diff --git a/assets/forgejo/apple-touch-icon.png b/assets/forgejo/apple-touch-icon.png
new file mode 100644
index 0000000..78da40f
Binary files /dev/null and b/assets/forgejo/apple-touch-icon.png differ
diff --git a/assets/forgejo/avatar_default.png b/assets/forgejo/avatar_default.png
new file mode 100644
index 0000000..ce6f772
Binary files /dev/null and b/assets/forgejo/avatar_default.png differ
diff --git a/assets/forgejo/favicon.png b/assets/forgejo/favicon.png
new file mode 100644
index 0000000..f6e48b9
Binary files /dev/null and b/assets/forgejo/favicon.png differ
diff --git a/assets/forgejo/favicon.svg b/assets/forgejo/favicon.svg
new file mode 100644
index 0000000..7cf10f5
--- /dev/null
+++ b/assets/forgejo/favicon.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/assets/forgejo/logo.png b/assets/forgejo/logo.png
new file mode 100644
index 0000000..ca1d390
Binary files /dev/null and b/assets/forgejo/logo.png differ
diff --git a/assets/forgejo/logo.svg b/assets/forgejo/logo.svg
new file mode 100644
index 0000000..7cf10f5
--- /dev/null
+++ b/assets/forgejo/logo.svg
@@ -0,0 +1 @@
+
\ No newline at end of file
diff --git a/flake.nix b/flake.nix
index c49e260..821117f 100644
--- a/flake.nix
+++ b/flake.nix
@@ -65,6 +65,10 @@
# racket
"*.rkt"
"**/rashrc"
+
+ # custom assets
+ "*.png"
+ "*.svg"
];
settings.on-unmatched = "fatal";
};
diff --git a/hosts/kazuki/default.nix b/hosts/kazuki/default.nix
index df92f1c..8464cb5 100644
--- a/hosts/kazuki/default.nix
+++ b/hosts/kazuki/default.nix
@@ -15,7 +15,6 @@
./storage.nix
./ntfy.nix
./zitadel.nix
- ./forgejo.nix
./prometheus.nix
];
diff --git a/hosts/kazuki/forgejo.nix b/hosts/kazuki/forgejo.nix
deleted file mode 100644
index 9f200e2..0000000
--- a/hosts/kazuki/forgejo.nix
+++ /dev/null
@@ -1,62 +0,0 @@
-{ config, ... }:
-{
- age.secrets.rab-lol-cf = {
- file = ../../secrets/rab-lol-cf.age;
- owner = config.services.nginx.user;
- };
-
- services.forgejo = {
- enable = true;
- settings = {
- server = {
- DOMAIN = "git.rab.lol";
- ROOT_URL = "https://git.rab.lol/";
- };
- oauth2_client = {
- REGISTER_EMAIL_CONFIRM = false;
- ENABLE_AUTO_REGISTRATION = true;
- ACCOUNT_LINKING = "auto";
- UPDATE_AVATAR = true;
- };
- service = {
- DISABLE_REGISTRATION = false;
- ALLOW_ONLY_INTERNAL_REGISTRATION = false;
- ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
- };
- federation.ENABLED = true;
- };
- repositoryRoot = "/storage-box/forgejo/repos";
- lfs = {
- enable = true;
- contentDir = "/storage-box/forgejo/lfs";
- };
- };
-
- services.nginx = {
- enable = true;
- recommendedProxySettings = true;
- recommendedGzipSettings = true;
- recommendedOptimisation = true;
- recommendedTlsSettings = true;
- virtualHosts."git.rab.lol" = {
- forceSSL = true;
- enableACME = true;
- acmeRoot = null;
- locations."/" = {
- proxyPass = "http://127.0.0.1:3000";
- extraConfig = ''
- proxy_set_header Connection $http_connection;
- proxy_set_header Upgrade $http_upgrade;
- '';
- };
- };
- };
-
- users.users.nginx.extraGroups = [ "acme" ];
- security.acme.acceptTerms = true;
- security.acme.certs."git.rab.lol" = {
- dnsProvider = "cloudflare";
- credentialsFile = config.age.secrets.rab-lol-cf.path;
- email = "nikodem@rabulinski.com";
- };
-}
diff --git a/modules/system/containers.nix b/modules/system/containers.nix
index a0942f9..26e7e7e 100644
--- a/modules/system/containers.nix
+++ b/modules/system/containers.nix
@@ -85,6 +85,12 @@ let
services.openssh.hostKeys = [ ];
system.stateVersion = lib.mkDefault config.system.stateVersion;
+
+ networking.useHostResolvConf = false;
+ networking.nameservers = [
+ "1.1.1.1"
+ "1.0.0.1"
+ ];
};
bindMounts = {
@@ -95,6 +101,11 @@ let
privateNetwork = lib.mkForce true;
}
) config.settei.containers;
+
+ networking.nat = lib.mkIf (config.settei.containers != { }) {
+ enable = true;
+ internalInterfaces = [ "ve-+" ];
+ };
};
darwinConfig = lib.optionalAttrs (!isLinux) {
diff --git a/services/default.nix b/services/default.nix
index 1837462..dfee582 100644
--- a/services/default.nix
+++ b/services/default.nix
@@ -2,5 +2,6 @@
imports = [
./attic.nix
./forgejo-runner.nix
+ ./forgejo.nix
];
}
diff --git a/services/forgejo.nix b/services/forgejo.nix
new file mode 100644
index 0000000..4b9ea02
--- /dev/null
+++ b/services/forgejo.nix
@@ -0,0 +1,98 @@
+{
+ services.forgejo = {
+ host = "kazuki";
+ ports = [ 3000 ];
+ config =
+ { config, pkgs, ... }:
+ {
+ age.secrets.rab-lol-cf = {
+ file = ../secrets/rab-lol-cf.age;
+ owner = config.services.nginx.user;
+ };
+
+ services.forgejo = {
+ enable = true;
+ package = pkgs.forgejo;
+ settings = {
+ server = {
+ DOMAIN = "git.rab.lol";
+ ROOT_URL = "https://git.rab.lol/";
+ };
+ security = {
+ DISABLE_GIT_HOOKS = false;
+ };
+ oauth2_client = {
+ REGISTER_EMAIL_CONFIRM = false;
+ ENABLE_AUTO_REGISTRATION = true;
+ ACCOUNT_LINKING = "auto";
+ UPDATE_AVATAR = true;
+ };
+ service = {
+ DISABLE_REGISTRATION = false;
+ ALLOW_ONLY_INTERNAL_REGISTRATION = false;
+ ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+ };
+ session = {
+ SESSION_LIFE_TIME = 86400 * 30;
+ };
+ federation.ENABLED = true;
+ };
+ repositoryRoot = "/forgejo/repos";
+ lfs = {
+ enable = true;
+ contentDir = "/forgejo/lfs";
+ };
+ };
+
+ systemd.tmpfiles.rules =
+ let
+ cfg = config.services.forgejo;
+ imgDir = pkgs.runCommand "forgejo-img-dir" { } ''
+ cp -R ${../assets/forgejo} "$out"
+ '';
+ in
+ [
+ "d '${cfg.customDir}/public' 0750 ${cfg.user} ${cfg.group} - -"
+ "d '${cfg.customDir}/public/assets' 0750 ${cfg.user} ${cfg.group} - -"
+ "L+ '${cfg.customDir}/public/assets/img' - - - - ${imgDir}"
+ ];
+
+ services.nginx = {
+ enable = true;
+ recommendedProxySettings = true;
+ recommendedGzipSettings = true;
+ recommendedOptimisation = true;
+ recommendedTlsSettings = true;
+ virtualHosts."git.rab.lol" = {
+ forceSSL = true;
+ enableACME = true;
+ acmeRoot = null;
+ locations."/" = {
+ proxyPass = "http://127.0.0.1:3000";
+ extraConfig = ''
+ proxy_set_header Connection $http_connection;
+ proxy_set_header Upgrade $http_upgrade;
+ '';
+ };
+ };
+ };
+
+ users.users.nginx.extraGroups = [ "acme" ];
+ security.acme.acceptTerms = true;
+ security.acme.certs."git.rab.lol" = {
+ dnsProvider = "cloudflare";
+ credentialsFile = config.age.secrets.rab-lol-cf.path;
+ email = "nikodem@rabulinski.com";
+ };
+
+ fileSystems."/forgejo" = {
+ device = "/dev/disk/by-label/forgejo";
+ fsType = "btrfs";
+ options = [
+ "compress=zstd"
+ "noatime"
+ ];
+ };
+ };
+ };
+}