feat(nixos): deploy Gitea on Pikachu

configs/nixos/modules/network/ssh.nix

@@ -33,11 +33,14 @@ let
   });
 
   extraTargets = {
-    # TODO: Pin Gitea's host key after migrating it from Proxmox.
     gitea = {
       hostName = "git.alexion.dev";
-      port = 2022;
       user = "gitea";
+      hostKeys = [
+        "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFcUl17AcZz1wS8ek2yS/bu5NRTX4ViYTuFOSnp8leHmirP3Zk5QlC33hodQp09J6EA6Vl8zUowy4qLud7BMurQ="
+        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkK2W2Ev+9RXa2PNXiNPPCPF5ln2+M2jHiGoZ4cPYxX"
+        "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZSeU1iRHoaIXgbYe0kAiOAASw9LrQhu54RNCoTQ2O1rbqgnnKO2qbYJvfmUWL7jqEkEotgUBy4Xqxgfl7rXGQ9viWZe+i2tKwJdGsabNLJ+QTDCNyGCd22s1Hhl7n68JvuLTENXl4WpH56MB3yjFmK9onLHHcLG+rWiR0I6Yn264LfNVX0RuZK7TlG0tUKJR5bQBXGT6PxAE1IceYRgbgM0BYq4nakNg/s4ZSpmJFrrGfCHNsnHiEmFAXRFrGwf+0ef2STDukM/ADLziPXu0Ge7k72/UPvtEdcpgvzIDMJ2EznKTnxIoZnFkrDqhGOo8DnXK+cFVKAkkC6NgWQpO6fNnY+MEDgSb0fr/rGcwzUa1p+fON5/zEYxsAtKyAeP4D7OEAo65lsSKqi1tbt521miTobp0NOT8p4tGgHTwmshbqlmUZz0DVexN6uc7yzoHu4V/oYomEWP/j/E2uuvLi57AaJbM3Z/oAHUtrHFK9A9FFggyzpETZE7qWA9BhO/pJQUsjdWRm0pUHsPlf9Uqqit2BKVERiMSlHsBKch4tIk4ryZBazWunDD+QFcllKG74nMVISZ7i8q9IfNy+PWQuJIEm5XrT9W5pnkBIWrePlcAcPo080ALigmyhH+WOPiyO+dfueeq6PVdu2Voc+6FvtylRcn4u8O+E5Wq5amvQAQ=="
+      ];
       aliases = [
         "gitea"
         "git.alexion.dev"

configs/nixos/modules/services/gitea.nix

@@ -0,0 +1,69 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.modules.services.gitea;
+in
+{
+  options.modules.services.gitea = {
+    enable = lib.mkEnableOption "Gitea";
+
+    reverseProxyAddress = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = null;
+      description = "IP address of the reverse proxy trusted to forward client headers.";
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      registry."stable-uid".${config.networking.hostName}.gitea = 20007;
+    }
+
+    (lib.mkIf cfg.enable {
+      users.users.gitea = {
+        isSystemUser = true;
+        uid = config.registry."stable-uid".${config.networking.hostName}.gitea;
+        group = "storage";
+        home = "/var/lib/gitea";
+      };
+
+      networking.firewall.allowedTCPPorts = [
+        2222
+        3000
+      ];
+
+      services.gitea = {
+        enable = true;
+        user = "gitea";
+        group = "storage";
+        stateDir = "/var/lib/gitea";
+        repositoryRoot = "/var/lib/gitea/repositories";
+        lfs = {
+          enable = true;
+          contentDir = "/var/lib/gitea/data/lfs";
+        };
+        database.type = "sqlite3";
+        settings = {
+          server = {
+            HTTP_ADDR = "0.0.0.0";
+            HTTP_PORT = 3000;
+            ROOT_URL = "https://git.alexion.dev/";
+            SSH_DOMAIN = "git.alexion.dev";
+            SSH_PORT = 22;
+            START_SSH_SERVER = true;
+            SSH_LISTEN_HOST = "0.0.0.0";
+            SSH_LISTEN_PORT = 2222;
+          }
+          // lib.optionalAttrs (cfg.reverseProxyAddress != null) {
+            REVERSE_PROXY_TRUSTED_PROXIES = "${cfg.reverseProxyAddress}/32";
+          };
+          service.DISABLE_REGISTRATION = true;
+          session.COOKIE_SECURE = true;
+        };
+      };
+    })
+  ];
+}