freun.dev: add gitea

hosts/freun-dev/secrets.nix

@@ -30,6 +30,8 @@
           "hetzner"
           "actual"
           "voidauth"
+          "gitea"
+          "gitea-actions-runner"
         ]
     )
     // {

hosts/freun-dev/services.nix

@@ -439,6 +439,26 @@ in
       };
     };
 
+    gitea = {
+      enable = true;
+      subdomain = "git";
+      secrets = secrets.gitea.path;
+    };
+
+    gitea-actions-runner.instances = {
+      default = {
+        enable = true;
+        name = config.networking.domain;
+        labels = [
+          "linux_arm64"
+          "ubuntu-latest:docker://node:16-bullseye"
+        ];
+        tokenFile = secrets.gitea-actions-runner.path;
+        url = "https://${config.services.gitea.subdomain}.${config.networking.domain}";
+        settings.container.network = "bridge";
+      };
+    };
+
     webserver = {
       acme.dnsChallenge = true;
       tailscaleAuth.expectedTailnet = "tempel-vibes.ts.net";

modules/services/default.nix

@@ -30,5 +30,6 @@
     ./nqptp.nix
     ./actual.nix
     ./voidauth.nix
+    ./gitea.nix
   ];
 }

modules/services/gitea.nix

@@ -0,0 +1,71 @@
+{
+  lib,
+  config,
+  ...
+}:
+let
+  cfg = config.services.gitea;
+  fqdn = "${cfg.subdomain}.${config.networking.domain}";
+in
+{
+  options.services.gitea = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+    };
+    secrets = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.gitea = {
+      database = {
+        type = "postgres";
+        socket = "/run/postgresql";
+      };
+      settings = {
+        server = {
+          ROOT_URL = "https://${fqdn}/";
+          HTTP_ADDR = "127.0.0.1";
+          HTTP_PORT = 3008;
+          SSH_DOMAIN = fqdn;
+          SSH_PORT = 2222;
+          SSH_LISTEN_PORT = 2222;
+          START_SSH_SERVER = true;
+        };
+        service = {
+          DISABLE_REGISTRATION = false;
+        };
+        mailer = {
+          ENABLED = true;
+        };
+      };
+    };
+
+    services = {
+      webserver = {
+        enable = lib.mkDefault true;
+        vHosts.${fqdn}.locations."/".proxyPort = 3008;
+      };
+      postgresql = {
+        enable = lib.mkDefault true;
+        ensureDatabases = [ "gitea" ];
+        ensureUsers = [
+          {
+            name = "gitea";
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+    };
+
+    systemd.services.gitea = {
+      serviceConfig = lib.mkIf (cfg.secrets != null) {
+        EnvironmentFile = cfg.secrets;
+      };
+    };
+
+    networking.firewall.allowedTCPPorts = [ 2222 ];
+  };
+}

secrets/gitea-actions-runner.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 osOCZA WJ1gfKrLBMmFANdArq8g8PQNbUIl+vVtyxTq+bKx93c
+JFB9WXTK8/7HRfDRzTIzIpDHHc226YCPfUCqbBQ5N1Y
+-> ssh-ed25519 DFiohQ /5FxHaCm+0wGlQ2ZziKYTmD5AWjmoA5PTys3VSOluSU
+l6C6LhUaxw/dIUkyzw7pl2vREV7Bzy/FvbM+J6gFzZQ
+-> ssh-ed25519 PT7ffg B/mz/9eslfI+VEfEPfT4TWyvLTryDZRjSGxM3x2sQQE
+qIQUE4103ilhAhNxekvb3fPYeqZCZ3NGwzfZReMXiU4
+--- HzN/P0+Xj3Ep+LthjWEpKKDbjlXkPTtamWIPl9IQ6Ec
+C ¨ÇPœÞºãìQ½[<5B>&E"ñTQfë|NÃ!ÅÿÅú#³ZŸ:¼€ïr7È:ùóZè´£<08>Fisˆ€(ãÊɃ~È0>
+Œ°ZâŠÁk’

secrets/secrets.nix

@@ -42,4 +42,6 @@ in
   "actual.age".publicKeys = users ++ [ freun-dev ];
   "voidauth.age".publicKeys = users ++ [ freun-dev ];
   "context7.age".publicKeys = users ++ [ radish ];
+  "gitea.age".publicKeys = users ++ [ freun-dev ];
+  "gitea-actions-runner.age".publicKeys = users ++ [ freun-dev ];
 }