feat(nixos): deploy Gitea guest on Pikachu

configs/nixos/README.md

@@ -102,7 +102,7 @@ Confirm you have connectivity (`ping -c1 github.com`) before continuing.
 Clone the monorepo onto the live ISO and work from that local checkout:
 
 ```console
-$ git clone ssh://gitea@git.alexion.dev:2022/alexion/dev.git
+$ git clone ssh://gitea@git.alexion.dev/alexion/dev.git
 $ cd dev
 ```
 

configs/nixos/guests/gitea.nix

@@ -0,0 +1,40 @@
+{
+  config,
+  lib,
+  registry,
+  ...
+}:
+let
+  cfg = config.guests.gitea;
+in
+{
+  options.guests.gitea.dataPath = lib.mkOption {
+    type = lib.types.nullOr lib.types.str;
+    default = null;
+    example = "/srv/gitea";
+    description = "Host path mounted as Gitea's state directory.";
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.dataPath != null;
+        message = "guests.gitea.dataPath must point at the host directory that stores Gitea state.";
+      }
+    ];
+
+    guests.gitea = {
+      interior.modules.services.gitea = {
+        enable = true;
+        reverseProxyAddress = registry.address.${config.networking.hostName}."reverse-proxy";
+      };
+
+      mounts."/var/lib/gitea" = {
+        directory = cfg.dataPath;
+        owner = config.registry."stable-uid".${config.networking.hostName}.gitea;
+        group = "storage";
+        mode = "2770";
+      };
+    };
+  };
+}

configs/nixos/guests/reverse-proxy.nix

@@ -1,10 +1,11 @@
 {
   config,
   lib,
+  registry,
   ...
 }:
 let
-  giteaSshBackend = "10.23.20.45:2022";
+  giteaAddress = registry.address.${config.networking.hostName}.gitea;
 in
 {
   config = lib.mkIf config.guests.reverse-proxy.enable {
@@ -16,7 +17,7 @@ in
           "git.alexion.dev" = {
             forceSSL = true;
             enableACME = true;
-            locations."/".proxyPass = "http://10.23.20.32";
+            locations."/".proxyPass = "http://${giteaAddress}:3000";
           };
           "photos.alexion.dev" = {
             forceSSL = true;
@@ -45,12 +46,12 @@ in
           };
         };
 
-        networking.firewall.allowedTCPPorts = [ 2022 ];
+        networking.firewall.allowedTCPPorts = [ 22 ];
 
         services.nginx.streamConfig = ''
           server {
-            listen 2022;
+            listen 22;
-            proxy_pass ${giteaSshBackend};
+            proxy_pass ${giteaAddress}:2222;
           }
         '';
       };

configs/nixos/hosts/pikachu/default.nix

@@ -96,6 +96,13 @@
     };
   };
 
+  guests.gitea = {
+    enable = true;
+    vlan = 20;
+    address = "10.23.20.127";
+    dataPath = "/pikachu/data/gitea";
+  };
+
   guests.romm = {
     enable = true;
     vlan = 20;

configs/nixos/modules/network/ssh.nix

@@ -33,10 +33,9 @@ let
   });
 
   extraTargets = {
-    # TODO: Pin Gitea's host key after migrating it from Proxmox.
+    # TODO: Pin Gitea's host key after deploying its Pikachu guest.
     gitea = {
       hostName = "git.alexion.dev";
-      port = 2022;
       user = "gitea";
       aliases = [
         "gitea"

configs/nixos/modules/services/gitea.nix

@@ -0,0 +1,66 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.modules.services.gitea;
+in
+{
+  options.modules.services.gitea = {
+    enable = lib.mkEnableOption "Gitea";
+
+    reverseProxyAddress = lib.mkOption {
+      type = lib.types.str;
+      description = "IP address of the reverse proxy trusted to forward client headers.";
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      registry."stable-uid".${config.networking.hostName}.gitea = 20007;
+    }
+
+    (lib.mkIf cfg.enable {
+      users.users.gitea = {
+        isSystemUser = true;
+        uid = config.registry."stable-uid".${config.networking.hostName}.gitea;
+        group = "storage";
+        home = "/var/lib/gitea";
+      };
+
+      networking.firewall.allowedTCPPorts = [
+        2222
+        3000
+      ];
+
+      services.gitea = {
+        enable = true;
+        user = "gitea";
+        group = "storage";
+        stateDir = "/var/lib/gitea";
+        repositoryRoot = "/var/lib/gitea/repositories";
+        lfs = {
+          enable = true;
+          contentDir = "/var/lib/gitea/data/lfs";
+        };
+        database.type = "sqlite3";
+        settings = {
+          server = {
+            HTTP_ADDR = "0.0.0.0";
+            HTTP_PORT = 3000;
+            ROOT_URL = "https://git.alexion.dev/";
+            SSH_DOMAIN = "git.alexion.dev";
+            SSH_PORT = 22;
+            START_SSH_SERVER = true;
+            SSH_LISTEN_HOST = "0.0.0.0";
+            SSH_LISTEN_PORT = 2222;
+            REVERSE_PROXY_TRUSTED_PROXIES = "${cfg.reverseProxyAddress}/32";
+          };
+          service.DISABLE_REGISTRATION = false;
+          session.COOKIE_SECURE = true;
+        };
+      };
+    })
+  ];
+}