From 51fd337088a4e8a4c05267d7d2523c15392cb5f9 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Thu, 6 Aug 2026 23:34:48 +0200 Subject: [PATCH] set secrets from old instance --- hosts/git/forgejo.nix | 30 +++++++++++++++++++++----- secrets/forgejo-internal-token.age | Bin 1088 -> 1088 bytes secrets/forgejo-oauth2-jwt-secret.age | 19 ++++++++++++++++ secrets/forgejo-secret-key.age | Bin 1026 -> 1047 bytes secrets/secrets.nix | 1 + 5 files changed, 45 insertions(+), 5 deletions(-) create mode 100644 secrets/forgejo-oauth2-jwt-secret.age diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix index dd743d2..523f3d8 100644 --- a/hosts/git/forgejo.nix +++ b/hosts/git/forgejo.nix @@ -23,6 +23,7 @@ in SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path; INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path; }; + oauth2.JWT_SECRET = config.age.secrets.forgejo-oauth2-jwt-token.path; }; settings = { security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all"; @@ -32,6 +33,19 @@ in DOMAIN = fqdn; PROTOCOL = "http+unix"; ROOT_URL = "https://${fqdn}:443"; + OFFLINE_MODE = true; # disable gravatar, CDN + LANDING_PAGE = "explore"; + }; + openid.ENABLE_OPENID_SIGNUP = true; + oauth2_client = { + ENABLE_AUTO_REGISTRATION = true; + ACCOUNT_LINKING = "login"; + USERNAME = "nickname"; + }; + service = { + DISABLE_REGISTRATION = false; + ALLOW_ONLY_EXTERNAL_REGISTRATION = true; + AUTO_WATCH_NEW_REPOS = false; }; mailer = { ENABLED = true; @@ -40,6 +54,12 @@ in SENDMAIL_PATH = "${pkgs.msmtp}/bin/msmtp"; SENDMAIL_ARGS = "--"; }; + cors = { + ENABLED = false; + ALLOW_DOMAIN = "https://git.berlin.ccc.de"; + ALLOW_CREDENTIALS = true; + }; + metrics.ENABLED = true; }; lfs.enable = true; dump = { @@ -58,11 +78,11 @@ in }; }; - #openssh.extraConfig = '' - # Match User git - # AcceptEnv GIT_PROTOCOL - # PerSourcePenalties no - #''; + openssh.extraConfig = '' + Match User forgejo + AcceptEnv GIT_PROTOCOL + PerSourcePenalties no + ''; nginx.virtualHosts."${fqdn}" = { quic = true; diff --git a/secrets/forgejo-internal-token.age b/secrets/forgejo-internal-token.age index 01eb486eef5dd4511b74e1e12d0b0340c7fcb7da..f12e1fce04220425df69e973f784f718ec1a7446 100644 GIT binary patch delta 1001 zcmX@Wae!ljPQ9CXuyb~pXH{6XhoM1Gg}%R2Vx?0?k$G@sRh5r#giEMpWlofNq?37g zAXk8oPqL4nNqDG*QAC<{cy3^dTbXf+OL&2?e^#VVWVK7qbmWw~bM z;qHYYNh#)L7FA9L9-eNc-c{+zz5%I;NuE*O`st~TnI&N^VQv zJW71ZOZ1&waw<*DazfJ!O3nQ(3N6yzJu}KDpJf!UPYQ~%3@}bMiPARk(KpR2EzmE? z2z1XW3rKc!&(1X|bTi5;4RQ5ww{R@y@+t^4we(CWOD?u_);4hRw=nY1cXl!f%dm8E zOf@kpNw@U!G78rZ$u~DZj{!IL0#n0ug`i}A^AwBhp!`7Zvb>Ch z0Amx6^D=Th!vey~oI?C^E6PL66GJnyi@YPF%3Ok- z>Wwm!y-f5o^OCtNi~~bbBK5N~GfMLEof7p+JS*~(60?1Z3L=fmybTJROEOccv@-(} zoiNguN1~r|V!A@Ix2b<}aA0y~S&4H*n1Po`uu)KYqJ^=Ow})Sjfm4c$QA${nN12yN5@zc6eE$YjP-;uCA^^ zgmbZXPNH9WVPR@Txo<^Ips{~auB(%!wySw*m`g=uQb<@O=d+H04Wj!3=LXMp)6#1WKlovmRZsOfxmo!|uUI3N mF+|AL?(mo)HNiCev5I8EZS!!sCXbtc)WmqY+5W{j1p)wrF;_AG delta 1001 zcmX@Wae!ljPJO7ES7KSIxkpBRhKEV9ex7MSzH>oxk+y$?dsQMY4NpEOu0fewes+*&QI&5|wr{YTaekh*1(&X!LUD11 zZfc5=si~o*f@_&iQh2$7ezsdwwxN@&wyAl5p;@Vmms_DxMOKwrSZY9(wqZ%6k&~Zy zx_O>qfw5yCSE7ETd2w)fSb3DYv1ev-d2peRv6-P+d6s@isb#oJQbeeKhJj_CS6X=J z#E;_Pq2|fuN#S{g<*E8Xe$JLrre&u26A_(cuBP7Uf!7D^u0e*hw-ubD%hOQ=);~B-nbHZK20*VbH za|6>XJOYZ!%%dEG%FQ!9O^ZwY^Yjfvi~Z8P-CV0O0<%oGGChhcO|y)=yvvKtiyQ;B z3&K6B!b8i=lQRN*3nEjT0z%U>LW}b)!qNgKpJf!U&o{HkOxDlOPx4O5C^9!Th{($i zh_Xx%2sVgHarQUyEOAT@D$nrA2}#f9$}BDNE;lq!%XiE0EYr?+Pj@X#bj#0;@XRX+ zNit3KEAwzH^)E{<4R=pRj{!IL0#n0ug_7bj$AZ$Zl)!?Nyebn*j=?960;?EufhkkYi|5)UiOvmtmRD*K2sASKe zl*-DoyyB8#S9I%=O#L%M0u@TU3Q~-c(o?+h(@Y|L(o2l;{9H03^TUk%5*^FDa-!TE z>phE1LcB9f+={s}D$BEtsseKogS~T;0xLa?GQIpl3{CvXib~53jVdiN^GZWf-Ll*h z6Ft$b^GNh_PE1$GuPSsi^sEf>4fiX~E-g+9cXIMK$xJIvGj?)y%Xdo2O7nIs_6>A$ zH%jL6GYK#7uF9^D@^s27E-~>p3^g}0_w)Dl&-HdmF--EQic0k|^D{873NKIQ($&>f zaI0|jDlPFW)7K8w_ce|R_VY^fO$;=3%Plm@4XShu$O`pJE=t!nuW)9AS-|V_qmY!;r#vuk*B_eimyAEkigx@UsYLkTJ3-2zQ|`y zl3Lvy=YM)h8e8ma*c+PrN;*$O;avKzZ8t7mk>J^C^x>d$$IsZkELm|LPwr*D^4Byz n8yClL)lJ%wk^9!MYj)eCmfSq*ap|6j;=47=6g2m24EO~Ah{9Y= diff --git a/secrets/forgejo-oauth2-jwt-secret.age b/secrets/forgejo-oauth2-jwt-secret.age new file mode 100644 index 0000000..9575e4a --- /dev/null +++ b/secrets/forgejo-oauth2-jwt-secret.age @@ -0,0 +1,19 @@ +age-encryption.org/v1 +-> ssh-ed25519 uH+n1w KI9l4sauYEJDyxjDLmb7XpFa1p0+pBecGEvaIikdfX0 +YqsPwm2QL/04tJmnEByFa8D2sPwuwqbOUtqLCUq4Te0 +-> ssh-ed25519 EvLbWw HQIKS0fya9C0bNEt9tTzZcd1FN4ubwIRzpcWREHy0Do +TYPC+2F8ibv0ZE51fXpG+oO7QqqAB+zpdOiy6ArRkB4 +-> ssh-ed25519 dM+fLQ 3WVonBlN4+uU0j10FQUTGTAG7MIQRyK2sf+memWx/CQ +8/6x7MjeIdIAhaMalsBLAQ84VO2nOtapmAO7SGNzd1E +-> ssh-ed25519 jxWM2Q bjQkARCVy2+9YnNQ6CJZ3s0GvrOIwIb7pEvupGw8cy0 +g8E4dwFNCr3q6c69XoLe/S5hUTyX80cahpHcurNYpao +-> ssh-ed25519 /yCUCg z0gLuz8/GNf97GpRlbnFmFlsyMplMUmms+IAj8IBfTs +nYodZX4Bm9DBZ3ojJtcOOlhIPMfxpoTpakU7o98qqeA +-> ssh-ed25519 FGp51g D6nK7ZUod/AlAp5+76yZHVCko8Y+KH3/ZYHhKqSFc0U +vE9T4FXxKKKIvYZwucPKpWaB/KtjAj9BNAhQJ5GBEcU +-> ssh-ed25519 b5OiTQ G65Cax9YgCn7Xvwa5kI2scWdt4tSAForrpHEmV2lG08 +14pdLMWG4Uy5N57aKCqahsHh4SdKoCCKepT3zYZhxTs +-> ssh-ed25519 HaNCag mA0JV8IXeHuOd92Buf0UxoH9zioZuB2/Whuxs927n0c +C4OacOAJXCI/fIs6fCIKoDWZKg8MMZTsolHSnkP9BAc +--- 0VQUZSYlQ/1evWAzs+XAPnQGytUFI7FJsR2w68tx8k4 +D/x,j?Qߋ߀=l}y+ pd#:;БbWڨ핾5Yxes&v \ No newline at end of file diff --git a/secrets/forgejo-secret-key.age b/secrets/forgejo-secret-key.age index c444ed90c9a400ff3cf121f1837b7d1a28cf87ba..fc9784ba7831f2fd4996cd36f6ca674751c115d9 100644 GIT binary patch delta 960 zcmZqTn9ealr`{mMIHb@hsLawUu`n_u&B)szsw^nWwOqflAiyHeEGyWuBFrbn%sImrK`9p}06h zH#Nn`)YQ;Y!L`gMDZE@ELfb_@-!#$5FWsX&-P12Q*v;3_GBY{3u*56Mzp^4L+&w+S zJKW66IMUsd%iGku!qV9#$SkF*G$<^wC@Ct*-=eZSrQEg3FFhbYKgC7gz|F@wC@a!+ z;z#lDjM6kSx3qLacdumQ9M`I%Vv9`o!nCB^sFcV8|I!?n;LJcLZ%@OBQo~}doSabC zipYYJ{1m5bv%IR5U}KkHuTV#WfPBY@N=xnZ$|Qp_&mhZG!$_0K@r>f(`BhPlRZcEO zP8NkBrRJI1ZYKUlrP{73*%2YRRlyNS{vHQ3F7A%r6-g|NGmRL9zrAK5~RFt|0 zd$@%=re+)FJNdg*B&PXPgk@T|nFLvIB^8*KrB~)uB^Bm{`1u+8lz63tl=>xBRwQS8 zg?X418HPp`1V;vXCYL*+$AFuAfvI7-LY7;3QD9_BzCl5jg{4V$xo^E&eo0n?M^#}}eu9iGGN&w`obSW1?ePvZ04(QFxd|V1T7hYKEV`LArTz zSdwXRNU^79Il6U8rv8~BfeMjEJ~^SqK1t=p?v9?0=24}VVFudaE-qnif&O^`ZY8ez z^%mZRxlxto?#WzX<>iHCW@YY{k(rel-oX+2d1b*Fe!1RJg_R!K6=i0=PF@)X?&c{K zW$EbFc_jKdC#EY@CV7OXCi)d+mFBorCY47R7?y?^85>4;>nCNJWtgP8Sw?!5`f3NH z=azG&nw7caxw+Sy>Ia&eXXk~u80Lm}W)^#-T7-wVc;@H(M;4XjIiFVk# zcoiB42L!kjYnxTMM|wo1yBVeiyXE9oMi^wIB^Fi%CuVsin60gTK`b)=so(qu7FR@-7230TrYy-x2)60J#(QAR;wuX@%zdL~rWiDRoO3uZ)>Y+r wVvfuEWU1#frwVOTeJt|y%!f6{*S8)iWy>v$yd%H4>5TNj;!Uv(KXvZ`02c&C_5c6? delta 939 zcmbQv(Zn%9r#{co&ndVs3_#FR9D<3bZBlYF1hP}fpF6ZfpZ@|^4}%Z#u<&-{|CqO|;+#7svnKUYs@ z1Jh);%v{qd-}GcJOV<>a%Bafh694?9qCoxZLXVK7ybzzPoPzYp@r>f(QTY*RuA$`~ z$)@H(>4rh&<&i;VPLUDLLHPy7QI-|P+9hVLxsHBWl|kiPg$DU~+F^#tl_`ckxyix7 z=~c-&QLZWJ8NP*uiRocwE{kB}g@gqr<@pEY=H}_A=Z0jZmqvN|`e%g{1SKa1 zTUdDM7pG@9IcDX09L1daqa;1J)slT_jccOb~ za$!|QjzL+TFS>O}rv8~BfeMvnmKJ{H-e&G5UPd`a#Tkypu4So-ZU#XCmSx6fS(zqb z^&b8i*@^B!Ipti5B~?*Am7$R#?(RnB+WJZ9!I2piq2^&;rf%9{IYqv~A!bQtAt^>t z8QJL8c_jKdC#EZe=Y}}@ho$BFd-!M<=DC)6n|KvDStjL&r+WsbgzA@sWQJzsR~Gxa zI=XTNgr!y`8>ZHmnYt!MxTKmCN90vRFVk# z6MC{(3|wXI#q$)e)m?<+WF_camFwFxmdyOt&)I=L&7c|v5&{P(t<9p aw6D7{L&rJnoz&;mE^&!JW-BN@oeTivyF%Ll diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 3148b96..14e5f9c 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -68,4 +68,5 @@ in "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; + "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; }