feat(nixos): cut over Gitea to Pikachu

configs/nixos/README.md

@@ -102,7 +102,7 @@ Confirm you have connectivity (`ping -c1 github.com`) before continuing.
 Clone the monorepo onto the live ISO and work from that local checkout:
 
 ```console
-$ git clone ssh://gitea@git.alexion.dev:2022/alexion/dev.git
+$ git clone ssh://gitea@git.alexion.dev/alexion/dev.git
 $ cd dev
 ```
 

configs/nixos/guests/reverse-proxy.nix

@@ -1,10 +1,11 @@
 {
   config,
   lib,
+  registry,
   ...
 }:
 let
-  giteaSshBackend = "10.23.20.45:2022";
+  giteaAddress = registry.address.${config.networking.hostName}.gitea;
 in
 {
   config = lib.mkIf config.guests.reverse-proxy.enable {
@@ -16,7 +17,7 @@ in
           "git.alexion.dev" = {
             forceSSL = true;
             enableACME = true;
-            locations."/".proxyPass = "http://10.23.20.32";
+            locations."/".proxyPass = "http://${giteaAddress}:3000";
           };
           "photos.alexion.dev" = {
             forceSSL = true;
@@ -45,12 +46,12 @@ in
           };
         };
 
-        networking.firewall.allowedTCPPorts = [ 2022 ];
+        networking.firewall.allowedTCPPorts = [ 22 ];
 
         services.nginx.streamConfig = ''
           server {
-            listen 2022;
-            proxy_pass ${giteaSshBackend};
+            listen 22;
+            proxy_pass ${giteaAddress}:2222;
           }
         '';
       };

configs/nixos/modules/network/ssh.nix

@@ -33,10 +33,9 @@ let
   });
 
   extraTargets = {
-    # TODO: Pin Gitea's host key after migrating it from Proxmox.
+    # TODO: Pin Gitea's host key after deploying its Pikachu guest.
     gitea = {
       hostName = "git.alexion.dev";
-      port = 2022;
       user = "gitea";
       aliases = [
         "gitea"

configs/nixos/modules/services/gitea.nix

@@ -57,15 +57,8 @@ in
             SSH_LISTEN_PORT = 2222;
             REVERSE_PROXY_TRUSTED_PROXIES = "${cfg.reverseProxyAddress}/32";
           };
-          migrations.ALLOWED_HOST_LIST = lib.concatStringsSep "," [
-            "git.alexion.dev:80"
-            "git.alexion.dev:443"
-            "10.23.20.109/32:80"
-            "10.23.20.109/32:443"
-          ];
           service.DISABLE_REGISTRATION = true;
-          # Direct bootstrap access uses HTTP until the public HTTPS route moves.
-          session.COOKIE_SECURE = false;
+          session.COOKIE_SECURE = true;
         };
       };
     })