fixup! services/forgejo: forgejo but make it COOL

assets/forgejo/favicon.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linecap:round;stroke-linejoin:round" viewBox="0 0 380 380" width="32" height="32"><path d="M149.575 234.069q-1.811-19.766-14.887-37.117l-3.95-2.915q11.298-2.199 20.018-8.145l2.017 2.236q9.436.497 18.673-2.59c-1.959-4.581-5.162-9.942-9.113-15.187 6.358-5.113 10.839-9.91 12.947-15.288q-10.332-.871-17.08.648l4.084-3.329c9.155-4.309 12.227-16.306 12.515-36.033.26-17.767-1.208-32.111-7.701-43.184q-34.73 24.961-35.481 42.674-13.548-18.255-35.253-18.564c.448 5.884 2.21 12.099 5.565 17.243-2.604.285-4.894 1.216-7.859 2.411-12.156-13.612-23.673-29.376-34.414-47.008-8.039 23.269-11.333 40.023-11.455 50.284-.185 15.523 2.061 27.432 8.313 35.773l3.091 3.727-16.713-1.928c2.54 8.707 7.805 10.601 12.388 14.2-3.162 5.672-6.712 11.419-5.2 16.186 4.853 1.053 10.244.317 15.543-.116q12.885 6.631 30.679 9.057c-3.911.199-8.614.271-18.699-1.928q1.927 7.567 10.869 12.33-5.961 4.674-7.947 10.518 5.58-.468 10.226-1.169-3.624 8.152-4.909 17.239" style="fill:#fff;fill-rule:nonzero" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M85.842 234.094q1.285-9.087 4.909-17.239-4.646.701-10.226 1.169 1.986-5.844 7.947-10.518-8.942-4.763-10.869-12.33c10.085 2.199 14.788 2.127 18.699 1.928q-17.793-2.425-30.679-9.058c-5.299.434-10.69 1.17-15.543.117-1.512-4.767 2.038-10.514 5.2-16.186-4.583-3.6-9.848-5.493-12.388-14.2l16.713 1.928M56.514 155.978c-6.252-8.341-8.498-20.25-8.313-35.773.122-10.261 3.416-27.015 11.455-50.284q16.112 26.448 34.068 46.565" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M108.929 122.454q-13.353 2.18-23.373.049c8.248-6.371 12.822-8.004 18.865-8.135" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M102.706 115.642c-3.863-5.34-5.86-12.045-6.342-18.367q21.705.31 35.253 18.563.751-17.712 35.481-42.673c6.493 11.073 7.961 25.417 7.701 43.184-.288 19.727-3.36 31.724-12.515 36.033M158.2 155.711q6.748-1.52 17.08-.648c-2.108 5.378-6.589 10.175-12.947 15.288 3.951 5.245 7.154 10.606 9.113 15.187q-9.237 3.087-18.673 2.59M130.738 194.037q11.298-2.199 20.018-8.145M149.575 234.069q-1.811-19.766-14.887-37.117M65.551 146.77l29.868-1.53M70.019 170.273q-4.531-9.216 1.71-23.819" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M82.462 145.904c-1.913 14.213.121 23.042 6.417 23.03 6.855-.014 8.935-9.064 6.54-23.694" style="fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M122.796 145.382q13.86-3.124 28.791-1.607" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M143.816 143.298c5.18 5.875 5.983 14.532 4.825 24.09" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M122.796 145.382c-1.413 14.984.295 21.028 5.401 21.024 11.093-.008 5.742-13.933 6.606-22.844" style="fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M100.913 170.171a31 31 0 0 1 7.467-.581M94.877 182.466c3.607 2.981 6.483 2.176 12.251-2.727 6.426 1.759 13.671 4.519 16.185-1.431" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M60.711 175.474q2.568-2.85 6.354-2.742c-.29 2.933-.746 3.681-1.211 5.237-.775 2.588 6.18-1.728 9.088-3.278M140.128 175.257l4.115-3.759c.165 2.013-.146 5.293.486 6.06 2.44-.927 4.167-3.564 6.223-5.412" style="fill:none;fill-rule:nonzero;stroke:#c41818;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/></svg>

assets/forgejo/logo.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xml:space="preserve" style="fill-rule:evenodd;clip-rule:evenodd;stroke-linecap:round;stroke-linejoin:round" viewBox="0 0 380 380" width="32" height="32"><path d="M149.575 234.069q-1.811-19.766-14.887-37.117l-3.95-2.915q11.298-2.199 20.018-8.145l2.017 2.236q9.436.497 18.673-2.59c-1.959-4.581-5.162-9.942-9.113-15.187 6.358-5.113 10.839-9.91 12.947-15.288q-10.332-.871-17.08.648l4.084-3.329c9.155-4.309 12.227-16.306 12.515-36.033.26-17.767-1.208-32.111-7.701-43.184q-34.73 24.961-35.481 42.674-13.548-18.255-35.253-18.564c.448 5.884 2.21 12.099 5.565 17.243-2.604.285-4.894 1.216-7.859 2.411-12.156-13.612-23.673-29.376-34.414-47.008-8.039 23.269-11.333 40.023-11.455 50.284-.185 15.523 2.061 27.432 8.313 35.773l3.091 3.727-16.713-1.928c2.54 8.707 7.805 10.601 12.388 14.2-3.162 5.672-6.712 11.419-5.2 16.186 4.853 1.053 10.244.317 15.543-.116q12.885 6.631 30.679 9.057c-3.911.199-8.614.271-18.699-1.928q1.927 7.567 10.869 12.33-5.961 4.674-7.947 10.518 5.58-.468 10.226-1.169-3.624 8.152-4.909 17.239" style="fill:#fff;fill-rule:nonzero" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M85.842 234.094q1.285-9.087 4.909-17.239-4.646.701-10.226 1.169 1.986-5.844 7.947-10.518-8.942-4.763-10.869-12.33c10.085 2.199 14.788 2.127 18.699 1.928q-17.793-2.425-30.679-9.058c-5.299.434-10.69 1.17-15.543.117-1.512-4.767 2.038-10.514 5.2-16.186-4.583-3.6-9.848-5.493-12.388-14.2l16.713 1.928M56.514 155.978c-6.252-8.341-8.498-20.25-8.313-35.773.122-10.261 3.416-27.015 11.455-50.284q16.112 26.448 34.068 46.565" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M108.929 122.454q-13.353 2.18-23.373.049c8.248-6.371 12.822-8.004 18.865-8.135" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M102.706 115.642c-3.863-5.34-5.86-12.045-6.342-18.367q21.705.31 35.253 18.563.751-17.712 35.481-42.673c6.493 11.073 7.961 25.417 7.701 43.184-.288 19.727-3.36 31.724-12.515 36.033M158.2 155.711q6.748-1.52 17.08-.648c-2.108 5.378-6.589 10.175-12.947 15.288 3.951 5.245 7.154 10.606 9.113 15.187q-9.237 3.087-18.673 2.59M130.738 194.037q11.298-2.199 20.018-8.145M149.575 234.069q-1.811-19.766-14.887-37.117M65.551 146.77l29.868-1.53M70.019 170.273q-4.531-9.216 1.71-23.819" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M82.462 145.904c-1.913 14.213.121 23.042 6.417 23.03 6.855-.014 8.935-9.064 6.54-23.694" style="fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M122.796 145.382q13.86-3.124 28.791-1.607" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M143.816 143.298c5.18 5.875 5.983 14.532 4.825 24.09" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M122.796 145.382c-1.413 14.984.295 21.028 5.401 21.024 11.093-.008 5.742-13.933 6.606-22.844" style="fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M100.913 170.171a31 31 0 0 1 7.467-.581M94.877 182.466c3.607 2.981 6.483 2.176 12.251-2.727 6.426 1.759 13.671 4.519 16.185-1.431" style="fill:none;fill-rule:nonzero;stroke:#000;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/><path d="M60.711 175.474q2.568-2.85 6.354-2.742c-.29 2.933-.746 3.681-1.211 5.237-.775 2.588 6.18-1.728 9.088-3.278M140.128 175.257l4.115-3.759c.165 2.013-.146 5.293.486 6.06 2.44-.927 4.167-3.564 6.223-5.412" style="fill:none;fill-rule:nonzero;stroke:#c41818;stroke-width:1.59px" transform="translate(-96.92 -181.242)scale(2.62918)"/></svg>

flake.lock

@@ -47,10 +47,10 @@
         "nixpkgs-stable": "nixpkgs-stable"
       },
       "locked": {
-        "lastModified": 1742674578,
-        "narHash": "sha256-WnbRUpnUtd0UadC/zrwQjCWi2P0f/pBLv0HSknZ+0t8=",
+        "lastModified": 1742679462,
+        "narHash": "sha256-L9q9KDqiJEREM/GRnSo4vB9VCvclmdRT9vXuFwBmb9Y=",
         "ref": "refs/heads/main",
-        "rev": "faf973d3829e1b9b9e76ca2d0a09389c0c8233cb",
+        "rev": "087bfe9234f8dc682dbf1d8f96c0b712f587c466",
         "revCount": 368,
         "type": "git",
         "url": "https://git.lix.systems/nrabulinski/attic.git"

flake.nix

@@ -65,6 +65,10 @@
               # racket
               "*.rkt"
               "**/rashrc"
+
+              # custom assets
+              "*.png"
+              "*.svg"
             ];
             settings.on-unmatched = "fatal";
           };

hosts/kazuki/default.nix

@@ -15,7 +15,6 @@
         ./storage.nix
         ./ntfy.nix
         ./zitadel.nix
-        ./forgejo.nix
         ./prometheus.nix
       ];
 

hosts/kazuki/forgejo.nix

@@ -1,62 +0,0 @@
-{ config, ... }:
-{
-  age.secrets.rab-lol-cf = {
-    file = ../../secrets/rab-lol-cf.age;
-    owner = config.services.nginx.user;
-  };
-
-  services.forgejo = {
-    enable = true;
-    settings = {
-      server = {
-        DOMAIN = "git.rab.lol";
-        ROOT_URL = "https://git.rab.lol/";
-      };
-      oauth2_client = {
-        REGISTER_EMAIL_CONFIRM = false;
-        ENABLE_AUTO_REGISTRATION = true;
-        ACCOUNT_LINKING = "auto";
-        UPDATE_AVATAR = true;
-      };
-      service = {
-        DISABLE_REGISTRATION = false;
-        ALLOW_ONLY_INTERNAL_REGISTRATION = false;
-        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
-      };
-      federation.ENABLED = true;
-    };
-    repositoryRoot = "/storage-box/forgejo/repos";
-    lfs = {
-      enable = true;
-      contentDir = "/storage-box/forgejo/lfs";
-    };
-  };
-
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedTlsSettings = true;
-    virtualHosts."git.rab.lol" = {
-      forceSSL = true;
-      enableACME = true;
-      acmeRoot = null;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:3000";
-        extraConfig = ''
-          proxy_set_header Connection $http_connection;
-          proxy_set_header Upgrade $http_upgrade;
-        '';
-      };
-    };
-  };
-
-  users.users.nginx.extraGroups = [ "acme" ];
-  security.acme.acceptTerms = true;
-  security.acme.certs."git.rab.lol" = {
-    dnsProvider = "cloudflare";
-    credentialsFile = config.age.secrets.rab-lol-cf.path;
-    email = "nikodem@rabulinski.com";
-  };
-}

modules/system/containers.nix

@@ -85,6 +85,12 @@ let
 
           services.openssh.hostKeys = [ ];
           system.stateVersion = lib.mkDefault config.system.stateVersion;
+
+          networking.useHostResolvConf = false;
+          networking.nameservers = [
+            "1.1.1.1"
+            "1.0.0.1"
+          ];
         };
 
         bindMounts = {
@@ -95,6 +101,11 @@ let
         privateNetwork = lib.mkForce true;
       }
     ) config.settei.containers;
+
+    networking.nat = lib.mkIf (config.settei.containers != { }) {
+      enable = true;
+      internalInterfaces = [ "ve-+" ];
+    };
   };
 
   darwinConfig = lib.optionalAttrs (!isLinux) {

secrets/kanidm-admin-pass.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 84j9mw W4+Z4WjOyUl4mWPqVykNWRhf2/8qfVOSM7QCFPNMZTA
+0ndQjslMwjQqguN25nBQtCchpCLhoD/vrxh1yNVeTNw
+-> ssh-ed25519 GKhvwg H8XcFJDZTA3IzxmK6wbB+PVM2gCZ4ysAPjL5j0LgeE0
+kehTMRIVOZ5ubtO7w8WF+gU3sjYXMQtd5hH+wcv3uSE
+--- 72ntrRbWq8pdkk/GrsVupTttfY9t+w3l+2KQbQyNn/I
+iydìû$vVl TK$4G[€â· ©âMI[™#t—¹ °ôz:‰ñÍÙr9~½ESÃA»6Œ}×µ

secrets/kanidm-idm-admin-pass.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 84j9mw 8zYeVXx36dpC8TxMdoM1GdERoNNj902KwTF4h/r4inM
+n3mYra0BeM4gWsZ7Roilu14o/GajX1iWw0fcy0q31yc
+-> ssh-ed25519 GKhvwg cqd7YmVpbxqZxaVluHDZ8Yw0gNfJCKMmoWa4mEoXym8
+Gbcj+PJaqyPRRGX4olr7mmJ5IoEGlQaogYbj7i9E/98
+--- LoQPWI+m8s3NjalUh0+xdW54c8lgddBmhPoIiPbmR8I
+‘ê¢èÒ–Æœ܉ ÈY
+ž9˜ä­Å!4<>šÞ2DV³£P²·‘9¡N<C2A1>]G;ÎÏ?ˆÐ‰S± '

secrets/secrets.nix

@@ -97,4 +97,12 @@ in
     keys.system.ude
     keys.other.bootstrap
   ];
+  "kanidm-admin-pass.age".publicKeys = [
+    keys.system.kazuki
+    keys.other.bootstrap
+  ];
+  "kanidm-idm-admin-pass.age".publicKeys = [
+    keys.system.kazuki
+    keys.other.bootstrap
+  ];
 }

services/default.nix

@@ -2,5 +2,7 @@
   imports = [
     ./attic.nix
     ./forgejo-runner.nix
+    ./kanidm.nix
+    ./forgejo.nix
   ];
 }

services/forgejo.nix

@@ -0,0 +1,86 @@
+{
+  services.forgejo = {
+    host = "kazuki";
+    ports = [ 3000 ];
+    config =
+      { config, pkgs, ... }:
+      {
+        age.secrets.rab-lol-cf = {
+          file = ../secrets/rab-lol-cf.age;
+          owner = config.services.nginx.user;
+        };
+
+        services.forgejo = {
+          enable = true;
+          package = pkgs.forgejo;
+          settings = {
+            server = {
+              DOMAIN = "git.rab.lol";
+              ROOT_URL = "https://git.rab.lol/";
+            };
+            security = {
+              DISABLE_GIT_HOOKS = false;
+            };
+            oauth2_client = {
+              REGISTER_EMAIL_CONFIRM = false;
+              ENABLE_AUTO_REGISTRATION = true;
+              ACCOUNT_LINKING = "auto";
+              UPDATE_AVATAR = true;
+            };
+            service = {
+              DISABLE_REGISTRATION = false;
+              ALLOW_ONLY_INTERNAL_REGISTRATION = false;
+              ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+            };
+            federation.ENABLED = true;
+          };
+          repositoryRoot = "/storage-box/forgejo/repos";
+          lfs = {
+            enable = true;
+            contentDir = "/storage-box/forgejo/lfs";
+          };
+        };
+
+        systemd.tmpfiles.rules =
+          let
+            cfg = config.services.forgejo;
+            imgDir = pkgs.runCommand "forgejo-img-dir" { } ''
+              cp -R ${../assets/forgejo} "$out"
+            '';
+          in
+          [
+            "d '${cfg.customDir}/public' 0750 ${cfg.user} ${cfg.group} - -"
+            "d '${cfg.customDir}/public/assets' 0750 ${cfg.user} ${cfg.group} - -"
+            "L+ '${cfg.customDir}/public/assets/img' - - - - ${imgDir}"
+          ];
+
+        services.nginx = {
+          enable = true;
+          recommendedProxySettings = true;
+          recommendedGzipSettings = true;
+          recommendedOptimisation = true;
+          recommendedTlsSettings = true;
+          virtualHosts."git.rab.lol" = {
+            forceSSL = true;
+            enableACME = true;
+            acmeRoot = null;
+            locations."/" = {
+              proxyPass = "http://127.0.0.1:3000";
+              extraConfig = ''
+                proxy_set_header Connection $http_connection;
+                proxy_set_header Upgrade $http_upgrade;
+              '';
+            };
+          };
+        };
+
+        users.users.nginx.extraGroups = [ "acme" ];
+        security.acme.acceptTerms = true;
+        security.acme.certs."git.rab.lol" = {
+          dnsProvider = "cloudflare";
+          credentialsFile = config.age.secrets.rab-lol-cf.path;
+          email = "nikodem@rabulinski.com";
+        };
+      };
+  };
+}

services/kanidm.nix

@@ -0,0 +1,85 @@
+{
+  services.kanidm =
+    let
+      port = 8443;
+      domain = "auth.rabulinski.com";
+    in
+    {
+      host = "kazuki";
+      ports = [ port ];
+      config =
+        { config, pkgs, ... }:
+        let
+          cert = config.security.acme.certs.${domain};
+        in
+        {
+          age.secrets.rabulinski-com-cf = {
+            file = ../secrets/rabulinski-com-cf.age;
+            owner = config.services.nginx.user;
+          };
+          age.secrets.kanidm-admin-pass = {
+            file = ../secrets/kanidm-admin-pass.age;
+            owner = "kanidm";
+          };
+          age.secrets.kanidm-idm-admin-pass = {
+            file = ../secrets/kanidm-idm-admin-pass.age;
+            owner = "kanidm";
+          };
+
+          services.kanidm = {
+            enableServer = true;
+            package = pkgs.kanidmWithSecretProvisioning;
+            serverSettings = {
+              bindaddress = "127.0.0.1:${toString port}";
+              inherit domain;
+              origin = "https://${domain}";
+              trust_x_forward_for = true;
+              tls_chain = "${cert.directory}/fullchain.pem";
+              tls_key = "${cert.directory}/key.pem";
+            };
+            provision = {
+              enable = true;
+              idmAdminPasswordFile = config.age.secrets.kanidm-idm-admin-pass.path;
+              adminPasswordFile = config.age.secrets.kanidm-admin-pass.path;
+            };
+          };
+
+          systemd.services.kanidm.serviceConfig = {
+            SupplementaryGroups = [ cert.group ];
+          };
+
+          users.users.nginx.extraGroups = [ "acme" ];
+          networking.firewall.allowedTCPPorts = [
+            80
+            443
+          ];
+
+          services.nginx = {
+            enable = true;
+            recommendedProxySettings = true;
+            recommendedGzipSettings = true;
+            recommendedOptimisation = true;
+            recommendedTlsSettings = true;
+            virtualHosts."auth.rabulinski.com" = {
+              forceSSL = true;
+              enableACME = true;
+              acmeRoot = null;
+              locations."/" = {
+                proxyPass = "https://localhost:${toString port}";
+                proxyWebsockets = true;
+                extraConfig = ''
+                  proxy_ssl_verify off;
+                  proxy_ssl_name ${domain};
+                '';
+              };
+            };
+          };
+
+          security.acme.certs.${domain} = {
+            dnsProvider = "cloudflare";
+            credentialsFile = config.age.secrets.rabulinski-com-cf.path;
+            reloadServices = [ "kanidm" ];
+          };
+        };
+    };
+}