feat: basic forgejo setup
This commit is contained in:
parent
97d1783561
commit
f00ae5bd2d
GPG key ID:
54E2C71918E93B74
7 changed files with 212 additions and 42 deletions
|
|
@ -35,22 +35,19 @@ in {
|
|||
};
|
||||
|
||||
forgejo = {
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
default = 3000;
|
||||
};
|
||||
|
||||
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
default = 3000;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
|
||||
# age.secrets.forgejo-mailer-password = {
|
||||
# file = ../../secrets/forgejo/mailer-password.age;
|
||||
# mode = "400";
|
||||
# owner = "forgejo";
|
||||
# };
|
||||
# age.secrets.forgejo-mailer-password = {
|
||||
# file = ../../secrets/forgejo/mailer-password.age;
|
||||
# mode = "400";
|
||||
# owner = "forgejo";
|
||||
# };
|
||||
|
||||
services.skynet.acme.domains = [
|
||||
"${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}"
|
||||
|
|
@ -79,38 +76,38 @@ in {
|
|||
};
|
||||
};
|
||||
|
||||
|
||||
services.forgejo = {
|
||||
enable = true;
|
||||
database.type = "sqlite3";
|
||||
# Enable support for Git Large File Storage
|
||||
lfs.enable = true;
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}";
|
||||
# You need to specify this to remove the port from URLs in the web UI.
|
||||
ROOT_URL = "https://${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}/";
|
||||
HTTP_PORT = cfg.forgejo.port;
|
||||
};
|
||||
|
||||
# You can temporarily allow registration to create an admin user.
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
# Add support for actions, based on act: https://github.com/nektos/act
|
||||
# actions = {
|
||||
# ENABLED = true;
|
||||
# DEFAULT_ACTIONS_URL = "github";
|
||||
# };
|
||||
# Sending emails is completely optional
|
||||
# You can send a test email from the web UI at:
|
||||
# Profile Picture > Site Administration > Configuration > Mailer Configuration
|
||||
# mailer = {
|
||||
# ENABLED = true;
|
||||
# SMTP_ADDR = "mail.${cfg.domain.base}.${cfg.domain.tld}";
|
||||
# FROM = "noreply@${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}";
|
||||
# USER = "noreply@${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}";
|
||||
# };
|
||||
enable = true;
|
||||
package = pkgs.forgejo;
|
||||
database.type = "sqlite3";
|
||||
# Enable support for Git Large File Storage
|
||||
lfs.enable = true;
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}";
|
||||
# You need to specify this to remove the port from URLs in the web UI.
|
||||
ROOT_URL = "https://${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}/";
|
||||
HTTP_PORT = cfg.forgejo.port;
|
||||
};
|
||||
# mailerPasswordFile = config.age.secrets.forgejo-mailer-password.path;
|
||||
|
||||
# You can temporarily allow registration to create an admin user.
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
# Add support for actions, based on act: https://github.com/nektos/act
|
||||
# actions = {
|
||||
# ENABLED = true;
|
||||
# DEFAULT_ACTIONS_URL = "github";
|
||||
# };
|
||||
# Sending emails is completely optional
|
||||
# You can send a test email from the web UI at:
|
||||
# Profile Picture > Site Administration > Configuration > Mailer Configuration
|
||||
# mailer = {
|
||||
# ENABLED = true;
|
||||
# SMTP_ADDR = "mail.${cfg.domain.base}.${cfg.domain.tld}";
|
||||
# FROM = "noreply@${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}";
|
||||
# USER = "noreply@${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}";
|
||||
# };
|
||||
};
|
||||
# mailerPasswordFile = config.age.secrets.forgejo-mailer-password.path;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
145
applications/git/forgejo_runner.nix
Normal file
145
applications/git/forgejo_runner.nix
Normal file
|
|
@ -0,0 +1,145 @@
|
|||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
inputs,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
name = "forgejo_runner";
|
||||
cfg = config.services.skynet."${name}";
|
||||
in {
|
||||
imports = [
|
||||
];
|
||||
|
||||
options.services.skynet."${name}" = {
|
||||
enable = mkEnableOption "Skynet ForgeJo Runner";
|
||||
|
||||
runner = {
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
default = config.networking.hostName;
|
||||
};
|
||||
|
||||
website = mkOption {
|
||||
default = "https://forgejo.skynet.ie";
|
||||
type = types.str;
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
default = "gitea-runner";
|
||||
type = types.str;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
# https://search.nixos.org/options?from=0&size=50&sort=alpha_desc&type=packages&query=services.gitlab-runner.
|
||||
environment.systemPackages = with pkgs; [
|
||||
forgejo-actions-runner
|
||||
];
|
||||
|
||||
age.secrets.forgejo_runner_token = {
|
||||
file = ../../secrets/forgejo/runners/token.age;
|
||||
owner = cfg.runner.user;
|
||||
group = cfg.runner.user;
|
||||
};
|
||||
|
||||
# make sure the ssh config stuff is in teh right palce
|
||||
systemd.tmpfiles.rules = [
|
||||
#"d /home/${cfg.runner.user} 0755 ${cfg.runner.user} ${cfg.runner.user}"
|
||||
"L+ /home/${cfg.runner.user}/.ssh/config 0755 ${cfg.runner.user} ${cfg.runner.user} - ${./ssh_config}"
|
||||
];
|
||||
age.secrets.forgejo_runner_ssh = {
|
||||
file = ../../secrets/forgejo/runners/ssh.age;
|
||||
mode = "600";
|
||||
owner = "${cfg.runner.user}";
|
||||
group = "${cfg.runner.user}";
|
||||
symlink = false;
|
||||
path = "/home/${cfg.runner.user}/.ssh/skynet/root";
|
||||
};
|
||||
|
||||
nix = {
|
||||
settings = {
|
||||
trusted-users = [
|
||||
# allow the runner to build nix stuff and to use the cache
|
||||
"gitea-runner"
|
||||
];
|
||||
trusted-public-keys = [
|
||||
"skynet-cache:zMFLzcRZPhUpjXUy8SF8Cf7KGAZwo98SKrzeXvdWABo="
|
||||
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
|
||||
];
|
||||
substituters = [
|
||||
"https://nix-cache.skynet.ie/skynet-cache/"
|
||||
"https://cache.nixos.org/"
|
||||
];
|
||||
trusted-substituters = [
|
||||
"https://nix-cache.skynet.ie/skynet-cache/"
|
||||
"https://cache.nixos.org/"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
# very basic setup to always be watching for changes in teh cache
|
||||
systemd.services.attic-uploader = {
|
||||
enable = true;
|
||||
serviceConfig = {
|
||||
ExecStart = "${pkgs.attic-client}/bin/attic watch-store skynet-cache";
|
||||
User = "root";
|
||||
Restart = "always";
|
||||
RestartSec = 1;
|
||||
};
|
||||
};
|
||||
|
||||
# give teh runner user a home to store teh ssh config stuff
|
||||
systemd.services.gitea-runner-default.serviceConfig = {
|
||||
DynamicUser = lib.mkForce false;
|
||||
User = lib.mkForce cfg.runner.user;
|
||||
};
|
||||
users = {
|
||||
groups."${cfg.runner.user}" = {};
|
||||
users."${cfg.runner.user}" = {
|
||||
#isSystemUser = true;
|
||||
isNormalUser = true;
|
||||
group = cfg.runner.user;
|
||||
createHome = true;
|
||||
shell = pkgs.bash;
|
||||
};
|
||||
};
|
||||
|
||||
# the actual runner
|
||||
services.gitea-actions-runner = {
|
||||
package = pkgs.forgejo-actions-runner;
|
||||
instances.default = {
|
||||
enable = true;
|
||||
name = cfg.runner.name;
|
||||
url = cfg.runner.website;
|
||||
tokenFile = config.age.secrets.forgejo_runner_token.path;
|
||||
labels = [
|
||||
## optionally provide native execution on the host:
|
||||
"nix:host"
|
||||
"docker:docker://node:16-bullseye"
|
||||
"ubuntu-latest:docker://node:16-bullseye"
|
||||
];
|
||||
|
||||
hostPackages = with pkgs; [
|
||||
# default ones
|
||||
bash
|
||||
coreutils
|
||||
curl
|
||||
gawk
|
||||
gitMinimal
|
||||
gnused
|
||||
nodejs
|
||||
wget
|
||||
|
||||
# used in deployments
|
||||
inputs.colmena.defaultPackage."x86_64-linux"
|
||||
attic-client
|
||||
nix
|
||||
openssh
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
5
applications/git/ssh_config
Normal file
5
applications/git/ssh_config
Normal file
|
|
@ -0,0 +1,5 @@
|
|||
Host *.skynet.ie 193.1.99.* 193.1.96.165
|
||||
User root
|
||||
IdentityFile ~/.ssh/skynet/root
|
||||
IdentitiesOnly yes
|
||||
|
||||
Loading…
Add table
Add a link
Reference in a new issue