helm/hosts/profiles/woodpecker-server/default.nix

{ self, pkgs, config, ... }:
{
  age.secrets.woodpecker-server-secrets.owner = "woodpecker";
  age.secrets.woodpecker-server-secrets.file = "${self}/secrets/woodpecker-server-secrets.age";

  age.secrets.woodpecker-agent-secret.owner = "woodpecker";
  age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age";
  users.users.woodpecker = {
    group = "woodpecker";
    description = "woodpecker user";
    home = "/var/lib/woodpecker";
    createHome = true;
    isNormalUser = true;
  };

  users.groups.woodpecker = { };

  services.nginx.virtualHosts."ci.sealight.xyz" = {
    enableACME = true;
    forceSSL = true;
    locations."/".proxyPass = "http://localhost:38125";
  };

  networking.firewall.allowedTCPPorts = [ 80 443 22 ];

  services.postgresql = {
    ensureDatabases = [ "woodpecker" ];
    ensureUsers = [{
      name = "woodpecker";
      ensureDBOwnership = true;
    }];
  };

  systemd.services.woodpecker-server = {
    after = [ "postgresql.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      WorkingDirectory = "/var/lib/woodpecker";
      EnvironmentFile = [
        /run/agenix/woodpecker-server-secrets
        /run/agenix/woodpecker-agent-secret
      ];
      Environment = [
        "WOODPECKER_OPEN=false"
        "WOODPECKER_HOST=https://ci.sealight.xyz"
        "WOODPECKER_SERVER_ADDR=:38125"

        "WOODPECKER_GITEA=true"
        "WOODPECKER_GITEA_URL=https://git.sealight.xyz"

        "WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql"
        "WOODPECKER_DATABASE_DRIVER=postgres"
        "WOODPECKER_ADMIN=aynish"
      ];
      ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server";
      User = "woodpecker";
      Group = "woodpecker";
    };
  };

}