phase 2: promote services/, tests/, patches/, lib/, scripts/

services/gitea.nix

@@ -0,0 +1,65 @@
+{
+  pkgs,
+  lib,
+  config,
+  service_configs,
+  ...
+}:
+{
+  imports = [
+    (lib.serviceMountWithZpool "gitea" service_configs.zpool_ssds [ config.services.gitea.stateDir ])
+    (lib.serviceFilePerms "gitea" [
+      "Z ${config.services.gitea.stateDir} 0700 ${config.services.gitea.user} ${config.services.gitea.group}"
+    ])
+    (lib.mkCaddyReverseProxy {
+      domain = service_configs.gitea.domain;
+      port = service_configs.ports.private.gitea.port;
+    })
+    (lib.mkFail2banJail {
+      name = "gitea";
+      failregex = "^.*Failed authentication attempt for .* from <HOST>:.*$";
+    })
+  ];
+
+  services.gitea = {
+    enable = true;
+    appName = "Simon Gardling's Gitea instance";
+    stateDir = service_configs.gitea.dir;
+    database = {
+      type = "postgres";
+      socket = service_configs.postgres.socket;
+    };
+
+    settings = {
+      server = {
+        SSH_USER = "gitea";
+        DOMAIN = service_configs.gitea.domain;
+        ROOT_URL = "https://" + config.services.gitea.settings.server.DOMAIN;
+        HTTP_PORT = service_configs.ports.private.gitea.port;
+        LANDING_PAGE = "/explore/repos";
+        DISABLE_HTTP_GIT = true;
+      };
+      session = {
+        # https cookies or smth
+        COOKIE_SECURE = true;
+      };
+      # only I shall use gitea
+      service.DISABLE_REGISTRATION = true;
+      actions.ENABLED = true;
+    };
+  };
+
+  services.postgresql = {
+    ensureDatabases = [ config.services.gitea.user ];
+    ensureUsers = [
+      {
+        name = config.services.gitea.database.user;
+        ensureDBOwnership = true;
+        ensureClauses.login = true;
+      }
+    ];
+  };
+
+  services.openssh.settings.AllowUsers = [ config.services.gitea.user ];
+
+}