65 lines
1.9 KiB
Nix
65 lines
1.9 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
unstablePkgs,
|
|
...
|
|
}: {
|
|
services.postgresql = {
|
|
enable = true;
|
|
package = pkgs.postgresql_14;
|
|
ensureDatabases = ["gitea"];
|
|
ensureUsers = [
|
|
{
|
|
name = "gitea";
|
|
ensureDBOwnership = true;
|
|
}
|
|
];
|
|
};
|
|
|
|
# Gitea connects to local Postgres via Unix socket (peer auth).
|
|
# No password needed — the socket is at /run/postgresql by default.
|
|
# createDatabase = true ensures the DB + user are set up automatically.
|
|
services.gitea = {
|
|
enable = true;
|
|
package = unstablePkgs.gitea;
|
|
database.type = "postgres";
|
|
database.name = "gitea";
|
|
database.user = "gitea";
|
|
appName = "Jory's Git";
|
|
lfs.enable = true;
|
|
settings = {
|
|
server = {
|
|
DOMAIN = "git.severijnse.eu";
|
|
ROOT_URL = "https://git.severijnse.eu/";
|
|
HTTP_PORT = 3000;
|
|
SSH_PORT = 222;
|
|
SSH_LISTEN_PORT = 2222;
|
|
START_SSH_SERVER = true;
|
|
SSH_USER = "git";
|
|
BUILTIN_SSH_SERVER_USER = "git";
|
|
LANDING_PAGE = "explore";
|
|
};
|
|
service = {
|
|
DISABLE_REGISTRATION = true;
|
|
REQUIRE_SIGNIN_VIEW = false;
|
|
};
|
|
repository = {
|
|
DEFAULT_BRANCH = "main";
|
|
};
|
|
};
|
|
};
|
|
|
|
# Gitea built-in SSH server: listens on high port 2222 (no privileged-cap needed),
|
|
# while clone URLs advertise port 222. Firewall redirects 222 -> 2222.
|
|
networking.firewall.allowedTCPPorts = [222 2222];
|
|
|
|
# Redirect external git SSH (222) to Gitea's internal listener (2222)
|
|
networking.firewall.extraCommands = ''
|
|
${pkgs.nftables}/bin/nft add table inet gitea-redirect 2>/dev/null || true
|
|
${pkgs.nftables}/bin/nft flush chain inet gitea-redirect prerouting 2>/dev/null || true
|
|
${pkgs.nftables}/bin/nft add chain inet gitea-redirect prerouting '{ type nat hook prerouting priority dstnat; }' 2>/dev/null || true
|
|
${pkgs.nftables}/bin/nft add rule inet gitea-redirect prerouting tcp dport 222 redirect to :2222 2>/dev/null || true
|
|
'';
|
|
}
|