jory
5116faf0d3
- caddy: security headers (X-Content-Type-Options/X-XSS-Protection/ X-Frame-Options) on all vhosts + baseline CSP; strip SnappyMail upstream copies via header_down on mail.severijnse.eu - tlsa-updater: compute TLSA 3 1 1 from cert SPKI (SHA-256), sync _25/_465/_993, fail-safe placeholders; coredns zone updated - pre-commit: wire cachix/git-hooks.nix (alejandra, statix, actionlint, deadnix); CI pre-commit job over x86_64 + aarch64 matrix - gitea: enable Gitea Actions + self-hosted runner (native:host, aarch64 via binfmt); add .gitea/workflows/ci.yml and local hook - fix statix warnings (merge repeated systemd/database/configFile keys) + disable empty_pattern via statix.toml (nixpkgs standard) - Clean up unused lambda patterns across 38 .nix files via deadnix - Format whole repo with alejandra (27 files) - Remove .github/workflows/ci.yml (Gitea shadows .github; runner labels differ) - Fix CI nix-not-found: export /run/current-system/sw/bin in PATH - Trim aarch64 from pre-commit matrix (no QEMU binfmt deployed yet)
106 lines
3.3 KiB
Nix
106 lines
3.3 KiB
Nix
{
|
|
pkgs,
|
|
unstablePkgs,
|
|
...
|
|
}: {
|
|
services = {
|
|
postgresql = {
|
|
enable = true;
|
|
package = pkgs.postgresql_14;
|
|
ensureDatabases = ["gitea"];
|
|
ensureUsers = [
|
|
{
|
|
name = "gitea";
|
|
ensureDBOwnership = true;
|
|
}
|
|
];
|
|
};
|
|
|
|
gitea = {
|
|
enable = true;
|
|
package = unstablePkgs.gitea;
|
|
database = {
|
|
type = "postgres";
|
|
name = "gitea";
|
|
user = "gitea";
|
|
};
|
|
appName = "Jory's Git";
|
|
lfs.enable = true;
|
|
settings = {
|
|
server = {
|
|
DOMAIN = "git.severijnse.eu";
|
|
ROOT_URL = "https://git.severijnse.eu/";
|
|
HTTP_PORT = 3000;
|
|
SSH_PORT = 222;
|
|
SSH_LISTEN_PORT = 2222;
|
|
START_SSH_SERVER = true;
|
|
SSH_USER = "git";
|
|
BUILTIN_SSH_SERVER_USER = "git";
|
|
LANDING_PAGE = "explore";
|
|
};
|
|
service = {
|
|
DISABLE_REGISTRATION = true;
|
|
REQUIRE_SIGNIN_VIEW = false;
|
|
};
|
|
repository = {
|
|
DEFAULT_BRANCH = "main";
|
|
};
|
|
actions = {
|
|
ENABLED = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
gitea-actions-runner = {
|
|
# nixos-24-05's gitea-actions-runner module hardcodes bin/act_runner,
|
|
# but the current upstream package (1.0.3, matching gitea 1.26) ships
|
|
# bin/gitea-runner. Wrap it so both names resolve.
|
|
package = pkgs.runCommand "gitea-actions-runner-wrapped" {} ''
|
|
mkdir -p $out/bin
|
|
ln -s ${unstablePkgs.gitea-actions-runner}/bin/gitea-runner $out/bin/act_runner
|
|
'';
|
|
instances.default = {
|
|
enable = true;
|
|
name = "hetzner";
|
|
url = "https://git.severijnse.eu";
|
|
tokenFile = "/var/lib/secrets/gitea-runner-token";
|
|
labels = ["native:host"];
|
|
hostPackages = with pkgs; [
|
|
bash
|
|
coreutils
|
|
curl
|
|
gawk
|
|
gitMinimal
|
|
gnused
|
|
nodejs
|
|
wget
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
# Gitea connects to local Postgres via Unix socket (peer auth).
|
|
# No password needed — the socket is at /run/postgresql by default.
|
|
# createDatabase = true ensures the DB + user are set up automatically.
|
|
|
|
# Gitea built-in SSH server: listens on high port 2222 (no privileged-cap needed),
|
|
# while clone URLs advertise port 222. Firewall redirects 222 -> 2222.
|
|
networking.firewall.allowedTCPPorts = [222 2222];
|
|
|
|
# Redirect external git SSH (222) to Gitea's internal listener (2222)
|
|
networking.firewall.extraCommands = ''
|
|
${pkgs.nftables}/bin/nft add table inet gitea-redirect 2>/dev/null || true
|
|
${pkgs.nftables}/bin/nft flush chain inet gitea-redirect prerouting 2>/dev/null || true
|
|
${pkgs.nftables}/bin/nft add chain inet gitea-redirect prerouting '{ type nat hook prerouting priority dstnat; }' 2>/dev/null || true
|
|
${pkgs.nftables}/bin/nft add rule inet gitea-redirect prerouting tcp dport 222 redirect to :2222 2>/dev/null || true
|
|
'';
|
|
|
|
# --- Gitea Actions self-hosted CI runner ---
|
|
# The native runner only exposes `hostPackages` on PATH (see the list above),
|
|
# which intentionally omits Nix. CI steps export the host's system Nix
|
|
# (/run/current-system/sw/bin, i.e. Lix) onto PATH rather than installing a
|
|
# second Nix client, so the running Lix daemon is used directly.
|
|
# aarch64 builds run under QEMU user-emulation via boot.binfmt below.
|
|
boot.binfmt.emulatedSystems = ["aarch64-linux"];
|
|
}
|