Added hetzner server configs

2026-07-11 20:28:51 +02:00
parent 0457d618e1
commit c5f771bd53
51 changed files with 1800 additions and 309 deletions
@@ -0,0 +1,64 @@
+{
+  config,
+  pkgs,
+  lib,
+  unstablePkgs,
+  ...
+}: {
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_14;
+    ensureDatabases = ["gitea"];
+    ensureUsers = [
+      {
+        name = "gitea";
+        ensureDBOwnership = true;
+      }
+    ];
+  };
+
+  # Gitea connects to local Postgres via Unix socket (peer auth).
+  # No password needed — the socket is at /run/postgresql by default.
+  # createDatabase = true ensures the DB + user are set up automatically.
+  services.gitea = {
+    enable = true;
+    package = unstablePkgs.gitea;
+    database.type = "postgres";
+    database.name = "gitea";
+    database.user = "gitea";
+    appName = "Jory's Git";
+    lfs.enable = true;
+    settings = {
+      server = {
+        DOMAIN = "git.severijnse.eu";
+        ROOT_URL = "https://git.severijnse.eu/";
+        HTTP_PORT = 3000;
+        SSH_PORT = 222;
+        SSH_LISTEN_PORT = 2222;
+        START_SSH_SERVER = true;
+        SSH_USER = "git";
+        BUILTIN_SSH_SERVER_USER = "git";
+        LANDING_PAGE = "explore";
+      };
+      service = {
+        DISABLE_REGISTRATION = true;
+        REQUIRE_SIGNIN_VIEW = false;
+      };
+      repository = {
+        DEFAULT_BRANCH = "main";
+      };
+    };
+  };
+
+  # Gitea built-in SSH server: listens on high port 2222 (no privileged-cap needed),
+  # while clone URLs advertise port 222. Firewall redirects 222 -> 2222.
+  networking.firewall.allowedTCPPorts = [222 2222];
+
+  # Redirect external git SSH (222) to Gitea's internal listener (2222)
+  networking.firewall.extraCommands = ''
+    ${pkgs.nftables}/bin/nft add table inet gitea-redirect 2>/dev/null || true
+    ${pkgs.nftables}/bin/nft flush chain inet gitea-redirect prerouting 2>/dev/null || true
+    ${pkgs.nftables}/bin/nft add chain inet gitea-redirect prerouting '{ type nat hook prerouting priority dstnat; }' 2>/dev/null || true
+    ${pkgs.nftables}/bin/nft add rule inet gitea-redirect prerouting tcp dport 222 redirect to :2222 2>/dev/null || true
+  '';
+}