feat(nixos): deploy Gitea on Pikachu

configs/nixos/guests/gitea.nix

@@ -0,0 +1,48 @@
+{
+  config,
+  lib,
+  registry,
+  ...
+}:
+let
+  cfg = config.guests.gitea;
+in
+{
+  options.guests.gitea.dataPath = lib.mkOption {
+    type = lib.types.nullOr lib.types.str;
+    default = null;
+    example = "/srv/gitea";
+    description = "Host path mounted as Gitea's state directory.";
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = cfg.dataPath != null;
+        message = "guests.gitea.dataPath must point at the host directory that stores Gitea state.";
+      }
+    ];
+
+    registry.homepage.${config.networking.hostName}.gitea = {
+      tab = "Apps";
+      section = "Other";
+      name = "Gitea";
+      description = "Git forge";
+      icon = "gitea.png";
+    };
+
+    guests.gitea = {
+      interior.modules.services.gitea = {
+        enable = true;
+        reverseProxyAddress = registry.address.${config.networking.hostName}."reverse-proxy";
+      };
+
+      mounts."/var/lib/gitea" = {
+        directory = cfg.dataPath;
+        owner = config.registry."stable-uid".${config.networking.hostName}.gitea;
+        group = "storage";
+        mode = "2770";
+      };
+    };
+  };
+}

configs/nixos/guests/reverse-proxy.nix

@@ -1,11 +1,9 @@
 {
   config,
   lib,
+  registry,
   ...
 }:
-let
-  giteaSshBackend = "10.23.20.45:2022";
-in
 {
   config = lib.mkIf config.guests.reverse-proxy.enable {
     guests.reverse-proxy = {
@@ -13,11 +11,6 @@ in
         modules.services.reverse-proxy.enable = true;
 
         services.nginx.virtualHosts = {
-          "git.alexion.dev" = {
-            forceSSL = true;
-            enableACME = true;
-            locations."/".proxyPass = "http://10.23.20.32";
-          };
           "photos.alexion.dev" = {
             forceSSL = true;
             enableACME = true;
@@ -45,12 +38,12 @@ in
           };
         };
 
-        networking.firewall.allowedTCPPorts = [ 2022 ];
+        networking.firewall.allowedTCPPorts = [ 22 ];
 
         services.nginx.streamConfig = ''
           server {
-            listen 2022;
-            proxy_pass ${giteaSshBackend};
+            listen 22;
+            proxy_pass ${registry.address.${config.networking.hostName}.gitea}:2222;
           }
         '';
       };