From f68ede169561b67b02cf86ef77c99b85d8ce0bd2 Mon Sep 17 00:00:00 2001 From: "Ricardo (XenGi) Band" Date: Fri, 31 Jul 2026 19:50:27 +0200 Subject: [PATCH] add forgejo --- flake.nix | 28 ++++++ hosts/git/default.nix | 1 + hosts/git/forgejo-runner.nix | 52 ++++++++++ hosts/git/forgejo.nix | 98 +++++++++++++++++++ secrets/forgejo-internal-token.age | Bin 0 -> 1088 bytes secrets/forgejo-runner-token-snowden-env.age | 19 ++++ secrets/forgejo-runner-token-snowden.age | Bin 0 -> 989 bytes secrets/forgejo-secret-key.age | 19 ++++ secrets/postgres-forgejo.age | 34 ++++--- secrets/secrets.nix | 11 ++- 10 files changed, 243 insertions(+), 19 deletions(-) create mode 100644 hosts/git/forgejo-runner.nix create mode 100644 hosts/git/forgejo.nix create mode 100644 secrets/forgejo-internal-token.age create mode 100644 secrets/forgejo-runner-token-snowden-env.age create mode 100644 secrets/forgejo-runner-token-snowden.age create mode 100644 secrets/forgejo-secret-key.age diff --git a/flake.nix b/flake.nix index d85717c..aa0caea 100644 --- a/flake.nix +++ b/flake.nix @@ -236,6 +236,34 @@ modules = [ agenix.nixosModules.default { environment.systemPackages = [ (agenix.packages.${system}.default) ]; } + { + age.secrets = { + forgejo-internal-token = { + file = ./secrets/forgejo-internal-token.age; + mode = "440"; + owner = "forgejo"; + group = "forgejo"; + }; + forgejo-secret-key = { + file = ./secrets/forgejo-secret-key.age; + mode = "440"; + owner = "forgejo"; + group = "forgejo"; + }; + forgejo-runner-token-snowden = { + file = ./secrets/forgejo-runner-token-snowden.age; + mode = "444"; + owner = "root"; + group = "root"; + }; + forgejo-runner-token-snowden-env = { + file = ./secrets/forgejo-runner-token-snowden-env.age; + mode = "444"; + owner = "root"; + group = "root"; + }; + }; + } ./hosts/git ]; }; diff --git a/hosts/git/default.nix b/hosts/git/default.nix index 11598f1..5ccac8b 100644 --- a/hosts/git/default.nix +++ b/hosts/git/default.nix @@ -6,6 +6,7 @@ ../../services/openssh.nix ../../services/prometheus-node.nix ./forgejo.nix + #./forgejo-runner.nix ]; networking = { diff --git a/hosts/git/forgejo-runner.nix b/hosts/git/forgejo-runner.nix new file mode 100644 index 0000000..b9652bb --- /dev/null +++ b/hosts/git/forgejo-runner.nix @@ -0,0 +1,52 @@ +{ config, pkgs, ... }: + +{ + services.gitea-actions-runner = { + package = pkgs.forgejo-runner; + instances.yuka = { + enable = true; + name = "yuka"; + url = "https://git.sb20.xengi.de"; + labels = [ + "debian-stable:docker://docker.io/debian:stable-slim" + "alpine-latest:docker://docker.io/alpine:latest" + "buildkit:docker://docker.io/moby/buildkit:rootless" + ]; + tokenFile = config.age.secrets.forgejo-runner-token-env.path; + settings = { + runner.labels = { + debian-stable = { + backend = "docker"; + backend-options = { + image = "docker.io/debian:stable-slim"; + platform = "linux/amd64"; + }; + }; + alpine-latest = { + backend = "docker"; + backend-options = { + image = "docker.io/alpine:latest"; + platform = "linux/amd64"; + }; + }; + buildkit = { + backend = "docker"; + backend-options = { + image = "docker.io/moby/buildkit:rootless"; + platform = "linux/amd64"; + }; + }; + }; + server.connections.forgejo = { + url = "https://git.sb20.xengi.de/"; + uuid = "f16ffc21-eb17-4595-ba54-eac00a6f1fa4"; + token_url = "file://${config.age.secrets.forgejo-runner-token.path}"; + }; + container = { + enable_ipv6 = true; + docker_host = "unix:///run/podman/podman.sock"; + }; + }; + }; + }; +} diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix new file mode 100644 index 0000000..1a78101 --- /dev/null +++ b/hosts/git/forgejo.nix @@ -0,0 +1,98 @@ +{ + lib, + config, + pkgs, + ... +}: + +let + fqdn = "git.${config.networking.domain}"; +in +{ + imports = [ + ../../services/nginx.nix + ../../services/prometheus-nginx.nix + ]; + + services = { + forgejo = { + enable = true; + package = pkgs.forgejo; + secrets = { + security = { + SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path; + INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path; + }; + }; + settings = { + security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all"; + session.COOKIE_SECURE = true; + log.LEVEL = "Warn"; + server = { + DOMAIN = fqdn; + PROTOCOL = "http+unix"; + ROOT_URL = "https://${fqdn}:443"; + }; + mailer = { + ENABLED = true; + FROM = "admin@berlin.ccc.de"; + PROTOCOL = "sendmail"; + SENDMAIL_PATH = "${pkgs.msmtp}/bin/msmtp"; + SENDMAIL_ARGS = "--"; + }; + }; + lfs.enable = true; + dump = { + enable = true; + type = "tar.zst"; + interval = "daily"; + }; + database = { + createDatabase = false; + host = "sql.${config.networking.domain}"; + name = "git"; + passwordFile = config.age.secrets.postgresql_forgejo.path; + port = 5432; + user = "git"; + type = "postgres"; + }; + }; + + #openssh.extraConfig = '' + # Match User git + # AcceptEnv GIT_PROTOCOL + # PerSourcePenalties no + #''; + + nginx.virtualHosts."${fqdn}" = { + quic = true; + kTLS = true; + forceSSL = true; + enableACME = true; + extraConfig = '' + merge_slashes off; # Required to handle URL-encoded slashes + ''; + locations = { + "/" = { + recommendedProxySettings = true; + proxyWebsockets = true; + proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; + extraConfig = '' + client_max_body_size 512M; + ''; + }; + "/metrics" = { + recommendedProxySettings = true; + proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; + extraConfig = '' + allow 195.160.173.14; + allow 2001:678:760:cccb::14; + deny all; + ''; + }; + }; + }; + }; + + security.acme.certs."${fqdn}".reloadServices = [ "nginx" ]; +} diff --git a/secrets/forgejo-internal-token.age b/secrets/forgejo-internal-token.age new file mode 100644 index 0000000000000000000000000000000000000000..01eb486eef5dd4511b74e1e12d0b0340c7fcb7da GIT binary patch literal 1088 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSH_0Y~UELR9M^GYl$ zHTTHK&+srQ*3UBy$agMCF4Fdoa8Jug@+k6(vPgChF!T-z59A8aPD~DQ2?#JNN{!Uk z_DuFLEG^D4%QYx-%g+w-EUNM?%JvO*GtSS`wm`Sdwah0eyj(#)+bt^F(8*QX)I7k@ ztklJ;(5ND-$}B83pi0}YB+|&q&pX{b&#=JQF_0@!KhnH7I6SO8%H7yAGr2st(8t)! z(5yU5Kcv($+$AX@)IY<(GS4e5JQUrw6kqK$pFo9B^W^fR@VvtERQ(`7XUizlGSmDD zuMF>y?3D820?!C@|ME;Dm*8CYa0{-$ia@8R5R0V3G*iR$;IIr=Q}6UZ?<&LW z&+y3!NzdlWEG_abH#ASncgyfB)6REKcP&eF%g>GQ%qs{^KdNnFH0^BcTY#R z&CR{Q)G%G4q`1tnpfoHcuplL`%EZz*D5J{6U*A76LfvTEV8If+tl03D94v8 z&p$ge*5)g{w0JRsGe+$}2EGbp99vMjH-q}UbRwj@*k%#c8Z z60d?3qoni{ulzKVNT2i)qdY&CjL7^jBfmt)GOwH{H%HGRlMwF=6SrcnjLPzCqpHB1 z#9;5-q`*oKqf9Tq5JMBcvZB&*L!(NI%)HW&RJSbm#6(YY+dLBeoDMgC{7k|NysNUKJe{(NOHBL? zL(PrM{rr9XbG=ZvO>L*i_*2tD_niKe0BR!FlRyW7_pI(y27CRgEhUUJK&J$5M zm%eM;jZ0S~c(xjSIOyE*Gj=aaR-DI^dzr8NHI2{4#W7rUlXhg}zIE)H-S(&@H;;N; Sx+kLeZp|_U%{?0fegOdOopMwF literal 0 HcmV?d00001 diff --git a/secrets/forgejo-runner-token-snowden-env.age b/secrets/forgejo-runner-token-snowden-env.age new file mode 100644 index 0000000..61774b5 --- /dev/null +++ b/secrets/forgejo-runner-token-snowden-env.age @@ -0,0 +1,19 @@ +age-encryption.org/v1 +-> ssh-ed25519 uH+n1w OqZFs/+8RfQcxHVYYhsTuOllqYz8vC1VVHv64y0oKxI +5hgPS2Y3pXDbs01Wi8772mHXJjeQaVryYBKEgtKxmBk +-> ssh-ed25519 EvLbWw 3Kt46VGnY4ReeMRfnfoGxFxPdNw2G0NTk5UDQX4bC0I +J4eJ85bq9bTsrqbXK35TqOI/dEQgB0Om+a6G/kTx9dM +-> ssh-ed25519 dM+fLQ lXxgeNxLNDI85LU54gGzxrtGmS3wvJiIWyEQWZ/TGgA +jJFc4D52KwQyaR6ghLbWL2VEtbAfHSh2gSs6JkIbtUA +-> ssh-ed25519 jxWM2Q 4N/Q36JyktmQIiZnuZxen0ihw4M+GlraSbvnH9fdcAs +n9cJai680IXvkcy1yItOiBZkNL57E4mlU/98Og8P9a4 +-> ssh-ed25519 /yCUCg odaQ9dbiqNlcATWIOPuyxjjZDp6nBgpKNk0cTNDpHC4 +tT67245DfpegikJT63VVTQwpaqREW440C6Y7tGW8iEo +-> ssh-ed25519 FGp51g Ai1mFU3StdHeNxsuShhv9pENTI5u1ZZ3F/D2RkPDmUU +RLsCuQCPThwuLRWD3BY0zoYNMH66DMPeXf3N+T2D1N4 +-> ssh-ed25519 b5OiTQ qRrLha5yq6pTIJcHso5wc4TS2Jt958t5mNQVuexlkks +64vDXNC9I6TlO1Pvho0Nuj9Nxh56vS8y5Wnwv+r+/MM +-> ssh-ed25519 HaNCag TTizYb1Kw+boj0RQvrf/rwsjxmhzfg64YFCNL3umhms +MrsSQ9ukFHCCkzgu9J+HgYcP/2MHRaGA+OkwK6/YxW0 +--- kvXDCI+iHRpiJRjWfrK9omFndjVw33CH2pHthv3zrjw +? 7Gw2c8 _7߲cXB"|: \ No newline at end of file diff --git a/secrets/forgejo-runner-token-snowden.age b/secrets/forgejo-runner-token-snowden.age new file mode 100644 index 0000000000000000000000000000000000000000..7b70eebdbba7f73c20078d6975cd54e833d29b69 GIT binary patch literal 989 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCSH_0Y~UELU&|E3=F! zHujB3EvWKKP0Mk&NHh1ZNZ0nv3=Js?&(GBN@d*ksswniTD&{gy@ivYOD=kV1F!rs| zchvVZam>i`N!HE}sR;EpaVn0?DRoM%FfWQUE=RY`wah0eyj&rp!Y4G;qsT8et1=|q zFWcA8Gc_q9GN>rRrMw`=$=4{rFh3+=9z1EF~yEsN65xvm&v)Al)FS$~oB0 zt1`_kyEL=X(kIQxGc~)=u+l&~%mUrE6kqK$pFjn(^5O!o9+dLBeoD^eeNu3WCC%vrRK2Je~YKlS?DR zgDafeN=?f=1N{QC^DDBlv#Pu-(mhIYOWl0AbaizV@;r;Z4f8GC(h8#tEJK4rTns`> zjor<2Ofz!xj54+JQqmF&%nZX*iX)1-7WpNeK7E2=d8Ok0oidMAxPG4!pB=SLG}1Ik RwMpGen>XrXQjc8RbO0S{LBjw5 literal 0 HcmV?d00001 diff --git a/secrets/forgejo-secret-key.age b/secrets/forgejo-secret-key.age new file mode 100644 index 0000000..c444ed9 --- /dev/null +++ b/secrets/forgejo-secret-key.age @@ -0,0 +1,19 @@ +age-encryption.org/v1 +-> ssh-ed25519 uH+n1w nANBSx+rWIbFDgHxlQYmKpenWyMEn/69GhZVDX3HpAc +bo09+gwFupWuBHOh8XjTEGJ91JKRghJJeXDDwZUoDU8 +-> ssh-ed25519 EvLbWw JFZiJazyC5H1GdkMCUB1uUh9C4ikkDWAqCiDqOVwbGg +qmQmsGcLNNvunrp1dctPl5mQvfHXXN9/VymjZoq88Wg +-> ssh-ed25519 dM+fLQ mOiUadfO3q4B4oLUUEuN4GjQwlkj9hVQIotjrfolaiA +NEIC05cFim5zMgcJ9EdDyZyktOobrQ/kqHTbnTLjlpg +-> ssh-ed25519 jxWM2Q ZoXfEUwHc57Rg1RwwYR6BYXCRop3Z9x3+t6EmANjyRw +q0on+V1cyd1LmcSSgzclZEdghMqqagVvDAvjSHF1uNY +-> ssh-ed25519 /yCUCg EMWhZacYsnyT4BenbDKlqp9jMdLLeTIyirBg+zbyEyI +TVQbnORmmn/gmTjguZIMOjTpRcaS88J/sghBAjmHlDo +-> ssh-ed25519 FGp51g PaKf3JuzzgklCFEOJ8qrCGZrz/YYojNB0gaPyaXSimg +HAwFk/cG2YVRgy0VefpYf4cy/VuOK+KaGucqzhl0vnM +-> ssh-ed25519 b5OiTQ yv98NwK6G4J2l2shAsEveaF0RP9v36ji4VHOhkaGRlw +atzZLyUYTGG27+/bgSYhxU7VJ5F+VlrMST6b6Td2Zhk +-> ssh-ed25519 HaNCag WmTCOVfoOHL+qnEvK4JrB9boWgIQdU/tTiUhoysMEAE +PVezc1ev5EaXDe4sXnxXoB40Ko5sBmqdqyFup+uTCgU +--- mmrd92d6NnTrTeuF0uTPnX7BJpyvFNX8ECoLvIBitPM +*f8F2.u.{e ?} _ >4@` ƊfRө?~ؘ,CVD^a ! \ No newline at end of file diff --git a/secrets/postgres-forgejo.age b/secrets/postgres-forgejo.age index b070f4f..c5b1c4d 100644 --- a/secrets/postgres-forgejo.age +++ b/secrets/postgres-forgejo.age @@ -1,17 +1,19 @@ age-encryption.org/v1 --> ssh-ed25519 uH+n1w FD2JW6kvjXmr0TZJGXZP/vcfApKI5BO6qJ5I1DpEOkc -2TJjW+JITFo71uJiFd1TV3svvLv2QiZZXV+aUdnDxP8 --> ssh-ed25519 EvLbWw zFCBdnw2FkB13fb5C/4JAt4dxRy2YP+5GqI6XWhmdRw -qI4ZcueMLqqvFwFV0Qkvnx6fiOkpxugusLJXNtBYwmo --> ssh-ed25519 dM+fLQ 3RS4KkR113bKoKuEESIbexvjlU7lFIqzGOQLeGBx1lQ -wJAqBZzb6HR+tV0TknnhvAbprJA0i40wpMBaaH0JXKk --> ssh-ed25519 jxWM2Q E7w2F7U0cSUDyAAxLVMv6WtkXlHpfHKFXBgZl6BfZy0 -fIjJef6+b/68Tc0iSzUIb9uF3tARN6u3upDh2ZZIeIc --> ssh-ed25519 /yCUCg oOkWf9EWdsKU3bKHE8LrfikdP0KzXXaY8dmVhy7GegQ -UPMdwMVFHqGX0/NR0JDgQO2olnbZKa7ZIMToyzmGIn0 --> ssh-ed25519 FGp51g vh5aXCivvT+fQ0rDOtAmaROcz/J/l52xZ6AR4Eba7y4 -pSN1uwDUDZ8Cq7P6YH01+jBIEblwn0BYgHzpPIrDFRc --> ssh-ed25519 I2FcBQ 6gC+El7wX9F3Cxb+OpBPfbR1VMy+klDT5gtgWHwRvis -jpAlqr3Wcd9jxJkNV3CUJ0Hqx5ZmEVeQ3B2rfpprO/E ---- 1TKuLtrpevwfQ0vFN2Vyx0MxdWisGrxvjf2eZVY78go -+}g(~n!fV]ܻ+&_?ٗ;ьO 1s}]լ1Bk< J \ No newline at end of file +-> ssh-ed25519 uH+n1w JhpTZMpgUWp+XeZ1VUwzD5J2ULu3LLvn2TDhyNhUXj4 +YCCKiivXHhZFHc5PSDB71U5r6Fls7N4yewJlUpC7u+8 +-> ssh-ed25519 EvLbWw SgfT0Hi6hxTOMxJNaPm5zzPoNOoeoqLRr1cBHAkGpVc +wk9980kmoZjrvDRGLb0MW92cvDpEDZnDez7X2EAnXyw +-> ssh-ed25519 dM+fLQ nOdVu+dvN5cKBjH+IxU4BtAO+aONShhkqqO9EtjmvnY +CRliq7X0agUxDMF0VwQFx5TVtIrXRumMwCwRG9hjAMc +-> ssh-ed25519 jxWM2Q qM3VJDip+JfwShXBu5UMjeZukcmGc5axmECUUSEYrCY +ZsQd2X6efKfbesB2bN+0O0jjonF+/oDTR3eS1DIUX50 +-> ssh-ed25519 /yCUCg yTvhWJDZmn3n1Rdk3Ml+KAfKvY0uEAmON6gKZZGdShU +hIrnvVk5mk/qagGpXc2AQ3e/4fXS9q4FOVC9ohV+Lnw +-> ssh-ed25519 FGp51g jgm/l2V/MG/xwyeGLXLPQDWK1z3blWk9rBpqZSjD9Uo +zUMx4LBsCS2AaxwSXVYZq9J/6EcA0Wv392r1R2sT348 +-> ssh-ed25519 b5OiTQ njlniNBj2a9IYxHDei6WA4qvT3ztK40mCga7S4LK1X4 +uawAWHeYWx9VDDcFYgZDL2Mm4aMiE5sSVU2JK3aAtD8 +-> ssh-ed25519 I2FcBQ gH8XKdxZkr+s2/vqVhZSl9A/Fv30gb+mDdvDMXp7QUY +Tz1WOrmTJHu8abaRyaz6BPnhB2uVniThynipCUg5Hd4 +--- /JXQ5Zn/tnO60SFw4SN10dQY65hAixTYGCVxPL/QyDA +’\x0Zh,&j{ICMoͶ 7[D+ T_#HOODNӐbI+oVs؏4/!B \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 0b55165..51b6b88 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -13,8 +13,8 @@ let nana nyu ]; - shokinn = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdR4oakO1AO1pg4ZTlwPy9UjZZWf7R+e8SAe1ntGdT8" + kaythxbye = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto" ]; _matrix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIApAkkhHLj918co/wUGuyW8WCPYHxsNM4uo32XDEu7VV root@matrix"; @@ -23,6 +23,7 @@ let _www = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID4TJCMuJZn03soKuxxv6ywFKiXfhLf9Ab03fbMqNaBJ root@www"; _monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring"; _dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav"; + _git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git"; in { "matrix_admin_password.age".publicKeys = xengi; @@ -54,7 +55,7 @@ in _sql _monitoring ]; - "postgres-forgejo.age".publicKeys = xengi ++ shokinn ++ [ _sql ]; + "postgres-forgejo.age".publicKeys = xengi ++ kaythxbye ++ [ _sql ]; "postgres-extkuma.age".publicKeys = xengi ++ [ _sql ]; "postgres-baikal.age".publicKeys = xengi ++ [ _sql @@ -63,4 +64,8 @@ in "www-staging-htpasswd.age".publicKeys = xengi ++ [ _www ]; "caldav-export-config.age".publicKeys = xengi ++ [ _www ]; "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ]; + "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; + "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; + "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; + "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ]; }