From 2ba33e485169a7fab15ad4ddf28485484819ae9d Mon Sep 17 00:00:00 2001
From: Jakob Lechner <mail@jalr.de>
Date: Tue, 17 Sep 2024 13:46:44 +0200
Subject: [PATCH] Add forgejo

---
 hosts/iron/secrets/mail-users.nix    | Bin 1342 -> 1524 bytes
 hosts/magnesium/ports.nix            |   3 +-
 hosts/magnesium/secrets.yaml         |   7 +--
 hosts/magnesium/services/default.nix |   1 +
 hosts/magnesium/services/forgejo.nix |  68 +++++++++++++++++++++++++++
 5 files changed, 75 insertions(+), 4 deletions(-)
 create mode 100644 hosts/magnesium/services/forgejo.nix

diff --git a/hosts/iron/secrets/mail-users.nix b/hosts/iron/secrets/mail-users.nix
index 4caac0272ba9b7f6a486d618340f3c1cbb23dc09..0046b885874d45c973507b8b794424d0d4864c26 100644
GIT binary patch
literal 1524
zcmZQ@_Y83kiVO&05aO?RHS60mha(MQ3{4+T=?i|@zlCi^Pg7RM2ib)dlm6&S?Anst
zC%e+CtYMOOcG-i#gwIX2{J%<XIrru4+`RJVlIto{e;u%08~ggV-_3+?PZifWT|b<6
z?fQ$fYT-kAEh}#IBwzSvuH}69{>8lCH3b3_zG?*)zrLy#`|)S(kF&FX__-Vwo;quD
z`h?BvV}I^De(6S0$?jU|oi}Ej_Sw6sZ3TzfMW;EpDy&%@kIw2c`_9&N=61Pk#60K8
z-}&roN~)KZ^vz6m?J|)sa(|a`HRaNbf3MtF>yAI@o)`Q7;`b!8f6ZrumHZY=_h<Oq
z$LXs0e23g_=Q4-dLy2$ybQe$L<PEs0X`Z}t^PWS?_Qh@s<Nd|BV5VL1hL49-pGUo1
zV{OFA!tD8GW!JmeHzYiR1iUUEoqc?(_||IKNp~W@?<wHdofok8!l8v?OVZ!D-V{hL
zEijdSWo@<YR{qgVZb~tS3svsAHP;8F{r}#vXxdSo^G`Q*%e3CzCy@8?;yz0Oo~~8h
zlHo@tuPE*`UHVG-{o;A;Sq-0dwq0eYn|}RyB3D}dY1Y78g@r<uclPXF-STSk2hNZk
zhHEFCNU6A!xpwo}NelWWH%AvXd}t|HTX^bgLTi=drVFPX>>O{(Olw-N7jfZ2%7IU_
z+ONB8te7ja<JXt+><71wPt&Y5=ab28YuQ;*ex;4!o7<%u!80-?Z|^r<^|tEBr1|<g
zAJ?vF3R&f9wRB?gM&38armUR&`Ymrv)<NG_j2F#PANlQ;zY{;DoBwCcvbI&i#}W=r
z+TrY$^mk=_K<2|E%(<+)DsM#oXx;KSY+4JC+EdvITV{24|FXZ19RFQ;)B^8%zTYVD
z)oh{)n?&e&HtoEOOK)Y`Q#;NI@1OE*+M||&)M$rYcN?32+XX9nZ;ec7Qa}08Z+E1T
z)r$ih9Xp#_-doJ%y!mPA)ALWo7d|_8s_=jN5u2%#vsa6Ci+Nl%P<0eo@>}=FwRt8|
zelj~^n4=^*L#lsdW$4FDJuiFxV$Hp{tXI4lrZ2ON{+~`c{n6xtlCRg#Wi3ZS55>D_
z{NB|$F);OOSct^xzcp!>KF|DDo}Xa(A+6eX<?QPVLo%Cu<+xV+2^McVr=(G(u`K=7
z<tsrG?iyJ1OMbA~@aOQif@znxoX?bLezH=tse7|Zv&#`Z!Ng?^YaBaI-cZrplau4Y
zn8>g(>~pNk&ET2!KD7}izh1a)-6s9(c-x<y*Mlo29^N<WtG_GX8G)tRv;L{{zUUKO
zu<iSc_0DHp7m7wGFWqiu_2SZ_(q#)vj|Ml~?48A~z2>0Of$dHqSIee8wA$o<Q|Emk
zivqVhyY$f+#*z}b+dEI5VOx6rr8%pdOS|fgUsERY);w{2v|-(ykOTK+7q2R}KWN5!
zw#uqdta3`nfoeHX(e!<*y;aJu?*DxB!lkV>=l3`_P1z_qe{;3WJK>!M)9;9D$XuT%
zb@i|E)(6WRr53#Mcp}e~y^(KO&NkKP2*wW|@<Vtw7k8<potm_F^F}A0y%QHTa`*1e
zD3>$g|JeRM{>qPA+E0I7(bjH0S)ZAEJ!`?1l#~nEXP4dPx!uwI(nUi(v?cGu^u=#t
z7nfa#<gb_JUiUxs=t^bHvYDEflp205nG?4;&{pN#A~pLbPgJ>LB92Xc_oJci(f*r~
z){|x`X!1T^+jT+d`>gy@`!h>zEUy0(<de`pw#GVYPWSvZhW~$jcbKea@Zn_7f>Teg
zteOA4=E2rAb{`La++I6{d0wYTish+WFGG?#H*j12{#J0{x17}b{YyFC<lR5FviynJ
zMT-~uc28q!s?zoRKf35odLZFwoF!6jRw1;cuHxIYhb6pOGx#2E>v{O3+Unrl34NA5
zm!2(Xlufnt(4H`9ev;JGn`}4bB272NO`C8pwzYhwoUU@qqQwi<x2DU#blUcyZ^EZ5
zYXt?f<W1TRUgd7S7L;+ia&uwywsRdnMT3{hN=2PKHreIv$|rxXy((L^%zb@PUtiR=
zHT#Wco$+qf{l4p=*VLEk&W{dmaq@DF6cpHElA_9D(f?4c?+5!lmhPxh=~XYiLQ7A?
HA9w-)FwqoG

literal 1342
zcmZQ@_Y83kiVO&0aJ})!?ZtiW9s6vJ6y}Io^NF9ix9r~jkl-^{s%)%JFDYx-7qKQI
zPIlonC-1_ojjivTcive$CDKNyVAFP^2)WJWg*C?#nFGDT&tBXU?)5ySU%b3{MZ?(z
zj;Gnq#B6&zNBZeTbE$_~?s_-fVhhXV>y}j<>krkHnY?d;Nulsx$DKV#yc1qJ))vL_
zXeP~Eb>(dgyWeN;TWYop!9J&}Tt02tm&+8zV?HCpV53<2n^O1n2LpEm%=(*_a4(r*
z<;Rn4DtexctEZ){y7o$Hw)D=KYxfoX-E4BEyzlDmFX2sx<Xe4DZ{AsWR{Z}ZhKAM!
z%M)8a9}{W#^nkTeuKntoP3%d1r7j<I8~2K=%Ui-}ks;7-*eUrbR?wn4ok`cVImP?w
zW5&sa2Y<_4Sa<f{E?wV@@Q|=|lb8KF=3n^LGdSy{)}&LDRSS5EBi>xI{$j9B!S|Bz
z%87Nodrv-_X5;=&XO{fc%o@Iig}Xvuu$S0wc6MX_BzC-oyC-M=?xPZ|J0unc3L0Ms
zEc`lS*RusVYGoa*!YBI{?D(>I_n!j64Lr%~!m_xg&fV(46g*EmL#M>W;M^peOZPra
zi=N4GEx5QmMeNtymG_0s#Ts-@v9t?CyjWl7onUNyu<*Fe?Hx~zg-sUgmzUgs?cQ{8
zuW8~f<^wCT<##`K{<LC8@xJq#8~#68JxTBJD!wCYn#7M@SKYt8^XG-d24CdN!_A+k
zbF}5u>!17}=FR7@E~BC(FSzYZ@Zqqxrm^ySg5FJ;CB?3AWTt0!_};Jg>$5*kX>wO_
zH0ZtRulC;h&Gxw;Pp4fDy}xUg-oB%PEi4^wAGfI6OKjt3*lNtf{Qk5Ruj)Fz)R4o?
zQtnl*shrc4Iody12`%P1G{>yGI`R7f1J%qNsRJhZFIH8utZJFYH*41$CYvHXK8-yt
zt+(fW`?t;3W24^X0yo2}7mTI{Mjp195HRa)!Oz7%Dt#}`l=!H**<+7$*0Vi}0%xpe
zpY_tocII7=<860N%)G8XEyyit@$_upIt`^G8F`8q1<xK=PtB2;ZlTp1bIXBaj_5hp
zKWioyc~(eXx<BP*q4uK_`8w=DJioR)yR`YOYRl|7yQ`Ts9^0?pxBHYR53kd9`B!rU
zC%R|OWs<W!y8OEA_q=T{lub4p<up$E{pdh)?3dyLDx4D-=ca~+y3f;QdJxbU$*s<O
z#B*nQ&gzXlTM|}0)O=`nG3o%5S}OCM`MVBlvpv1KzEC$L%zHuCeYf~+OY4o_*SKC=
zxR=pPGUj7JUq8Fd_d7zWE2D)x`XboE0`xx~7dXUysbuMyDITw;2YGugUdn1y{D4n~
za|;V!s9EujP4zGNXKdn<-I^;O@}j=(W!G1a_Zx(r7o?k=p7zUV#}-}3IK^e*&RR-`
z*x#lve090O*~zg+(N&%!=ZAOeXQj*!%YF6;PP5S7yT0h!6`mkh;nR;*KIZ*!{dhhx
z>&BagXL-C$JdO8uDa2M7{Y_$CbNFBX0lUXJ-#_dOd;9t9<}2+B1XF9<m-jj!h;hB|
z)pJYk&X?cH3)j54xbe=N&xge(+9a>|m(yB3gXPHl;5Bx^Dk7)U8T<+qHw3+pEoRl7
z@XPhe{q7mbNfwX)epupA+xfe>z~$S#_j(KN&S;S9Z@SG|$P?YhU4F#!6(7&53vH8^
zq?sw++`TaC826r+U$U0Xk+YV|S$cHyGM8`eN!3eSohk*=&eX76m*U$lB={nEvCWa<
zecky?;xCj^t}R)_ep!-jChL4_+q_Mu>n6Ko7#!4oq}aVBb-iz{u<>*;nO`ev`}VyH
Q?w;cG^UtJ+(uJ}103<h#ga7~l

diff --git a/hosts/magnesium/ports.nix b/hosts/magnesium/ports.nix
index b35165c..0fa666e 100644
--- a/hosts/magnesium/ports.nix
+++ b/hosts/magnesium/ports.nix
@@ -1,4 +1,4 @@
-{ lib, custom-utils, ... }:
+{ custom-utils, ... }:
 
 custom-utils.validatePortAttrset {
   coturn-cli.tcp = 5766;
@@ -9,4 +9,5 @@ custom-utils.validatePortAttrset {
   nginx-http.tcp = 80;
   nginx-https.tcp = 443;
   wireguard-public-ip-tunnel.udp = 51000;
+  forgejo-ssh.tcp = 2022;
 }
diff --git a/hosts/magnesium/secrets.yaml b/hosts/magnesium/secrets.yaml
index cd7f526..f7c505b 100644
--- a/hosts/magnesium/secrets.yaml
+++ b/hosts/magnesium/secrets.yaml
@@ -1,6 +1,7 @@
 wireguard_key_hetzner-ha: ENC[AES256_GCM,data:HEW+EalHg6/mq7pRKZkasGz0nqbkSppkf0H/uV5QMJnWwKw9a9W21Y77OSw=,iv:OA6yml1T5kVafX0RYd0Es7DHcGjJazUxP2M6a5Pwkag=,tag:lX5UPIseIQ136HLrHbzZyw==,type:str]
 turn-static-auth-secret: ENC[AES256_GCM,data:rzhixUemFPwKj1BcVPZd7KtUO9OA6A2R4qEQ1BZGVG0=,iv:uYHYe4Cywxovt3b/Ho1tQVHrpgVic+AKh9AjYMYSZcM=,tag:rr8RW/if06t38GpZCYQB4w==,type:str]
 gitlab-runner_fablab-nea-hcloud-labsync: ENC[AES256_GCM,data:+znVO8cQxjDdhch7oUALZvt84iJmWnAx6lTM0+WGkGtaRWTCTPjgnst5waSJpw/Oysrd1PkXZKmLHyHuU7K/CHQij7sWH50G3ZcUum58klJc3dCPztlrLpDVHeSwyYiLpsqkQTfjqLPfrMkxuxBgTEVXlq2ZnFuyOGbFx9hubPxLeyQKakiW3qZWGjbFXYAps7Gl61AVdKJj3y1otX2JbCjG9x2i6FHZpl5ywwQCjKNM,iv:7v+I/oJtWDap6PNIJ4Qm3Si9dGs7a79SaMhnr/tbe1A=,tag:7jgoLtdWAEKMkWoXZ10owA==,type:str]
+forgejo-mail: ENC[AES256_GCM,data:eZv9dM0a06wFJaDUZjo=,iv:L32ab5k/AX8HqSACJA5w+WbzLlBijA5++Gcr2SrnYIU=,tag:ddyTXikWTMnxq86IijgyYg==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -16,8 +17,8 @@ sops:
             QTBqZDZLeDFLK0k2MHF4Uk1mQTIxRHcKeLHz+lSnHLyTgw2Aq+IVGpIi9X8SQx+Q
             bCSPPMPIZsL4VLInuZmcd2n/kEr80fQM2P3/ktW8RnViQjTU+kKbMg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-10-13T18:27:53Z"
-    mac: ENC[AES256_GCM,data:8DPq0aGtoiMOdFyD+0NKGZ9OrDi1VXXS/6y3tH4DwlkLDpDqb2QsxunTDwoHlILQBu300nB2lUeGuGlp4/0FimFdiddlu2Ljq8vLh3wt+sz660RgfeaIcgWLSHtulyNIIQJ91wzzgbRADafFRCavVFvJALnIgeE+QDQa4ybLus0=,iv:T3xwELbHbqDszIkGs8BeJn9WV0LjagF1T+HLxCR/Aeo=,tag:NAIBPTRcnRtkGKhpWpe5Pw==,type:str]
+    lastmodified: "2024-09-17T12:35:12Z"
+    mac: ENC[AES256_GCM,data:ji+KDLN/7nQG448ZMxOFCuCTrzwnn00xbey84itd2cHpGP3oWYCFDWqdMg18C7koZ8eVtudgi3v6++bYLunAMONcvVwqconiEgEy17GKMzaladkEVDzSTRLipbcby/k4VYzS+iBP02eEn1gHYaNWTeIN/8X+42kIdhq3Itx44fU=,iv:X72KO/yNE1RI8lSPEc5llmCUuO0bZrtD4kizHf4dnzA=,tag:jZOIX1hhF1yfy7U8f47/VA==,type:str]
     pgp:
         - created_at: "2024-01-31T01:20:03Z"
           enc: |-
@@ -31,4 +32,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: 3044E71E3DEFF49B586CF5809BF4FCCB90854DA9
     unencrypted_suffix: _unencrypted
-    version: 3.7.3
+    version: 3.8.1
diff --git a/hosts/magnesium/services/default.nix b/hosts/magnesium/services/default.nix
index 0fd2a7f..9737c6c 100644
--- a/hosts/magnesium/services/default.nix
+++ b/hosts/magnesium/services/default.nix
@@ -1,6 +1,7 @@
 {
   imports = [
     ./coturn.nix
+    ./forgejo.nix
     ./gitlab-runner.nix
     ./mosquitto.nix
     ./public-ip-tunnel.nix
diff --git a/hosts/magnesium/services/forgejo.nix b/hosts/magnesium/services/forgejo.nix
new file mode 100644
index 0000000..98042a7
--- /dev/null
+++ b/hosts/magnesium/services/forgejo.nix
@@ -0,0 +1,68 @@
+args@{ config, custom-utils, ... }:
+let
+  domain = "git.jalr.de";
+  cfg = config.services.forgejo;
+  ports = import ../ports.nix args;
+in
+{
+  sops.secrets.forgejo-mail = {
+    owner = cfg.user;
+    sopsFile = ../secrets.yaml;
+  };
+  services.forgejo = {
+    enable = true;
+    lfs.enable = true;
+    mailerPasswordFile = config.sops.secrets.forgejo-mail.path;
+    settings = {
+      DEFAULT.APP_NAME = "jalr's git";
+      avatar.DISABLE_GRAVATAR = true;
+      mailer = {
+        ENABLED = true;
+        PROTOCOL = "smtps";
+        SMTP_ADDR = "hha.jalr.de";
+        FROM = "git@jalr.de";
+        USER = "git@jalr.de";
+      };
+      server = {
+        DOMAIN = domain;
+        PROTOCOL = "http+unix";
+        ROOT_URL = "https://${domain}/";
+
+        DISABLE_ROUTER_LOG = true;
+        OFFLINE_MODE = true;
+
+        BUILTIN_SSH_SERVER_USER = "git";
+        START_SSH_SERVER = true;
+        SSH_PORT = ports.forgejo-ssh.tcp;
+        SSH_SERVER_HOST_KEYS = "ssh/forgejo.ed25519";
+      };
+      service = {
+        DEFAULT_ALLOW_CREATE_ORGANIZATION = false;
+        DEFAULT_KEEP_EMAIL_PRIVATE = true;
+        ENABLE_NOTIFY_MAIL = false;
+        REGISTER_MANUAL_CONFIRM = true;
+        DISABLE_REGISTRATION = true;
+      };
+      session = {
+        PROVIDER = "file";
+        COOKIE_SECURE = true;
+      };
+      log.level = "Warn";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ cfg.settings.server.SSH_PORT ];
+
+  services.nginx.virtualHosts."${domain}" = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      proxyPass = "http://unix:/run/forgejo/forgejo.sock";
+    };
+
+    extraConfig = ''
+      client_max_body_size 1G;
+    '';
+  };
+}