bound the forge's SSO source setup and retry it with a growing delay

nix/host-modules/hive-forge/default.nix

@@ -113,6 +113,9 @@ let
   oneWord = path: builtins.match ".*[[:space:]].*" path == null;
   forwarderCredential = id: "/run/credentials/${forwarderUnit}.service/${id}";
   mintUnit = "forgejo-swarm-controller-account";
+  # `timeout` arguments for the forgejo calls that fetch the issuer's discovery
+  # document; the CLI has no client timeout of its own.
+  ssoCallTimeout = "--kill-after=3 20";
   mintCredential = id: "/run/credentials/${mintUnit}.service/${id}";
 
   # ROOT_URL forgejo advertises in clone links + outbound URLs.
@@ -897,7 +900,10 @@ in
             after = [ "forgejo.service" ];
             requires = [ "forgejo.service" ];
             wantedBy = [ "multi-user.target" ];
-            serviceConfig = {
+            # ../lib/store-retry.nix: a secret that is not there yet, or an
+            # authelia that is not answering, is retried.
+            inherit (storeRetry) startLimitBurst startLimitIntervalSec;
+            serviceConfig = storeRetry.serviceConfig // {
               Type = "oneshot";
               RemainAfterExit = true;
               User = "forgejo";
@@ -907,6 +913,14 @@ in
               # it, and this unit fails to start until then; that unit starts
               # it again once the file is written.
               LoadCredential = [ "oidc-client-secret:${oidcSecretPath}" ];
+              # This unit is in the boot wait of a container with a one-minute
+              # start limit. Each registration call is capped at 20 s, so an
+              # authelia that never answers fails the attempt, and the growing
+              # delay below retries it.
+              TimeoutStartSec = 30;
+              RestartSec = 5;
+              RestartSteps = 6;
+              RestartMaxDelaySec = 300;
             };
             # `FORGEJO_CUSTOM` (the forgejo-prefixed name, not `GITEA_CUSTOM`)
             # is how the CLI finds the app.ini upstream's module wrote.
@@ -966,12 +980,12 @@ in
                 id=$(forgejo admin auth list \
                   | grep "[[:space:]]${ssoSourceName}[[:space:]]" \
                   | cut -f1)
-                forgejo admin auth update-oauth --id "$id" \
+                timeout ${ssoCallTimeout} forgejo admin auth update-oauth --id "$id" \
                   --name ${lib.escapeShellArg ssoSourceName} \
                   --secret "$secret" "''${args[@]}"
                 echo "updated OIDC login source ${ssoSourceName} (id $id)"
               else
-                forgejo admin auth add-oauth \
+                timeout ${ssoCallTimeout} forgejo admin auth add-oauth \
                   --name ${lib.escapeShellArg ssoSourceName} \
                   --secret "$secret" "''${args[@]}"
                 echo "added OIDC login source ${ssoSourceName}"