add forgejo

hosts/git/default.nix

@@ -6,6 +6,7 @@
     ../../services/openssh.nix
     ../../services/prometheus-node.nix
     ./forgejo.nix
+    #./forgejo-runner.nix
   ];
 
   networking = {

hosts/git/forgejo-runner.nix

@@ -0,0 +1,52 @@
+{ config, pkgs, ... }:
+
+{
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.yuka = {
+      enable = true;
+      name = "yuka";
+      url = "https://git.sb20.xengi.de";
+      labels = [
+        "debian-stable:docker://docker.io/debian:stable-slim"
+        "alpine-latest:docker://docker.io/alpine:latest"
+        "buildkit:docker://docker.io/moby/buildkit:rootless"
+      ];
+      tokenFile = config.age.secrets.forgejo-runner-token-env.path;
+      settings = {
+        runner.labels = {
+          debian-stable = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/debian:stable-slim";
+              platform = "linux/amd64";
+            };
+          };
+          alpine-latest = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/alpine:latest";
+              platform = "linux/amd64";
+            };
+          };
+          buildkit = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/moby/buildkit:rootless";
+              platform = "linux/amd64";
+            };
+          };
+        };
+        server.connections.forgejo = {
+          url = "https://git.sb20.xengi.de/";
+          uuid = "f16ffc21-eb17-4595-ba54-eac00a6f1fa4";
+          token_url = "file://${config.age.secrets.forgejo-runner-token.path}";
+        };
+        container = {
+          enable_ipv6 = true;
+          docker_host = "unix:///run/podman/podman.sock";
+        };
+      };
+    };
+  };
+}

hosts/git/forgejo.nix

@@ -0,0 +1,98 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  fqdn = "git.${config.networking.domain}";
+in
+{
+  imports = [
+    ../../services/nginx.nix
+    ../../services/prometheus-nginx.nix
+  ];
+
+  services = {
+    forgejo = {
+      enable = true;
+      package = pkgs.forgejo;
+      secrets = {
+        security = {
+          SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
+          INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
+        };
+      };
+      settings = {
+        security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";
+        session.COOKIE_SECURE = true;
+        log.LEVEL = "Warn";
+        server = {
+          DOMAIN = fqdn;
+          PROTOCOL = "http+unix";
+          ROOT_URL = "https://${fqdn}:443";
+        };
+        mailer = {
+          ENABLED = true;
+          FROM = "admin@berlin.ccc.de";
+          PROTOCOL = "sendmail";
+          SENDMAIL_PATH = "${pkgs.msmtp}/bin/msmtp";
+          SENDMAIL_ARGS = "--";
+        };
+      };
+      lfs.enable = true;
+      dump = {
+        enable = true;
+        type = "tar.zst";
+        interval = "daily";
+      };
+      database = {
+        createDatabase = false;
+        host = "sql.${config.networking.domain}";
+        name = "git";
+        passwordFile = config.age.secrets.postgresql_forgejo.path;
+        port = 5432;
+        user = "git";
+        type = "postgres";
+      };
+    };
+
+    #openssh.extraConfig = ''
+    #  Match User git
+    #    AcceptEnv GIT_PROTOCOL
+    #    PerSourcePenalties no
+    #'';
+
+    nginx.virtualHosts."${fqdn}" = {
+      quic = true;
+      kTLS = true;
+      forceSSL = true;
+      enableACME = true;
+      extraConfig = ''
+        merge_slashes off; # Required to handle URL-encoded slashes
+      '';
+      locations = {
+        "/" = {
+          recommendedProxySettings = true;
+          proxyWebsockets = true;
+          proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
+          extraConfig = ''
+            client_max_body_size 512M;
+          '';
+        };
+        "/metrics" = {
+          recommendedProxySettings = true;
+          proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
+          extraConfig = ''
+            allow 195.160.173.14;
+            allow 2001:678:760:cccb::14;
+            deny all;
+          '';
+        };
+      };
+    };
+  };
+
+  security.acme.certs."${fqdn}".reloadServices = [ "nginx" ];
+}