From 7737f72328a02ed8229d4a9ce6ff9058536e5105 Mon Sep 17 00:00:00 2001 From: alexion Date: Thu, 22 Oct 2026 16:47:35 -0400 Subject: [PATCH] feat(nixos): deploy Gitea guest on Pikachu --- configs/nixos/README.md | 2 +- configs/nixos/guests/gitea.nix | 40 ++++++++++++++ configs/nixos/guests/reverse-proxy.nix | 11 ++-- configs/nixos/hosts/pikachu/default.nix | 7 +++ configs/nixos/modules/network/ssh.nix | 3 +- configs/nixos/modules/services/gitea.nix | 66 ++++++++++++++++++++++++ 6 files changed, 121 insertions(+), 8 deletions(-) create mode 100644 configs/nixos/guests/gitea.nix create mode 100644 configs/nixos/modules/services/gitea.nix diff --git a/configs/nixos/README.md b/configs/nixos/README.md index 2098e44..f199b6d 100644 --- a/configs/nixos/README.md +++ b/configs/nixos/README.md @@ -102,7 +102,7 @@ Confirm you have connectivity (`ping -c1 github.com`) before continuing. Clone the monorepo onto the live ISO and work from that local checkout: ```console -$ git clone ssh://gitea@git.alexion.dev:2022/alexion/dev.git +$ git clone ssh://gitea@git.alexion.dev/alexion/dev.git $ cd dev ``` diff --git a/configs/nixos/guests/gitea.nix b/configs/nixos/guests/gitea.nix new file mode 100644 index 0000000..8c34292 --- /dev/null +++ b/configs/nixos/guests/gitea.nix @@ -0,0 +1,40 @@ +{ + config, + lib, + registry, + ... +}: +let + cfg = config.guests.gitea; +in +{ + options.guests.gitea.dataPath = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + example = "/srv/gitea"; + description = "Host path mounted as Gitea's state directory."; + }; + + config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = cfg.dataPath != null; + message = "guests.gitea.dataPath must point at the host directory that stores Gitea state."; + } + ]; + + guests.gitea = { + interior.modules.services.gitea = { + enable = true; + reverseProxyAddress = registry.address.${config.networking.hostName}."reverse-proxy"; + }; + + mounts."/var/lib/gitea" = { + directory = cfg.dataPath; + owner = config.registry."stable-uid".${config.networking.hostName}.gitea; + group = "storage"; + mode = "2770"; + }; + }; + }; +} diff --git a/configs/nixos/guests/reverse-proxy.nix b/configs/nixos/guests/reverse-proxy.nix index 3ad5fa9..e3d1a41 100644 --- a/configs/nixos/guests/reverse-proxy.nix +++ b/configs/nixos/guests/reverse-proxy.nix @@ -1,10 +1,11 @@ { config, lib, + registry, ... }: let - giteaSshBackend = "10.23.20.45:2022"; + giteaAddress = registry.address.${config.networking.hostName}.gitea; in { config = lib.mkIf config.guests.reverse-proxy.enable { @@ -16,7 +17,7 @@ in "git.alexion.dev" = { forceSSL = true; enableACME = true; - locations."/".proxyPass = "http://10.23.20.32"; + locations."/".proxyPass = "http://${giteaAddress}:3000"; }; "photos.alexion.dev" = { forceSSL = true; @@ -45,12 +46,12 @@ in }; }; - networking.firewall.allowedTCPPorts = [ 2022 ]; + networking.firewall.allowedTCPPorts = [ 22 ]; services.nginx.streamConfig = '' server { - listen 2022; - proxy_pass ${giteaSshBackend}; + listen 22; + proxy_pass ${giteaAddress}:2222; } ''; }; diff --git a/configs/nixos/hosts/pikachu/default.nix b/configs/nixos/hosts/pikachu/default.nix index 2b81737..78106dd 100644 --- a/configs/nixos/hosts/pikachu/default.nix +++ b/configs/nixos/hosts/pikachu/default.nix @@ -96,6 +96,13 @@ }; }; + guests.gitea = { + enable = true; + vlan = 20; + address = "10.23.20.127"; + dataPath = "/pikachu/data/gitea"; + }; + guests.romm = { enable = true; vlan = 20; diff --git a/configs/nixos/modules/network/ssh.nix b/configs/nixos/modules/network/ssh.nix index 3a20988..d798197 100644 --- a/configs/nixos/modules/network/ssh.nix +++ b/configs/nixos/modules/network/ssh.nix @@ -33,10 +33,9 @@ let }); extraTargets = { - # TODO: Pin Gitea's host key after migrating it from Proxmox. + # TODO: Pin Gitea's host key after deploying its Pikachu guest. gitea = { hostName = "git.alexion.dev"; - port = 2022; user = "gitea"; aliases = [ "gitea" diff --git a/configs/nixos/modules/services/gitea.nix b/configs/nixos/modules/services/gitea.nix new file mode 100644 index 0000000..1446b68 --- /dev/null +++ b/configs/nixos/modules/services/gitea.nix @@ -0,0 +1,66 @@ +{ + config, + lib, + ... +}: +let + cfg = config.modules.services.gitea; +in +{ + options.modules.services.gitea = { + enable = lib.mkEnableOption "Gitea"; + + reverseProxyAddress = lib.mkOption { + type = lib.types.str; + description = "IP address of the reverse proxy trusted to forward client headers."; + }; + }; + + config = lib.mkMerge [ + { + registry."stable-uid".${config.networking.hostName}.gitea = 20007; + } + + (lib.mkIf cfg.enable { + users.users.gitea = { + isSystemUser = true; + uid = config.registry."stable-uid".${config.networking.hostName}.gitea; + group = "storage"; + home = "/var/lib/gitea"; + }; + + networking.firewall.allowedTCPPorts = [ + 2222 + 3000 + ]; + + services.gitea = { + enable = true; + user = "gitea"; + group = "storage"; + stateDir = "/var/lib/gitea"; + repositoryRoot = "/var/lib/gitea/repositories"; + lfs = { + enable = true; + contentDir = "/var/lib/gitea/data/lfs"; + }; + database.type = "sqlite3"; + settings = { + server = { + HTTP_ADDR = "0.0.0.0"; + HTTP_PORT = 3000; + ROOT_URL = "https://git.alexion.dev/"; + SSH_DOMAIN = "git.alexion.dev"; + SSH_PORT = 22; + START_SSH_SERVER = true; + SSH_LISTEN_HOST = "0.0.0.0"; + SSH_LISTEN_PORT = 2222; + REVERSE_PROXY_TRUSTED_PROXIES = "${cfg.reverseProxyAddress}/32"; + }; + service.DISABLE_REGISTRATION = false; + session.COOKIE_SECURE = true; + }; + }; + }) + ]; +}