infra/hosts/git/forgejo.nix

{
  lib,
  config,
  pkgs,
  ...
}:

let
  fqdn = "git.${config.networking.domain}";
in
{
  imports = [
    ../../services/nginx.nix
    ../../services/prometheus-nginx.nix
  ];

  services = {
    forgejo = {
      enable = true;
      package = pkgs.forgejo;
      secrets = {
        security = {
          SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
          INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
        };
        oauth2.JWT_SECRET = lib.mkDefault config.age.secrets.forgejo-oauth2-jwt-secret.path;
      };
      settings = {
        session.COOKIE_SECURE = true;
        log.LEVEL = "Warn";
        server = {
          DOMAIN = fqdn;
          PROTOCOL = "http+unix";
          ROOT_URL = "https://${fqdn}:443";
          OFFLINE_MODE = true; # disable gravatar, CDN
          LANDING_PAGE = "explore";
        };
        openid.ENABLE_OPENID_SIGNUP = true;
        oauth2_client = {
          ENABLE_AUTO_REGISTRATION = true;
          ACCOUNT_LINKING = "login";
          USERNAME = "nickname";
        };
        service = {
          DISABLE_REGISTRATION = false;
          ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
          AUTO_WATCH_NEW_REPOS = false;
        };
        mailer = {
          ENABLED = true;
          FROM = "admin@berlin.ccc.de";
          PROTOCOL = "sendmail";
          SENDMAIL_PATH = "${pkgs.msmtp}/bin/msmtp";
          SENDMAIL_ARGS = "--";
        };
        metrics.ENABLED = true;
        "cron.archive_cleanup" = {
          ENABLED = true;
          RUN_AT_START = true;
          SCHEDULE = "@every 4h";
          OLDER_THAN = "4h";
        };
      };
      lfs.enable = true;
      database = {
        createDatabase = false;
        host = "sql.${config.networking.domain}";
        name = "forgejo";
        passwordFile = config.age.secrets.postgres-forgejo.path;
        port = 5432;
        user = "forgejo";
        type = "postgres";
      };
    };

    nginx = {
      appendHttpConfig = ''
        limit_req_zone $binary_remote_addr zone=forgejo_archive:10m rate=2r/s;
      '';
      virtualHosts."${fqdn}" = {
      quic = true;
      kTLS = true;
      forceSSL = true;
      enableACME = true;
      extraConfig = ''
        merge_slashes off; # Required to handle URL-encoded slashes
      '';
      locations = {
        "/" = {
          recommendedProxySettings = true;
          proxyWebsockets = true;
          proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
          extraConfig = ''
            client_max_body_size 512M;
          '';
        };
        "/metrics" = {
          recommendedProxySettings = true;
          proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
          extraConfig = ''
            allow 195.160.173.14;
            allow 2001:678:760:cccb::14;
            deny all;
          '';
        };
        "~ ^/[^/]+/[^/]+/archive/".extraConfig = ''
          limit_req zone=forgejo_archive burst=10 nodelay;
        '';
        "= /robots.txt".extraConfig = ''
          default_type text/plain;
          return 200 "User-agent: *\nDisallow: /*/*/archive/\n";
        '';
      };
    };
  };

  security.acme.certs."${fqdn}".reloadServices = [ "nginx" ];
}