cfg.group} --preserve-env=GITEA_WORK_DIR --preserve-env=GITEA_CUSTOM'
fi
# Note that these variable names will change
export GITEA_WORK_DIR=${cli-cfg.stateDir}
export GITEA_CUSTOM=${cli-cfg.customDir}
$sudo ${lib.getExe cli-cfg.package} "$@"
'';
in
{
options = {
aux.system.services.forgejo = {
2024-05-20 20:52:57 -04:00
autostart = lib.mkEnableOption (lib.mdDoc "Automatically starts Forgejo at boot.");
enable = lib.mkEnableOption (lib.mdDoc "Enables Forgejo Git hosting service.");
2024-06-04 14:18:45 -04:00
domain = lib.mkOption {
default = "";
type = lib.types.str;
description = "The root domain that Forgejo will be hosted on.";
example = "example.com";
};
home = lib.mkOption {
default = "";
type = lib.types.str;
2024-05-20 20:52:57 -04:00
description = "Where to store Forgejo's files";
2024-06-04 14:18:45 -04:00
example = "/home/forgejo";
};
url = lib.mkOption {
default = "";
type = lib.types.str;
description = "The complete URL where Forgejo is hosted.";
example = "https://forgejo.example.com";
};
actions = {
enable = lib.mkEnableOption (lib.mdDoc "Enables a local Forgejo Actions runner.");
token = lib.mkOption {
default = "";
type = lib.types.str;
description = "Token used to authenticate the runner with Forgejo.";
};
};
};
};
config = lib.mkIf cfg.enable {
2024-05-27 12:32:24 -04:00
environment.systemPackages = [
forgejo-cli
pkgs.podman-tui
];
services = {
forgejo = {
enable = true;
settings.server = {
2024-06-04 14:18:45 -04:00
DOMAIN = cfg.domain;
ROOT_URL = cfg.url;
HTTP_PORT = 3000;
};
useWizard = true;
} // lib.optionalAttrs (cfg.home != null) { stateDir = cfg.home; };
2024-05-27 12:32:24 -04:00
2024-06-25 14:13:15 -04:00
nginx.virtualHosts."${cfg.url}" = {
useACMEHost = cfg.domain;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:3000";
proxyWebsockets = true;
extraConfig = "proxy_ssl_server_name on;"; # required when the target is also TLS server with multiple hosts
};
};
2024-05-27 12:32:24 -04:00
# Enable runner for CI actions
2024-06-04 14:18:45 -04:00
gitea-actions-runner = lib.mkIf cfg.actions.enable {
2024-05-27 12:32:24 -04:00
package = pkgs.forgejo-actions-runner;
instances.default = {
enable = true;
name = config.networking.hostName;
2024-06-04 14:18:45 -04:00
url = cfg.url;
token = cfg.actions.token;
2024-05-27 12:32:24 -04:00
labels = [
2024-05-27 13:11:16 -04:00
"nix:docker://nixos/nix" # Shoutout to Icewind 1991 for this syntax: https://icewind.nl/entry/gitea-actions-nix/
2024-05-27 13:07:35 -04:00
"debian:docker://node:20-bullseye"
"ubuntu-latest:docker://ubuntu:latest"
2024-05-27 12:32:24 -04:00
];
2024-05-27 13:30:16 -04:00
settings = {
# For an example of configuring in Nix: https://git.clan.lol/clan/clan-infra/src/branch/main/modules/web01/gitea/actions-runner.nix
# For an example of the different options available: https://gitea.com/gitea/act_runner/src/branch/main/internal/pkg/config/config.example.yaml
2024-05-28 14:00:05 -04:00
container.options = "-v /nix:/nix";
2024-05-28 13:48:44 -04:00
container.validVolumes = [ "/nix" ];
2024-05-27 13:30:16 -04:00
};
2024-05-27 12:32:24 -04:00
};
};
};
2024-06-04 14:18:45 -04:00
systemd.services = {
nginx.wants = [ config.systemd.services.forgejo.name ];
} // lib.optionalAttrs (!cfg.autostart) { forgejo.wantedBy = lib.mkForce [ ]; };
2024-05-27 12:32:24 -04:00
# Enable Podman for running...uh, runners.
2024-06-04 14:18:45 -04:00
virtualisation = lib.mkIf cfg.actions.enable {
2024-05-27 12:32:24 -04:00
containers.enable = true;
podman = {
enable = true;
# Create a `docker` alias for podman, to use it as a drop-in replacement
dockerCompat = true;
# Required for containers under podman-compose to be able to talk to each other.
defaultNetwork.settings.dns_enabled = true;
};
};
2024-05-28 14:17:53 -04:00
# Allow containers to make DNS queries (https://www.reddit.com/r/NixOS/comments/199f16j/why_dont_my_podman_containers_have_internet_access/)
2024-06-04 14:18:45 -04:00
networking.firewall.interfaces.podman4 = lib.mkIf cfg.actions.enable {
2024-05-28 14:17:53 -04:00
allowedTCPPorts = [ 53 ];
allowedUDPPorts = [ 53 ];
};
};
}