Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

flake.nix

@@ -23,7 +23,8 @@
     in
     {
       formatter.${system} = pkgs.nixfmt-tree;
-      apps.nixos-diff = {
+      apps = {
+        nixos-diff = {
           type = "app";
           program = "${pkgs.writeShellScript "nixos-diff.sh" ''
             ${pkgs.git}/bin/git checkout flake.lock
@@ -33,6 +34,19 @@
             ${pkgs.nvd}/bin/nvd diff /run/current-system ./result
           ''}";
         };
+        deploy = {
+          type = "app";
+          program = "${pkgs.writeShellScript "deploy.sh" ''
+            set -e
+            host="''${1:?usage: nix run .#apps.deploy -- <host>}"
+            ${pkgs.openssh}/bin/ssh -t "$host" 'bash -s' <<'EOF'
+            set -e
+            cd /etc/nixos
+            nix run .#apps.nixos-diff && nixos-rebuild switch
+            EOF
+          ''}";
+        };
+      };
       devShells.${system}.default = pkgs.mkShell {
         packages = [
           (agenix.packages.${system}.default)
@@ -256,6 +270,12 @@
                 group = "forgejo";
                 mode = "0440";
               };
+              forgejo-oauth2-jwt-secret = {
+                file = ./secrets/forgejo-oauth2-jwt-secret.age;
+                owner = "forgejo";
+                group = "forgejo";
+                mode = "0440";
+              };
               forgejo-runner-token-snowden = {
                 file = ./secrets/forgejo-runner-token-snowden.age;
                 owner = "root";

hosts/git/default.nix

@@ -40,5 +40,5 @@
   '';
   services.openssh.settings.Banner = "/etc/ssh/banner";
 
-  system.stateVersion = "25.11";
+  system.stateVersion = "26.05";
 }

hosts/git/forgejo.nix

@@ -23,10 +23,9 @@ in
           SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
           INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
         };
-        oauth2.JWT_SECRET = config.age.secrets.forgejo-oauth2-jwt-token.path;
+        oauth2.JWT_SECRET = lib.mkDefault config.age.secrets.forgejo-oauth2-jwt-secret.path;
       };
       settings = {
-        security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";
         session.COOKIE_SECURE = true;
         log.LEVEL = "Warn";
         server = {
@@ -78,12 +77,6 @@ in
       };
     };
 
-    openssh.extraConfig = ''
-      Match User forgejo
-        AcceptEnv GIT_PROTOCOL
-        PerSourcePenalties no
-    '';
-
     nginx.virtualHosts."${fqdn}" = {
       quic = true;
       kTLS = true;

hosts/www/nginx.nix

@@ -78,7 +78,7 @@ in
           '';
         };
         "/all.ics" = {
-          return = "301 https://www.berlin.ccc.de/calendars/all.ics";
+          return = "301 https://$host/calendars/all.ics";
         };
         "~ ^/calendars/([^/]+\.ics)$" = {
           alias = "/srv/http/calendars/$1";
@@ -97,12 +97,27 @@ in
       kTLS = true;
       forceSSL = true;
       enableACME = true;
-      locations."/" = {
+      locations = {
+        "/" = {
           basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
           root = "/srv/http/www-staging";
           index = "index.html";
           tryFiles = "$uri $uri/ $uri.html =404";
         };
+        "/all.ics" = {
+          return = "301 https://$host/calendars/all.ics";
+        };
+        "~ ^/calendars/([^/]+\.ics)$" = {
+          alias = "/srv/http/calendars/$1";
+          extraConfig = ''
+            add_header Cache-Control "no-cache";
+            types {
+              text/calendar ics;
+            }
+            default_type text/calendar;
+          '';
+        };
+      };
     };
   };
 }