blob: 3a2b9dadf21b1829f5a5009c9a15b8852362cf58 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
|
{
lib,
pkgs,
config,
...
}:
let
cfg = config.services.gitea;
in
{
services.nginx.virtualHosts."git.emile.space" = {
forceSSL = true;
enableACME = true;
# TODO(emile): figure out why this doesn't work when enabled, has to do with authelia
# extraConfig = authelia-location;
locations = {
"/" = {
# proxyPass = "http://127.0.0.1:3000";
proxyPass = "http://127.0.0.1:${toString config.services.gitea.settings.server.HTTP_PORT}";
# TODO(emile): figure out why this doesn't work when enabled, has to do with authelia
# extraConfig = authelia-authrequest;
};
};
};
# auth via authelia
services.authelia.instances.main.settings.identity_providers.oidc.clients = [
{
id = "git";
# ; nix run nixpkgs#authelia -- crypto hash generate pbkdf2 --variant sha512 --random --random.length 72 --random.charset rfc3986
secret = "$pbkdf2-sha512$310000$4bi9wRkfcqnjbdmgt7rU.g$pQ2mC6GW4.BQwanGKKFhFyIx6Y.WY80xd/YpmlYOPnlnGBWpp0dSOTv6a/2yqSA5D.EuRkGCyeexSE5FdCK2TA";
public = false;
authorization_policy = "two_factor";
redirect_uris = [ "https://git.emile.space/user/oauth2/authelia/callback" ];
scopes = [
"openid"
"email"
"profile"
];
}
];
services.gitea = rec {
enable = true;
appName = "git.emile.space";
# unstable in order to use the 1.20... version
#package = pkgs.forgejo;
package = pkgs.unstable.forgejo;
stateDir = "/var/lib/gitea";
repositoryRoot = "${stateDir}/repositories";
settings = {
service.DISABLE_REGISTRATION = true;
DEFAULT = {
WORK_PATH = "/var/lib/gitea";
};
server = {
DOMAIN = pkgs.lib.mkForce "git.emile.space";
ROOT_URL = pkgs.lib.mkForce "https://git.emile.space";
HTTP_PORT = config.emile.ports.git;
#START_SSH_SERVER = true;
BUILTIN_SSH_SERVER_USER = "git";
SSH_USER = "gitea";
SSH_DOMAIN = "git.emile.space";
REPO_INDEXER_ENABLED = true;
};
indexer = {
REPO_INDEXER_ENABLED = true;
ISSUE_INDEXER_PATH = "${stateDir}/indexers/issues.bleve";
REPO_INDEXER_PATH = "${stateDir}/indexers/repos.bleve";
MAX_FILE_SIZE = 1048576;
REPO_INDEXER_INCLUDE = "";
REPO_INDEXER_EXCLUDE = "resources/bin/**";
};
#federation = {
# enable = true;
# share_user_statistics = true;
# max_size = 4;
#};
};
};
users.users.git = {
isSystemUser = true;
useDefaultShell = true;
group = "git";
extraGroups = [ "gitea" ];
home = cfg.stateDir;
uid = 127;
};
users.groups.git = { };
}
|
