xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

Browse source
This commit is contained in:
XenGi 2026-08-20 22:55:08 +02:00
commit 2972bf312e
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
4 changed files with 52 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

2
hosts/git/default.nix
View file

@ -40,5 +40,5 @@
'';
services.openssh.settings.Banner = "/etc/ssh/banner";
system.stateVersion = "25.11";
system.stateVersion = "26.05";
}

9
hosts/git/forgejo.nix
View file

@ -23,10 +23,9 @@ in
SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
};
oauth2.JWT_SECRET = config.age.secrets.forgejo-oauth2-jwt-token.path;
oauth2.JWT_SECRET = lib.mkDefault config.age.secrets.forgejo-oauth2-jwt-secret.path;
};
settings = {
security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";
session.COOKIE_SECURE = true;
log.LEVEL = "Warn";
server = {
@ -78,12 +77,6 @@ in
};
};
openssh.extraConfig = ''
Match User forgejo
AcceptEnv GIT_PROTOCOL
PerSourcePenalties no
'';
nginx.virtualHosts."${fqdn}" = {
quic = true;
kTLS = true;

27
hosts/www/nginx.nix
View file

@ -78,7 +78,7 @@ in
'';
};
"/all.ics" = {
return = "301 https://www.berlin.ccc.de/calendars/all.ics";
return = "301 https://$host/calendars/all.ics";
};
"~ ^/calendars/([^/]+\.ics)$" = {
alias = "/srv/http/calendars/$1";
@ -97,11 +97,26 @@ in
kTLS = true;
forceSSL = true;
enableACME = true;
locations."/" = {
basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
root = "/srv/http/www-staging";
index = "index.html";
tryFiles = "$uri $uri/ $uri.html =404";
locations = {
"/" = {
basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
root = "/srv/http/www-staging";
index = "index.html";
tryFiles = "$uri $uri/ $uri.html =404";
};
"/all.ics" = {
return = "301 https://$host/calendars/all.ics";
};
"~ ^/calendars/([^/]+\.ics)$" = {
alias = "/srv/http/calendars/$1";
extraConfig = ''
add_header Cache-Control "no-cache";
types {
text/calendar ics;
}
default_type text/calendar;
'';
};
};
};
};