add forgejo

flake.nix

@@ -236,6 +236,34 @@
         modules = [
           agenix.nixosModules.default
           { environment.systemPackages = [ (agenix.packages.${system}.default) ]; }
+          {
+            age.secrets = {
+              forgejo-internal-token = {
+                file = ./secrets/forgejo-internal-token.age;
+                mode = "440";
+                owner = "forgejo";
+                group = "forgejo";
+              };
+              forgejo-secret-key = {
+                file = ./secrets/forgejo-secret-key.age;
+                mode = "440";
+                owner = "forgejo";
+                group = "forgejo";
+              };
+              forgejo-runner-token-snowden = {
+                file = ./secrets/forgejo-runner-token-snowden.age;
+                mode = "444";
+                owner = "root";
+                group = "root";
+              };
+              forgejo-runner-token-snowden-env = {
+                file = ./secrets/forgejo-runner-token-snowden-env.age;
+                mode = "444";
+                owner = "root";
+                group = "root";
+              };
+            };
+          }
           ./hosts/git
         ];
       };

hosts/git/default.nix

@@ -6,6 +6,7 @@
     ../../services/openssh.nix
     ../../services/prometheus-node.nix
     ./forgejo.nix
+    #./forgejo-runner.nix
   ];
 
   networking = {

hosts/git/forgejo-runner.nix

@@ -0,0 +1,52 @@
+{ config, pkgs, ... }:
+
+{
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.yuka = {
+      enable = true;
+      name = "yuka";
+      url = "https://git.sb20.xengi.de";
+      labels = [
+        "debian-stable:docker://docker.io/debian:stable-slim"
+        "alpine-latest:docker://docker.io/alpine:latest"
+        "buildkit:docker://docker.io/moby/buildkit:rootless"
+      ];
+      tokenFile = config.age.secrets.forgejo-runner-token-env.path;
+      settings = {
+        runner.labels = {
+          debian-stable = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/debian:stable-slim";
+              platform = "linux/amd64";
+            };
+          };
+          alpine-latest = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/alpine:latest";
+              platform = "linux/amd64";
+            };
+          };
+          buildkit = {
+            backend = "docker";
+            backend-options = {
+              image = "docker.io/moby/buildkit:rootless";
+              platform = "linux/amd64";
+            };
+          };
+        };
+        server.connections.forgejo = {
+          url = "https://git.sb20.xengi.de/";
+          uuid = "f16ffc21-eb17-4595-ba54-eac00a6f1fa4";
+          token_url = "file://${config.age.secrets.forgejo-runner-token.path}";
+        };
+        container = {
+          enable_ipv6 = true;
+          docker_host = "unix:///run/podman/podman.sock";
+        };
+      };
+    };
+  };
+}

hosts/git/forgejo.nix

@@ -0,0 +1,98 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}:
+
+let
+  fqdn = "git.${config.networking.domain}";
+in
+{
+  imports = [
+    ../../services/nginx.nix
+    ../../services/prometheus-nginx.nix
+  ];
+
+  services = {
+    forgejo = {
+      enable = true;
+      package = pkgs.forgejo;
+      secrets = {
+        security = {
+          SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
+          INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
+        };
+      };
+      settings = {
+        security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";
+        session.COOKIE_SECURE = true;
+        log.LEVEL = "Warn";
+        server = {
+          DOMAIN = fqdn;
+          PROTOCOL = "http+unix";
+          ROOT_URL = "https://${fqdn}:443";
+        };
+        mailer = {
+          ENABLED = true;
+          FROM = "admin@berlin.ccc.de";
+          PROTOCOL = "sendmail";
+          SENDMAIL_PATH = "${pkgs.msmtp}/bin/msmtp";
+          SENDMAIL_ARGS = "--";
+        };
+      };
+      lfs.enable = true;
+      dump = {
+        enable = true;
+        type = "tar.zst";
+        interval = "daily";
+      };
+      database = {
+        createDatabase = false;
+        host = "sql.${config.networking.domain}";
+        name = "git";
+        passwordFile = config.age.secrets.postgresql_forgejo.path;
+        port = 5432;
+        user = "git";
+        type = "postgres";
+      };
+    };
+
+    #openssh.extraConfig = ''
+    #  Match User git
+    #    AcceptEnv GIT_PROTOCOL
+    #    PerSourcePenalties no
+    #'';
+
+    nginx.virtualHosts."${fqdn}" = {
+      quic = true;
+      kTLS = true;
+      forceSSL = true;
+      enableACME = true;
+      extraConfig = ''
+        merge_slashes off; # Required to handle URL-encoded slashes
+      '';
+      locations = {
+        "/" = {
+          recommendedProxySettings = true;
+          proxyWebsockets = true;
+          proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
+          extraConfig = ''
+            client_max_body_size 512M;
+          '';
+        };
+        "/metrics" = {
+          recommendedProxySettings = true;
+          proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
+          extraConfig = ''
+            allow 195.160.173.14;
+            allow 2001:678:760:cccb::14;
+            deny all;
+          '';
+        };
+      };
+    };
+  };
+
+  security.acme.certs."${fqdn}".reloadServices = [ "nginx" ];
+}

secrets/forgejo-runner-token-snowden-env.age

@@ -0,0 +1,19 @@
+age-encryption.org/v1
+-> ssh-ed25519 uH+n1w OqZFs/+8RfQcxHVYYhsTuOllqYz8vC1VVHv64y0oKxI
+5hgPS2Y3pXDbs01Wi8772mHXJjeQaVryYBKEgtKxmBk
+-> ssh-ed25519 EvLbWw 3Kt46VGnY4ReeMRfnfoGxFxPdNw2G0NTk5UDQX4bC0I
+J4eJ85bq9bTsrqbXK35TqOI/dEQgB0Om+a6G/kTx9dM
+-> ssh-ed25519 dM+fLQ lXxgeNxLNDI85LU54gGzxrtGmS3wvJiIWyEQWZ/TGgA
+jJFc4D52KwQyaR6ghLbWL2VEtbAfHSh2gSs6JkIbtUA
+-> ssh-ed25519 jxWM2Q 4N/Q36JyktmQIiZnuZxen0ihw4M+GlraSbvnH9fdcAs
+n9cJai680IXvkcy1yItOiBZkNL57E4mlU/98Og8P9a4
+-> ssh-ed25519 /yCUCg odaQ9dbiqNlcATWIOPuyxjjZDp6nBgpKNk0cTNDpHC4
+tT67245DfpegikJT63VVTQwpaqREW440C6Y7tGW8iEo
+-> ssh-ed25519 FGp51g Ai1mFU3StdHeNxsuShhv9pENTI5u1ZZ3F/D2RkPDmUU
+RLsCuQCPThwuLRWD3BY0zoYNMH66DMPeXf3N+T2D1N4
+-> ssh-ed25519 b5OiTQ qRrLha5yq6pTIJcHso5wc4TS2Jt958t5mNQVuexlkks
+64vDXNC9I6TlO1Pvho0Nuj9Nxh56vS8y5Wnwv+r+/MM
+-> ssh-ed25519 HaNCag TTizYb1Kw+boj0RQvrf/rwsjxmhzfg64YFCNL3umhms
+MrsSQ9ukFHCCkzgu9J+HgYcP/2MHRaGA+OkwK6/YxW0
+--- kvXDCI+iHRpiJRjWfrK9omFndjVw33CH2pHthv3zrjw
+ò?½í 7GŠw½©2c8
	_¤<5F>Á7ß²cX•þBÓü¹ü«Ã"|ç:

secrets/forgejo-secret-key.age

@@ -0,0 +1,19 @@
+age-encryption.org/v1
+-> ssh-ed25519 uH+n1w nANBSx+rWIbFDgHxlQYmKpenWyMEn/69GhZVDX3HpAc
+bo09+gwFupWuBHOh8XjTEGJ91JKRghJJeXDDwZUoDU8
+-> ssh-ed25519 EvLbWw JFZiJazyC5H1GdkMCUB1uUh9C4ikkDWAqCiDqOVwbGg
+qmQmsGcLNNvunrp1dctPl5mQvfHXXN9/VymjZoq88Wg
+-> ssh-ed25519 dM+fLQ mOiUadfO3q4B4oLUUEuN4GjQwlkj9hVQIotjrfolaiA
+NEIC05cFim5zMgcJ9EdDyZyktOobrQ/kqHTbnTLjlpg
+-> ssh-ed25519 jxWM2Q ZoXfEUwHc57Rg1RwwYR6BYXCRop3Z9x3+t6EmANjyRw
+q0on+V1cyd1LmcSSgzclZEdghMqqagVvDAvjSHF1uNY
+-> ssh-ed25519 /yCUCg EMWhZacYsnyT4BenbDKlqp9jMdLLeTIyirBg+zbyEyI
+TVQbnORmmn/gmTjguZIMOjTpRcaS88J/sghBAjmHlDo
+-> ssh-ed25519 FGp51g PaKf3JuzzgklCFEOJ8qrCGZrz/YYojNB0gaPyaXSimg
+HAwFk/cG2YVRgy0VefpYf4cy/VuOK+KaGucqzhl0vnM
+-> ssh-ed25519 b5OiTQ yv98NwK6G4J2l2shAsEveaF0RP9v36ji4VHOhkaGRlw
+atzZLyUYTGG27+/bgSYhxU7VJ5F+VlrMST6b6Td2Zhk
+-> ssh-ed25519 HaNCag WmTCOVfoOHL+qnEvK4JrB9boWgIQdU/tTiUhoysMEAE
+PVezc1ev5EaXDe4sXnxXoB40Ko5sBmqdqyFup+uTCgU
+--- mmrd92d6NnTrTeuF0uTPnX7BJpyvFNX8ECoLvIBitPM
+Õ*Úf·¨ ¨8F2öê.uÈ.’ÿ{e ?»µ}ŸÎö	_¡ù£ >í4@`ºñÆŠfRÓ©?~ؘ,CVîó«D^aø› !å“

secrets/postgres-forgejo.age

@@ -1,17 +1,19 @@
 age-encryption.org/v1
--> ssh-ed25519 uH+n1w FD2JW6kvjXmr0TZJGXZP/vcfApKI5BO6qJ5I1DpEOkc
+-> ssh-ed25519 uH+n1w JhpTZMpgUWp+XeZ1VUwzD5J2ULu3LLvn2TDhyNhUXj4
-2TJjW+JITFo71uJiFd1TV3svvLv2QiZZXV+aUdnDxP8
+YCCKiivXHhZFHc5PSDB71U5r6Fls7N4yewJlUpC7u+8
--> ssh-ed25519 EvLbWw zFCBdnw2FkB13fb5C/4JAt4dxRy2YP+5GqI6XWhmdRw
+-> ssh-ed25519 EvLbWw SgfT0Hi6hxTOMxJNaPm5zzPoNOoeoqLRr1cBHAkGpVc
-qI4ZcueMLqqvFwFV0Qkvnx6fiOkpxugusLJXNtBYwmo
+wk9980kmoZjrvDRGLb0MW92cvDpEDZnDez7X2EAnXyw
--> ssh-ed25519 dM+fLQ 3RS4KkR113bKoKuEESIbexvjlU7lFIqzGOQLeGBx1lQ
+-> ssh-ed25519 dM+fLQ nOdVu+dvN5cKBjH+IxU4BtAO+aONShhkqqO9EtjmvnY
-wJAqBZzb6HR+tV0TknnhvAbprJA0i40wpMBaaH0JXKk
+CRliq7X0agUxDMF0VwQFx5TVtIrXRumMwCwRG9hjAMc
--> ssh-ed25519 jxWM2Q E7w2F7U0cSUDyAAxLVMv6WtkXlHpfHKFXBgZl6BfZy0
+-> ssh-ed25519 jxWM2Q qM3VJDip+JfwShXBu5UMjeZukcmGc5axmECUUSEYrCY
-fIjJef6+b/68Tc0iSzUIb9uF3tARN6u3upDh2ZZIeIc
+ZsQd2X6efKfbesB2bN+0O0jjonF+/oDTR3eS1DIUX50
--> ssh-ed25519 /yCUCg oOkWf9EWdsKU3bKHE8LrfikdP0KzXXaY8dmVhy7GegQ
+-> ssh-ed25519 /yCUCg yTvhWJDZmn3n1Rdk3Ml+KAfKvY0uEAmON6gKZZGdShU
-UPMdwMVFHqGX0/NR0JDgQO2olnbZKa7ZIMToyzmGIn0
+hIrnvVk5mk/qagGpXc2AQ3e/4fXS9q4FOVC9ohV+Lnw
--> ssh-ed25519 FGp51g vh5aXCivvT+fQ0rDOtAmaROcz/J/l52xZ6AR4Eba7y4
+-> ssh-ed25519 FGp51g jgm/l2V/MG/xwyeGLXLPQDWK1z3blWk9rBpqZSjD9Uo
-pSN1uwDUDZ8Cq7P6YH01+jBIEblwn0BYgHzpPIrDFRc
+zUMx4LBsCS2AaxwSXVYZq9J/6EcA0Wv392r1R2sT348
--> ssh-ed25519 I2FcBQ 6gC+El7wX9F3Cxb+OpBPfbR1VMy+klDT5gtgWHwRvis
+-> ssh-ed25519 b5OiTQ njlniNBj2a9IYxHDei6WA4qvT3ztK40mCga7S4LK1X4
-jpAlqr3Wcd9jxJkNV3CUJ0Hqx5ZmEVeQ3B2rfpprO/E
+uawAWHeYWx9VDDcFYgZDL2Mm4aMiE5sSVU2JK3aAtD8
---- 1TKuLtrpevwfQ0vFN2Vyx0MxdWisGrxvjf2eZVY78go
+-> ssh-ed25519 I2FcBQ gH8XKdxZkr+s2/vqVhZSl9A/Fv30gb+mDdvDMXp7QUY
-<EFBFBD>+}˜gÚÒ
(‚<>µÊ~<7E>µn!‚±fV]¹Ü»õÜ+<H(§Ð-èÓÖ<C393>€zhÛv>”&ä_<11>?Ù—;ÓÑŒO •Ýëò¦ãÊ1ãßs}Ý]¦Õ¬ü1BßÂk÷Ã< J
+Tz1WOrmTJHu8abaRyaz6BPnhB2uVniThynipCUg5Hd4
+--- /JXQ5Zn/tnO60SFw4SN10dQY65hAixTYGCVxPL/QyDA
+¾Â’‘\èxî«0ÐZˆhù,&²µjÄÑ{ICñ‹MoͶ¥„ô¤7[DÓ+’ T_Ä#HOO<4F>†‡D†¤Ÿ´N Ó<C2A0>çññbI+oêÐVsþº¬žØ<C5BE>4/£!BŸ

secrets/secrets.nix

@@ -13,8 +13,8 @@ let
     nana
     nyu
   ];
-  shokinn = [
+  kaythxbye = [
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdR4oakO1AO1pg4ZTlwPy9UjZZWf7R+e8SAe1ntGdT8"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMn0SP19A5C8PqdH+99ki3TILozj/U4tBSQxcRRepN21 samuel@pluto"
   ];
 
   _matrix = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIApAkkhHLj918co/wUGuyW8WCPYHxsNM4uo32XDEu7VV root@matrix";
@@ -23,6 +23,7 @@ let
   _www = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID4TJCMuJZn03soKuxxv6ywFKiXfhLf9Ab03fbMqNaBJ root@www";
   _monitoring = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINmRWdAUur0lb08NiB6ZWLrGmCeELRV30ElxRLfVJGPB root@monitoring";
   _dav = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICArHbX8OlNOv8HCWyyFvyi60d6MRFYe+apK0iGJ7yIM root@dav";
+  _git = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII93S1RUXVbH6mQksk9c5fXP8avSKXEUHBH0a7/ZbZY5 root@git";
 in
 {
   "matrix_admin_password.age".publicKeys = xengi;
@@ -54,7 +55,7 @@ in
     _sql
     _monitoring
   ];
-  "postgres-forgejo.age".publicKeys = xengi ++ shokinn ++ [ _sql ];
+  "postgres-forgejo.age".publicKeys = xengi ++ kaythxbye ++ [ _sql ];
   "postgres-extkuma.age".publicKeys = xengi ++ [ _sql ];
   "postgres-baikal.age".publicKeys = xengi ++ [
     _sql
@@ -63,4 +64,8 @@ in
   "www-staging-htpasswd.age".publicKeys = xengi ++ [ _www ];
   "caldav-export-config.age".publicKeys = xengi ++ [ _www ];
   "radicale_htpasswd.age".publicKeys = xengi ++ [ _dav ];
+  "forgejo-internal-token.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
+  "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
+  "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
+  "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
 }