Init

modules/forgejo/config.nix

@@ -0,0 +1,104 @@
+{
+  "repository.local".LOCAL_COPY_PATH = "/data/gitea/tmp/local-repo";
+  "repository.upload".TEMP_PATH = "/data/gitea/uploads";
+  attachment.PATH = "/data/gitea/attachments";
+  lfs.PATH = "/data/git/lfs";
+  mailer.ENABLED = false;
+  "repository.pull-request".DEFAULT_MERGE_STYLE = "merge";
+  "repository.signing".DEFAULT_TRUST_MODEL = "committer";
+  ui.DEFAULT_THEME = "forgejo-light";
+  oauth2 = {
+    ENABLED = false;
+    JWT_SECRET = "ref+sops://secrets.yml#/forgejo/jwtSecret";
+  };
+
+  DEFAULT = {
+    APP_NAME = "Forgejo: Beyond coding. We forge.";
+    RUN_MODE = "prod";
+    RUN_USER = "git";
+    WORK_PATH = "/data/gitea";
+  };
+
+  repository = {
+    ROOT = "/data/git/repositories";
+    DEFAULT_BRANCH = "master";
+  };
+
+  server = {
+    APP_DATA_PATH = "/data/gitea";
+    DOMAIN = "git.kun.is";
+    SSH_DOMAIN = "ssh.git.kun.is";
+    HTTP_PORT = 3000;
+    ROOT_URL = "https://git.kun.is";
+    DISABLE_SSH = false;
+    SSH_PORT = 56287;
+    SSH_LISTEN_PORT = 22;
+    LFS_START_SERVER = true;
+    LFS_JWT_SECRET = "ref+sops://secrets.yml#/forgejo/lfsJwtSecret";
+    OFFLINE_MODE = false;
+  };
+
+  database = {
+    PATH = "/data/gitea/gitea.db";
+    DB_TYPE = "sqlite3";
+    HOST = "localhost:3306";
+    NAME = "gitea";
+    USER = "root";
+    PASSWD = "";
+    LOG_SQL = false;
+    SCHEMA = "";
+    SSL_MODE = "disable";
+    CHARSET = "utf8";
+  };
+
+  indexer = {
+    ISSUE_INDEXER_PATH = "/data/gitea/indexers/issues.bleve";
+    ISSUE_INDEXER_TYPE = "db";
+  };
+
+  session = {
+    PROVIDER_CONFIG = "/data/gitea/sessions";
+    PROVIDER = "file";
+  };
+
+  picture = {
+    AVATAR_UPLOAD_PATH = "/data/gitea/avatars";
+    REPOSITORY_AVATAR_UPLOAD_PATH = "/data/gitea/repo-avatars";
+    ENABLE_FEDERATED_AVATAR = false;
+  };
+
+  log = {
+    MODE = "console";
+    LEVEL = "info";
+    "logger.router.MODE" = "console";
+    ROOT_PATH = "/data/gitea/log";
+    "logger.access.MODE" = "console";
+  };
+
+  security = {
+    INSTALL_LOCK = true;
+    SECRET_KEY = "";
+    REVERSE_PROXY_LIMIT = 1;
+    REVERSE_PROXY_TRUSTED_PROXIES = "*";
+    INTERNAL_TOKEN = "ref+sops://secrets.yml#/forgejo/internalToken";
+    PASSWORD_HASH_ALGO = "pbkdf2";
+  };
+
+  service = {
+    DISABLE_REGISTRATION = true;
+    REQUIRE_SIGNIN_VIEW = false;
+    REGISTER_EMAIL_CONFIRM = false;
+    ENABLE_NOTIFY_MAIL = false;
+    ALLOW_ONLY_EXTERNAL_REGISTRATION = false;
+    ENABLE_CAPTCHA = false;
+    DEFAULT_KEEP_EMAIL_PRIVATE = true;
+    DEFAULT_ALLOW_CREATE_ORGANIZATION = true;
+    DEFAULT_ENABLE_TIMETRACKING = true;
+    NO_REPLY_ADDRESS = "noreply.localhost";
+  };
+
+  openid = {
+    ENABLE_OPENID_SIGNIN = true;
+    ENABLE_OPENID_SIGNUP = false;
+  };
+}

modules/forgejo/default.nix

@@ -0,0 +1,102 @@
+{ lib, config, globals, ... }: {
+  options.forgejo.enable = lib.mkEnableOption "forgejo";
+
+  config = lib.mkIf config.forgejo.enable {
+    kubernetes.resources = {
+      secrets.forgejo.stringData.config = lib.generators.toINI { } (import ./config.nix);
+
+      deployments.server.spec = {
+        selector.matchLabels.app = "forgejo";
+
+        strategy = {
+          type = "RollingUpdate";
+
+          rollingUpdate = {
+            maxSurge = 0;
+            maxUnavailable = 1;
+          };
+        };
+
+        template = {
+          metadata.labels.app = "forgejo";
+
+          spec = {
+            # This disables services from becoming environmental variables
+            # to prevent SSH_PORT clashing with Forgejo config.
+            enableServiceLinks = false;
+
+            containers.forgejo = {
+              image = globals.images.forgejo;
+              imagePullPolicy = "IfNotPresent";
+
+              env = {
+                USER_UID.value = "1000";
+                USER_GID.value = "1000";
+              };
+
+              ports = {
+                web.containerPort = 3000;
+                ssh.containerPort = 22;
+              };
+
+              volumeMounts = [
+                {
+                  name = "data";
+                  mountPath = "/data";
+                }
+                {
+                  name = "config";
+                  mountPath = "/data/gitea/conf/app.ini";
+                  subPath = "config";
+                }
+              ];
+            };
+
+            volumes = {
+              data.persistentVolumeClaim.claimName = "data";
+              config.secret.secretName = "forgejo";
+            };
+          };
+        };
+      };
+
+      services = {
+        web.spec = {
+          selector.app = "forgejo";
+
+          ports.web = {
+            port = 80;
+            targetPort = "web";
+          };
+        };
+
+        ssh.spec = {
+          type = "LoadBalancer";
+          loadBalancerIP = globals.gitIPv4;
+          selector.app = "forgejo";
+
+          ports.ssh = {
+            port = 56287;
+            targetPort = "ssh";
+          };
+        };
+      };
+    };
+
+    lab = {
+      ingresses.web = {
+        host = "git.kun.is";
+
+        service = {
+          name = "web";
+          portName = "web";
+        };
+      };
+
+      longhorn.persistentVolumeClaim.data = {
+        volumeName = "forgejo";
+        storage = "20Gi";
+      };
+    };
+  };
+}