Finish up gitea host including secrets with sops
parent
6b8ec68ab2
commit
7de2924d05
GPG Key ID:
CADDADEEC9F753C0
@ -0,0 +1,10 @@
|
||||
keys:
|
||||
- &carsten BD9A82C3AC8185DAD4CFDA47A34D551C8CCA7DCD
|
||||
- &gitea age1r2xcvgph5egus0xmyypplpya5wlz5a5kxwydjakvx94eqpgyhgdqqnzd3j
|
||||
creation_rules:
|
||||
- path_regex: secrets/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- pgp:
|
||||
- *carsten
|
||||
age:
|
||||
- *gitea
|
||||
@ -0,0 +1,16 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
options.vm-guest = lib.mkOption {
|
||||
default = config.wsl.enable or false;
|
||||
type = lib.types.bool;
|
||||
description = "Whether this is a vm guest machine";
|
||||
};
|
||||
|
||||
config = lib.mkIf config.vm-guest {
|
||||
graphical = false;
|
||||
} // lib.mkIf (!config.vm-guest) {
|
||||
virtualisation.virtualbox.host.enable = true;
|
||||
virtualisation.docker.enable = true;
|
||||
};
|
||||
}
|
||||
@ -1,29 +1,37 @@
|
||||
{ pkgs, ... }: {
|
||||
services.gitea = rec {
|
||||
enable = true;
|
||||
package = pkgs.unstable.gitea;
|
||||
database = {
|
||||
type = "postgres";
|
||||
host = "unix:///var/run/postgresql/";
|
||||
};
|
||||
lfs.enable = true;
|
||||
domain = "gitea.pid1.sh";
|
||||
rootUrl = "https://" + domain;
|
||||
settings = {
|
||||
server.SSH_PORT = 22007;
|
||||
session.COOKIE_SECURE = true;
|
||||
mailer = {
|
||||
ENABLED = true;
|
||||
SMTP_ADDR = "mail.pid1.sh";
|
||||
SMTP_PORT = 587;
|
||||
FROM = "Root <root@pid1.sh>";
|
||||
USER = "root@pid1.sh";
|
||||
PASSWD = "***";
|
||||
MAILER_TYPE = "smtp";
|
||||
IS_TLS_ENABLED = true;
|
||||
SUBJECT_PREFIX = "PID1 Gitea: ";
|
||||
SEND_AS_PLAIN_TEXT = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
{ pkgs, config, ... }: {
|
||||
services.gitea = rec {
|
||||
enable = true;
|
||||
package = pkgs.unstable.gitea;
|
||||
database = {
|
||||
type = "postgres";
|
||||
host = "unix:///var/run/postgresql/";
|
||||
};
|
||||
lfs.enable = true;
|
||||
domain = "gitea.pid1.sh";
|
||||
rootUrl = "https://" + domain;
|
||||
mailerPasswordFile = config.sops.secrets.gitea_mailer_passwd.path;
|
||||
settings = {
|
||||
server.SSH_PORT = 22007;
|
||||
session.COOKIE_SECURE = true;
|
||||
mailer = {
|
||||
ENABLED = true;
|
||||
SMTP_ADDR = "mail.pid1.sh";
|
||||
SMTP_PORT = 465;
|
||||
FROM = "Root <root@pid1.sh>";
|
||||
USER = "root@pid1.sh";
|
||||
MAILER_TYPE = "smtp";
|
||||
IS_TLS_ENABLED = true;
|
||||
SUBJECT_PREFIX = "PID1 Gitea: ";
|
||||
SEND_AS_PLAIN_TEXT = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
systemd.services.gitea = {
|
||||
after = [ "sops-nix.service" ];
|
||||
};
|
||||
sops.secrets = {
|
||||
gitea_mailer_passwd = {
|
||||
owner = config.systemd.services.gitea.serviceConfig.User;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,13 +1,14 @@
|
||||
{ ... }: {
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "gitea" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "gitea";
|
||||
ensurePermissions = {
|
||||
"DATABASE gitea" = "ALL PRIVILEGES";
|
||||
};
|
||||
}
|
||||
];
|
||||
}
|
||||
{ ... }: {
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "gitea" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "gitea";
|
||||
ensurePermissions = {
|
||||
"DATABASE gitea" = "ALL PRIVILEGES";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@ -0,0 +1,42 @@
|
||||
gitea_mailer_passwd: ENC[AES256_GCM,data:8cBxkVTSS5uJM5FXsro=,iv:LvRu6/bsq7+9pO304VZ9Bqu3cQC2VTzhJW1XBXOqeM4=,tag:0IHlogFEQCqVh2qHZmR/mg==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1r2xcvgph5egus0xmyypplpya5wlz5a5kxwydjakvx94eqpgyhgdqqnzd3j
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZb1hFWElHL2ZaSnlLVzZM
|
||||
dGNXa0lnRk83YmZ3amNkS3NZdkZxS2NrWEdJClVBWGYrbnIyZUhPNGZTVDc3SmRr
|
||||
TmdueUk1OCt6S0lIUmRlUFc1bGRFNHcKLS0tIHFTSXdDelNFeS9FWjFzWmM2R3NW
|
||||
ak85SHlPMW5zZ0lPc2tCbmRkMWZ4L28K2B7i21iAThigRr3lWAlhxaU468hINJd+
|
||||
IFRMI+GPa8KXsuvhD9sqrO7ZVnUBGutn2Ka7vKzw9pnBtn9xnjL7MA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2023-04-26T22:12:13Z"
|
||||
mac: ENC[AES256_GCM,data:jltSFannVuFVA3GLJHYY5bd+10pSLKIfRZV5gPsuPwXpFgbvcoRhJSP79WuMV4m9V/Cr3O8on2CD2n0pm/BRx05UROw/37h8YvZ0RrMkWl+oxYf90PFW8Y7/WI187sNXVFeWzY95TN4xPvz7tU6Gm0otIxENg7WYcUuFM9WikV8=,iv:ACFUZXrLygl5KA5LYVgNbqg9Gs8ObCnmnG9/7sL50g8=,tag:XDzX1n+18ajghHLw7ShHzA==,type:str]
|
||||
pgp:
|
||||
- created_at: "2023-04-26T22:11:17Z"
|
||||
enc: |
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA6NNVRyMyn3NARAA0VdwNGAPsJpztgWzifqrDCe3PK6kqmaMev3rO0z0/acb
|
||||
ivwgjA0C5Tz6eecAbVE7RI61ROC4N2nKAy0tQ7SKnukpCMtwBVh7UyZS6N83LZvC
|
||||
fvbEm7v7EhRsPyOslMmD+p80P2pEHUfw/Hp2OpT6W3BjP1YA097Oesz4WpgKrIac
|
||||
BNbW5OZFl60fMHcv3u1XfvR57ft0Am8Pc3qQGD8Ex0FqGfz/cFEyh7gojYnZcWDF
|
||||
v6YELFJ9+ttsBjgrDvZ5mEU2V77Hb1NH1D98rnGWx19l0It8tAwV2P+cKnLQXJz6
|
||||
8zISnQ8HMdgQ07p1QbbboFT16dVcZNNMWAehLQ7a5MrOTfhYosryAZQd/ZJjDQZM
|
||||
w+MGhLxDug/8PJeD03IJx+SJKN3Wke+AbvlAgWrOEGQXxSDyLm6iLcfCTegHP6CR
|
||||
M9rzaz9pDv3yqyVnU4Ptr1wNeMqpVt76NF3uLgC3AuUyIlgnkqNxAk8Je6XuxjRJ
|
||||
WDpHiriAWoVySCHuIra2KHvGumtdF4/nz0E9xEVJuk+X40+LQKhh7UHm5taFPboi
|
||||
2yUZH7Gf1Xj1A2R6OeUopwJuEIuLzYRdJGvhGFLCgyts5Xa6UPOHp2pIzHtSn6lx
|
||||
UY+f2K6U6vsMrkYbfXW3KeiHB0NET+KGBeCvAPw+1sdF1CL05oeHZasj8tnI+1TU
|
||||
aAEJAhALEc2qzcI7OYizTPsfYywR0I4tL1cRrycufsaqMrvFWQ35WyHINgO93c0g
|
||||
SnVr0Fmd6qzaafqh3xQdf7QfogTMzIgkUGyNkHbcsFbTDngoKlA85KANHF132Tw7
|
||||
Hr4DRLTvKtvx
|
||||
=+v1p
|
||||
-----END PGP MESSAGE-----
|
||||
fp: BD9A82C3AC8185DAD4CFDA47A34D551C8CCA7DCD
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.7.3
|
||||
Loading…
Reference in New Issue