gitlab: I think this is the right config

applications/gitlab.nix

@@ -1,48 +1,96 @@
-{  ... }:
+{ config, pkgs, lib, ... }:
+  with lib;
   let
-    hostname = "gitlab.skynet.ie";
+    cfg = config.services.skynet_gitlab;
-    user = "git";
   in {
   imports = [
     ./acme.nix
+    ./dns.nix
+    ./firewall.nix
     ./nginx.nix
   ];
 
+  options.services.skynet_gitlab = {
+    enable = mkEnableOption "Skynet Gitlab";
+
+    host = {
+      ip = mkOption {
+        type = types.str;
+      };
+
+      name = mkOption {
+        type = types.str;
+      };
+    };
+
+    domain = {
+      tld = mkOption {
+        type = types.str;
+        default = "ie";
+      };
+
+      base = mkOption {
+        type = types.str;
+        default = "skynet";
+      };
+
+      sub = mkOption {
+        type = types.str;
+        default = "gitlab";
+      };
+    };
+
+    user = mkOption {
+      type = types.str;
+      default = "git";
+    };
+  };
+
+  config = mkIf cfg.enable {
     age.secrets.gitlab_pw = {
       file = ../secrets/gitlab/pw.age;
-    owner = user;
+      owner = cfg.user;
-    group = user;
+      group = cfg.user;
     };
     age.secrets.gitlab_db = {
       file = ../secrets/gitlab/db.age;
-    owner = user;
+      owner = cfg.user;
-    group = user;
+      group = cfg.user;
     };
     age.secrets.gitlab_db_pw = {
       file = ../secrets/gitlab/db_pw.age;
-    owner = user;
+      owner = cfg.user;
-    group = user;
+      group = cfg.user;
     };
 
     # using https://nixos.org/manual/nixos/stable/index.html#module-services-gitlab as a guide
+    skynet_dns.records.cname = [
+      "${cfg.domain.sub}  CNAME   ${cfg.host.name}"
+    ];
 
-  services.nginx = {
+    networking.firewall.allowedTCPPorts = [
-    virtualHosts."${hostname}" = {
+      80
+      443
+
+      # for git
+      22
+    ];
+
+    services.nginx. virtualHosts."${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = {
       forceSSL = true;
       useACMEHost = "skynet";
       locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
     };
-  };
 
     services.gitlab = {
       enable = true;
       databasePasswordFile = config.age.secrets.gitlab_db_pw.path;
       initialRootPasswordFile = config.age.secrets.gitlab_pw.path;
       https = true;
-    host = "${hostname}";
+      host = "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}";
       port = 443;
-    user = user;
+      user = cfg.user;
-    group = user;
+      group = cfg.user;
       #smtp = {
       #  enable = true;
       #  address = "localhost";
@@ -64,5 +112,5 @@
         };
       };
     };
-
+  };
 }