Rework and begin on Gitea host

flake.nix

@@ -115,5 +115,15 @@
           ./hosts/buzzard
         ];
       };
+      nixosConfigurations.gitea = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ({ config, pkgs, ... }: {
+            nixpkgs.overlays = overlays;
+          })
+          
+          ./hosts/gitea
+        ];
+      };
     };
 }

hosts/buzzard/default.nix

@@ -7,9 +7,7 @@
     ./hardware.nix
 
     ../../users/carsten
-    ../common.nix
+    ../common
-
-    ./pkgs.nix
   ];
 
   graphical = false;

hosts/common/graphical.nix

@@ -21,6 +21,11 @@
       pulse.enable = true;
     };
 
+    environment.systemPackages = with pkgs; [
+      pipewire
+      pulseaudio
+    ];
+
     services.xserver = {
       enable = true;
 

hosts/common/pkgs.nix

@@ -5,10 +5,10 @@
 
   environment.systemPackages = with pkgs; [
     git
+    git-lfs
+    gnupg
     home-manager
     ntfsprogs
-    pipewire
-    pulseaudio
     wget
   ];
 }

hosts/eagle/default.nix

@@ -7,9 +7,7 @@
     ./hardware.nix
 
     ../../users/carsten
-    ../common.nix
+    ../common
-
-    ./pkgs.nix
   ];
 
   networking.hostName = "eagle";

hosts/eagle/pkgs.nix

@@ -1,14 +0,0 @@
-{ pkgs, ... }:
-
-{
-  imports = [ ];
-
-  environment.systemPackages = with pkgs; [
-    git
-    home-manager
-    ntfsprogs
-    pipewire
-    pulseaudio
-    wget
-  ];
-}

hosts/falcon/default.nix

@@ -7,9 +7,7 @@
     ./hardware.nix
 
     ../../users/carsten
-    ../common.nix
+    ../common
-
-    ./pkgs.nix
   ];
 
   networking.hostName = "falcon";

hosts/falcon/pkgs.nix

@@ -1,14 +0,0 @@
-{ pkgs, ... }:
-
-{
-  imports = [ ];
-
-  environment.systemPackages = with pkgs; [
-    git
-    home-manager
-    ntfsprogs
-    pipewire
-    pulseaudio
-    wget
-  ];
-}

hosts/gitea/default.nix

@@ -0,0 +1,33 @@
+{ config
+, modulesPath
+, pkgs
+, ...
+}: {
+  imports = [
+    ./hardware.nix
+
+    ../common
+    
+    ./services
+  ];
+
+  users.users.admin = {
+    isNormalUser = true;
+    description = "Gitea Administrator";
+    hashedPassword = "$y$j9T$oL/jNqI1yz65OuUnJvpCn1$MC7.xSyvprru7QmqQVsGyBKZf2b4w7R7U.TmfzSBY39";
+    extraGroups = [
+      "wheel" # Sudoer
+    ];
+    shell = pkgs.bash;
+  };
+
+  networking.hostName = "gitea";
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "22.11"; # Did you read the comment?
+}

hosts/gitea/hardware.nix

@@ -0,0 +1,35 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports = [ ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "vmw_pvscsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/41d3a241-09d6-4a5d-8b55-7f284310a7a9";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/8206-16B6";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens192.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/gitea/services/default.nix

@@ -0,0 +1,7 @@
+{ ...} : {
+  imports = [
+    ./gitea.nix
+    ./postgres.nix
+    ./sshd.nix
+  ];
+}

hosts/gitea/services/gitea.nix

@@ -0,0 +1,29 @@
+{ pkgs, ... }: {
+  services.gitea = rec {
+    enable = true;
+    package = pkgs.unstable.gitea;
+    database = {
+      type = "postgres";
+      host = "unix:///var/run/postgresql/";
+    };
+    lfs.enable = true;
+    domain = "gitea.pid1.sh";
+    rootUrl = "https://" + domain;
+    settings = {
+      server.SSH_PORT = 22007;
+      session.COOKIE_SECURE = true;
+      mailer = {
+        ENABLED = true;
+        SMTP_ADDR = "mail.pid1.sh";
+        SMTP_PORT = 587;
+        FROM = "Root <root@pid1.sh>";
+        USER = "root@pid1.sh";
+        PASSWD = "***";
+        MAILER_TYPE = "smtp";
+        IS_TLS_ENABLED = true;
+        SUBJECT_PREFIX = "PID1 Gitea: ";
+        SEND_AS_PLAIN_TEXT = true;
+      };
+    };
+  };
+}

hosts/gitea/services/postgres.nix

@@ -0,0 +1,13 @@
+{ ... }: {
+  services.postgresql = {
+    enable = true;
+    ensureDatabases = [ "gitea" ];
+    ensureUsers = [
+      {
+        name = "gitea";
+        ensurePermissions = {
+          "DATABASE gitea" = "ALL PRIVILEGES";
+        };
+      }
+    ];
+}

hosts/gitea/services/sshd.nix

@@ -0,0 +1,6 @@
+{ ... }: {
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "yes";
+  };
+}

users/carsten/pkgs/default.nix

@@ -180,8 +180,6 @@
     duf
     exa
     fd
-    git-lfs
-    gnupg
     jq
     mcfly
     pinentry-curses