52 lines
1.8 KiB
Nix
52 lines
1.8 KiB
Nix
{ ... }:
|
|
let
|
|
domain = "code.randogoth.com";
|
|
port = 3000; # localhost-only HTTP backend, proxied by Caddy
|
|
in
|
|
{
|
|
services.forgejo = {
|
|
enable = true;
|
|
database.type = "sqlite3"; # default; explicit for clarity
|
|
lfs.enable = true; # git-LFS support
|
|
settings = {
|
|
server = {
|
|
DOMAIN = domain;
|
|
ROOT_URL = "https://${domain}/";
|
|
HTTP_ADDR = "127.0.0.1";
|
|
HTTP_PORT = port;
|
|
# Git-over-SSH via Forgejo's built-in server on a dedicated port.
|
|
START_SSH_SERVER = true;
|
|
SSH_PORT = 2222; # advertised in clone URLs
|
|
SSH_LISTEN_PORT = 2222; # built-in server listen port
|
|
SSH_USER = "git"; # login user in clone URLs (default is the run user)
|
|
BUILTIN_SSH_SERVER_USER = "git"; # login user the built-in server accepts
|
|
# SSH_DOMAIN defaults to DOMAIN (code.randogoth.com)
|
|
};
|
|
service = {
|
|
DISABLE_REGISTRATION = true; # admin creates accounts
|
|
};
|
|
# Quiet, sane defaults for a private instance.
|
|
"repository".DEFAULT_PRIVATE = "private";
|
|
session.COOKIE_SECURE = true;
|
|
log.LEVEL = "Info";
|
|
};
|
|
};
|
|
|
|
# System-wide SSH client config so root (the nix daemon) can fetch the private
|
|
# Forgejo flake inputs, mirroring the Codeberg block in webhook-deploy.nix.
|
|
# Reuses the existing /etc/ssh/codeberg_id_ed25519 deploy key (its public half
|
|
# is registered on the randogoth Forgejo account).
|
|
programs.ssh.extraConfig = ''
|
|
Host ${domain}
|
|
Port 2222
|
|
IdentityFile /etc/ssh/codeberg_id_ed25519
|
|
StrictHostKeyChecking accept-new
|
|
'';
|
|
|
|
# Caddy reverse proxy fragment — picked up via the glob import in caddy.nix.
|
|
environment.etc."caddy/Caddyfile.d/forgejo.caddyfile".text = ''
|
|
${domain} {
|
|
reverse_proxy localhost:${toString port}
|
|
}
|
|
'';
|
|
}
|