From 37f98eee1b8787bac99d3d2facb56d85364c05fb Mon Sep 17 00:00:00 2001
From: randogoth <kflux@posteo.de>
Date: Thu, 23 Jul 2026 11:39:18 +0200
Subject: [PATCH] added forgejo to code.randogoth.com

---
 flake.nix                    |  1 +
 modules/services/forgejo.nix | 35 +++++++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 modules/services/forgejo.nix

diff --git a/flake.nix b/flake.nix
index 905eb2e..5950c37 100644
--- a/flake.nix
+++ b/flake.nix
@@ -64,6 +64,7 @@
           ./modules/services/webhook-deploy.nix
           ./modules/services/jirorian.nix
           ./modules/services/oberon.nix
+          ./modules/services/forgejo.nix
           ./modules/services/nip05.nix
           ./modules/services/torrent-tracker.nix
           ./modules/services/backup.nix
diff --git a/modules/services/forgejo.nix b/modules/services/forgejo.nix
new file mode 100644
index 0000000..a8f1a89
--- /dev/null
+++ b/modules/services/forgejo.nix
@@ -0,0 +1,35 @@
+{ ... }:
+let
+  domain = "code.randogoth.com";
+  port = 3000; # localhost-only HTTP backend, proxied by Caddy
+in
+{
+  services.forgejo = {
+    enable = true;
+    database.type = "sqlite3"; # default; explicit for clarity
+    lfs.enable = true; # git-LFS support
+    settings = {
+      server = {
+        DOMAIN = domain;
+        ROOT_URL = "https://${domain}/";
+        HTTP_ADDR = "127.0.0.1";
+        HTTP_PORT = port;
+        DISABLE_SSH = true; # HTTPS-only git access
+      };
+      service = {
+        DISABLE_REGISTRATION = true; # admin creates accounts
+      };
+      # Quiet, sane defaults for a private instance.
+      "repository".DEFAULT_PRIVATE = "private";
+      session.COOKIE_SECURE = true;
+      log.LEVEL = "Info";
+    };
+  };
+
+  # Caddy reverse proxy fragment — picked up via the glob import in caddy.nix.
+  environment.etc."caddy/Caddyfile.d/forgejo.caddyfile".text = ''
+    ${domain} {
+      reverse_proxy localhost:${toString port}
+    }
+  '';
+}