{ self, pkgs, config, ... }: { age.secrets.woodpecker-server-secrets.owner = "woodpecker"; age.secrets.woodpecker-server-secrets.file = "${self}/secrets/woodpecker-server-secrets.age"; age.secrets.woodpecker-agent-secret.owner = "woodpecker"; age.secrets.woodpecker-agent-secret.file = "${self}/secrets/woodpecker-agent-secret.age"; users.users.woodpecker = { group = "woodpecker"; description = "woodpecker user"; home = "/var/lib/woodpecker"; createHome = true; isNormalUser = true; }; users.groups.woodpecker = { }; services.nginx.virtualHosts."ci.sealight.xyz" = { enableACME = true; forceSSL = true; locations."/".proxyPass = "http://localhost:38125"; }; networking.firewall.allowedTCPPorts = [ 80 443 22 ]; services.postgresql = { ensureDatabases = [ "woodpecker" ]; ensureUsers = [{ name = "woodpecker"; ensureDBOwnership = true; }]; }; systemd.services.woodpecker-server = { after = [ "postgresql.service" ]; wantedBy = [ "multi-user.target" ]; serviceConfig = { WorkingDirectory = "/var/lib/woodpecker"; EnvironmentFile = [ /run/agenix/woodpecker-server-secrets /run/agenix/woodpecker-agent-secret ]; Environment = [ "WOODPECKER_OPEN=false" "WOODPECKER_HOST=https://ci.sealight.xyz" "WOODPECKER_SERVER_ADDR=:38125" "WOODPECKER_GITEA=true" "WOODPECKER_GITEA_URL=https://git.sealight.xyz" "WOODPECKER_DATABASE_DATASOURCE=postgres:///woodpecker?host=/run/postgresql" "WOODPECKER_DATABASE_DRIVER=postgres" "WOODPECKER_ADMIN=aynish" ]; ExecStart = "${pkgs.woodpecker-server}/bin/woodpecker-server"; User = "woodpecker"; Group = "woodpecker"; }; }; }