Add selfhosted services

2026-06-30 04:26:40 +03:00
parent f212c874b5
commit 13e407847f
78 changed files with 2346 additions and 690 deletions
@@ -0,0 +1,38 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+let
+  common = config.selfhosted.common;
+  cfg = config.selfhosted.gitea;
+in
+{
+  imports = [
+    ./gitea
+    ./postgresql
+  ];
+
+  options.selfhosted.gitea = {
+    targetName = mkOption {
+      type = types.str;
+    };
+  };
+
+  config = {
+    sops.secrets = {
+      "gitea/db_password" = { };
+      "gitea/client_id" = { };
+      "gitea/client_secret" = { };
+    };
+
+    systemd.targets."${common.backend}-${cfg.targetName}" = {
+      unitConfig = {
+        Description = "Root target for ${cfg.targetName}";
+      };
+      wantedBy = [ "${common.backend}-${common.rootTarget.name}.target" ];
+    };
+  };
+}
@@ -0,0 +1,53 @@
+{ config, ... }:
+let 
+  common = config.selfhosted.common;
+  cfg = config.selfhosted.gitea;
+  giteaDomain = "${cfg.gitea.subdomain}.${config.sops.placeholder."domains/serv"}";
+in
+{
+  sops.templates."gitea.env".content = ''
+    USER_UID=${common.user.uid}
+    USER_GID=${common.group.gid}
+
+    GITEA__database__DB_TYPE=postgres
+    GITEA__database__HOST=${cfg.postgresql.name}:5432
+    GITEA__database__NAME=gitea
+    GITEA__database__USER=gitea
+    GITEA__database__PASSWD=${config.sops.placeholder."gitea/db_password"}
+
+    TZ=Europe/Moscow
+    GITEA__time__DEFAULT_UI_LOCATION=Europe/Moscow
+
+    GITEA__server__DOMAIN=${giteaDomain}
+    GITEA__server__ROOT_URL=https://${giteaDomain}/
+    GITEA__server__HTTP_PORT=3000
+    GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=false
+    GITEA__service__DISABLE_REGISTRATION=true
+    GITEA__service__SHOW_REGISTRATION_BUTTON=false
+    GITEA__service__ENABLE_BASIC_AUTHENTICATION=false
+
+    GITEA__service__ENABLE_PASSKEY_AUTHENTICATION=false
+    GITEA__server__START_SSH_SERVER=true
+    GITEA__server__SSH_DOMAIN=git.${config.sops.placeholder."domains/serv"}
+    GITEA__server__SSH_LISTEN_HOST=0.0.0.0
+    GITEA__server__SSH_LISTEN_PORT=2222
+    GITEA__server__SSH_PORT=2222
+
+    GITEA__security__INSTALL_LOCK=true
+
+    GITEA__repository__MAX_CREATION_LIMIT=50
+
+    GITEA__server__ENABLE_PASSWORD_SIGNIN_FORM=false
+    GITEA__server__ENABLE_BASIC_AUTHENTICATION=false
+    GITEA__openid__ENABLE_OPENID_SIGNIN=false
+    GITEA__openid__ENABLE_OPENID_SIGNUP=false
+
+    GITEA__oauth2_client__ENABLE_AUTO_REGISTRATION=true
+    GITEA__oauth2_client__ACCOUNT_LINKING=auto
+    GITEA__oauth2_client__USERNAME=preferred_username
+
+    GITEA__session__COOKIE_SECURE=true
+    GITEA__log__LEVEL=Info
+  '';
+}
+
@@ -0,0 +1,111 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+with lib;
+let
+  common = config.selfhosted.common;
+  cfg = config.selfhosted.gitea;
+  hostDataPath = "${common.dataDir}/gitea";
+in
+{
+  imports = [ ./config.nix ];
+
+  options.selfhosted.gitea.gitea = {
+    name = mkOption {
+      type = types.str;
+    };
+    subdomain = mkOption {
+      type = types.str;
+    };
+    hostWebPort = mkOption {
+      type = types.port;
+    };
+    hostSshPort = mkOption {
+      type = types.port;
+    };
+  };
+
+  config = {
+    virtualisation.oci-containers.containers."${cfg.gitea.name}" = {
+      image = "gitea/gitea:latest";
+      ports = [
+        "0.0.0.0:${toString cfg.gitea.hostWebPort}:3000"
+        "0.0.0.0:${toString cfg.gitea.hostSshPort}:2222"
+      ];
+      environmentFiles = [ config.sops.templates."gitea.env".path ];
+      volumes = [
+        "${hostDataPath}/data:/data"
+      ];
+      log-driver = "journald";
+      extraOptions = [
+        "--network=${common.network.name}"
+      ];
+    };
+
+    systemd.services."${common.backend}-${cfg.gitea.name}" = {
+      serviceConfig = {
+        Restart = lib.mkOverride 90 "always";
+      };
+      after = [
+        "${common.backend}-${cfg.postgresql.name}.service"
+        "${common.backend}-${config.selfhosted.traefik.name}.service"
+      ];
+      requires = [ 
+        "${common.backend}-${cfg.postgresql.name}.service"
+        "${common.backend}-${config.selfhosted.traefik.name}.service"
+      ];
+      partOf = [ "${common.backend}-${cfg.targetName}.target" ];
+      wantedBy = [ "${common.backend}-${cfg.targetName}.target" ];
+      preStart = ''
+        mkdir -p ${hostDataPath}/data
+        chown -R ${common.user.uid}:${common.group.gid} ${hostDataPath}/data
+        chmod -R 0775 ${hostDataPath}/data
+      '';
+      postStart =
+        let
+          engine =
+            if common.backend == "podman" then
+              pkgs.podman
+            else if common.backend == "docker" then
+              pkgs.docker
+            else
+              abort "Unknown backend ${common.backend}";
+        in
+        ''
+          set -euo pipefail
+          DOMAIN=$(cat ${config.sops.secrets."domains/serv".path})
+          CLIENT_ID=$(cat ${config.sops.secrets."gitea/client_id".path})
+          CLIENT_SECRET=$(cat ${config.sops.secrets."gitea/client_secret".path})
+
+          for i in $(seq 1 30); do
+            if ${pkgs.curl}/bin/curl -sf http://127.0.0.1:${toString cfg.gitea.hostWebPort}/api/v1/version >/dev/null 2>&1; then
+              break
+            fi
+            echo "Waiting for Gitea to be ready... ($i/20)"
+            sleep 5
+          done
+
+          if ${engine}/bin/${common.backend} exec --user ${common.user.uid} ${cfg.gitea.name} \
+              gitea admin auth list 2>/dev/null | grep -q 'PocketID'; then
+            echo "PocketID auth source already registered"
+            exit 0
+          fi
+
+          ${engine}/bin/${common.backend} exec --user ${common.user.uid} ${cfg.gitea.name} \
+            gitea admin auth add-oauth \
+              --name "PocketID" \
+              --provider "openidConnect" \
+              --key "$CLIENT_ID" \
+              --secret "$CLIENT_SECRET" \
+              --auto-discover-url "https://${config.selfhosted.pocket-id.subdomain}.$DOMAIN/.well-known/openid-configuration" \
+              --scopes "openid email profile" \
+              --skip-local-2fa
+
+          echo "PocketID auth source registered successfully"
+        '';
+    };
+  };
+}
@@ -0,0 +1,11 @@
+{ config, ... }:
+let
+  cfg = config.selfhosted.gitea;
+in
+{
+  sops.templates."gitea-db.env".content = ''
+    POSTGRES_DB=gitea
+    POSTGRES_USER=gitea
+    POSTGRES_PASSWORD=${config.sops.placeholder."gitea/db_password"}
+  '';
+}
@@ -0,0 +1,48 @@
+{ config, lib, ... }:
+with lib;
+let
+  common = config.selfhosted.common;
+  cfg = config.selfhosted.gitea;
+  hostDataPath = "${common.dataDir}/gitea";
+in
+{
+  imports = [ ./config.nix ];
+
+  options.selfhosted.gitea.postgresql = {
+    name = mkOption {
+      type = types.str;
+    };
+  };
+
+  config = {
+    virtualisation.oci-containers.containers."${cfg.postgresql.name}" = {
+      image = "postgres:16";
+      environmentFiles = [ config.sops.templates."gitea-db.env".path ];
+      volumes = [
+        "${hostDataPath}/dbData:/var/lib/postgresql/data"
+      ];
+      extraOptions = [
+        "--network=${common.network.name}"
+        "--network-alias=${cfg.postgresql.name}"
+        "--health-cmd=pg_isready -U gitea"
+        "--health-interval=10s"
+        "--health-timeout=5s"
+        "--health-retries=5"
+      ];
+    };
+
+    systemd.services."${common.backend}-${cfg.postgresql.name}" = {
+      serviceConfig = {
+        Restart = lib.mkOverride 90 "always";
+      };
+      after = [ "${common.backend}-network-${common.network.name}.service" ];
+      requires = [ "${common.backend}-network-${common.network.name}.service" ];
+      partOf = [ "${common.backend}-${cfg.targetName}.target" ];
+      wantedBy = [ "${common.backend}-${cfg.targetName}.target" ];
+      preStart = ''
+        mkdir -p ${hostDataPath}/dbData
+        chown 70:70 ${hostDataPath}/dbData
+      '';
+    };
+  };
+}