xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions

set secrets from old instance

Browse source
This commit is contained in:
XenGi 2026-08-06 23:34:48 +02:00
commit 51fd337088
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
5 changed files with 45 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

30
hosts/git/forgejo.nix
View file

@ -23,6 +23,7 @@ in
SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
};
oauth2.JWT_SECRET = config.age.secrets.forgejo-oauth2-jwt-token.path;
};
settings = {
security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";
@ -32,6 +33,19 @@ in
DOMAIN = fqdn;
PROTOCOL = "http+unix";
ROOT_URL = "https://${fqdn}:443";
OFFLINE_MODE = true; # disable gravatar, CDN
LANDING_PAGE = "explore";
};
openid.ENABLE_OPENID_SIGNUP = true;
oauth2_client = {
ENABLE_AUTO_REGISTRATION = true;
ACCOUNT_LINKING = "login";
USERNAME = "nickname";
};
service = {
DISABLE_REGISTRATION = false;
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
AUTO_WATCH_NEW_REPOS = false;
};
mailer = {
ENABLED = true;
@ -40,6 +54,12 @@ in
SENDMAIL_PATH = "${pkgs.msmtp}/bin/msmtp";
SENDMAIL_ARGS = "--";
};
cors = {
ENABLED = false;
ALLOW_DOMAIN = "https://git.berlin.ccc.de";
ALLOW_CREDENTIALS = true;
};
metrics.ENABLED = true;
};
lfs.enable = true;
dump = {
@ -58,11 +78,11 @@ in
};
};
#openssh.extraConfig = ''
# Match User git
# AcceptEnv GIT_PROTOCOL
# PerSourcePenalties no
#'';
openssh.extraConfig = ''
Match User forgejo
AcceptEnv GIT_PROTOCOL
PerSourcePenalties no
'';
nginx.virtualHosts."${fqdn}" = {
quic = true;