Skynet/nixos
6
1
Fork 0
Code Issues 43 Pull requests 1 Projects Releases Packages Wiki Activity Actions

gitlab: I think this is the right config

Browse source
This commit is contained in:
silver 2023-05-24 16:56:59 +01:00
parent 02fb3e28cd
commit e0e1b83e12
1 changed files with 97 additions and 49 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

146
applications/gitlab.nix
View file

@ -1,68 +1,116 @@
{ ... }: { config, pkgs, lib, ... }:
with lib;
let let
hostname = "gitlab.skynet.ie"; cfg = config.services.skynet_gitlab;
user = "git";
in { in {
imports = [ imports = [
./acme.nix ./acme.nix
./dns.nix
./firewall.nix
./nginx.nix ./nginx.nix
]; ];
age.secrets.gitlab_pw = { options.services.skynet_gitlab = {
file = ../secrets/gitlab/pw.age; enable = mkEnableOption "Skynet Gitlab";
owner = user;
group = user; host = {
}; ip = mkOption {
age.secrets.gitlab_db = { type = types.str;
file = ../secrets/gitlab/db.age; };
owner = user;
group = user; name = mkOption {
}; type = types.str;
age.secrets.gitlab_db_pw = { };
file = ../secrets/gitlab/db_pw.age; };
owner = user;
group = user; domain = {
tld = mkOption {
type = types.str;
default = "ie";
};
base = mkOption {
type = types.str;
default = "skynet";
};
sub = mkOption {
type = types.str;
default = "gitlab";
};
};
user = mkOption {
type = types.str;
default = "git";
};
}; };
# using https://nixos.org/manual/nixos/stable/index.html#module-services-gitlab as a guide config = mkIf cfg.enable {
age.secrets.gitlab_pw = {
file = ../secrets/gitlab/pw.age;
owner = cfg.user;
group = cfg.user;
};
age.secrets.gitlab_db = {
file = ../secrets/gitlab/db.age;
owner = cfg.user;
group = cfg.user;
};
age.secrets.gitlab_db_pw = {
file = ../secrets/gitlab/db_pw.age;
owner = cfg.user;
group = cfg.user;
};
services.nginx = { # using https://nixos.org/manual/nixos/stable/index.html#module-services-gitlab as a guide
virtualHosts."${hostname}" = { skynet_dns.records.cname = [
"${cfg.domain.sub} CNAME ${cfg.host.name}"
];
networking.firewall.allowedTCPPorts = [
80
443
# for git
22
];
services.nginx. virtualHosts."${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = {
forceSSL = true; forceSSL = true;
useACMEHost = "skynet"; useACMEHost = "skynet";
locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket"; locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket";
}; };
};
services.gitlab = { services.gitlab = {
enable = true; enable = true;
databasePasswordFile = config.age.secrets.gitlab_db_pw.path; databasePasswordFile = config.age.secrets.gitlab_db_pw.path;
initialRootPasswordFile = config.age.secrets.gitlab_pw.path; initialRootPasswordFile = config.age.secrets.gitlab_pw.path;
https = true; https = true;
host = "${hostname}"; host = "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}";
port = 443; port = 443;
user = user; user = cfg.user;
group = user; group = cfg.user;
#smtp = { #smtp = {
# enable = true; # enable = true;
# address = "localhost"; # address = "localhost";
# port = 25; # port = 25;
#}; #};
secrets = { secrets = {
dbFile = config.age.secrets.gitlab_db.path; dbFile = config.age.secrets.gitlab_db.path;
# these must be backed up for future # these must be backed up for future
secretFile = "/var/keys/gitlab/secret"; secretFile = "/var/keys/gitlab/secret";
otpFile = "/var/keys/gitlab/otp"; otpFile = "/var/keys/gitlab/otp";
jwsFile = "/var/keys/gitlab/jws"; jwsFile = "/var/keys/gitlab/jws";
}; };
extraConfig = { extraConfig = {
gitlab = { gitlab = {
#email_from = "gitlab-no-reply@example.com"; #email_from = "gitlab-no-reply@example.com";
#email_display_name = "Example GitLab"; #email_display_name = "Example GitLab";
#email_reply_to = "gitlab-no-reply@example.com"; #email_reply_to = "gitlab-no-reply@example.com";
default_projects_features = { builds = false; }; default_projects_features = { builds = false; };
};
}; };
}; };
}; };
} }