c883524efc
May not be as universal, but is more certain to work correctly than my hacked up version that I'm not so invested in.
63 lines
1.5 KiB
Nix
63 lines
1.5 KiB
Nix
# modules/services/gitea.nix
|
|
#
|
|
# Gitea is essentially a self-hosted github. This modules configures it with the
|
|
# expectation that it will be served over an SSL-secured reverse proxy (best
|
|
# paired with my modules.services.nginx module).
|
|
#
|
|
# Resources
|
|
# Config: https://docs.gitea.io/en-us/config-cheat-sheet/
|
|
# API: https://docs.gitea.io/en-us/api-usage/
|
|
|
|
{ options, config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
with lib.my;
|
|
let cfg = config.modules.services.gitea;
|
|
in {
|
|
options.modules.services.gitea = {
|
|
enable = mkBoolOpt false;
|
|
};
|
|
|
|
config = mkIf cfg.enable {
|
|
# Allows git@... clone addresses rather than gitea@...
|
|
users.users.git = {
|
|
useDefaultShell = true;
|
|
home = "/var/lib/gitea";
|
|
group = "gitea";
|
|
};
|
|
|
|
user.extraGroups = [ "gitea" ];
|
|
|
|
services.gitea = {
|
|
enable = true;
|
|
lfs.enable = true;
|
|
|
|
user = "git";
|
|
database.user = "git";
|
|
|
|
# We're assuming SSL-only connectivity
|
|
cookieSecure = true;
|
|
# Only log what's important, but Info is necessary for fail2ban to work
|
|
log.level = "Info";
|
|
settings = {
|
|
server.DISABLE_ROUTER_LOG = true;
|
|
database.LOG_SQL = false;
|
|
service.ENABLE_BASIC_AUTHENTICATION = false;
|
|
};
|
|
|
|
dump = {
|
|
enable = true;
|
|
interval = "daily";
|
|
backupDir = "/run/backups/gitea";
|
|
};
|
|
};
|
|
|
|
services.fail2ban.jails.gitea = ''
|
|
enabled = true
|
|
filter = gitea
|
|
banaction = %(banaction_allports)s
|
|
maxretry = 5
|
|
'';
|
|
};
|
|
}
|