From d342370b8923d8eee024e66df208baa26945fd6c Mon Sep 17 00:00:00 2001 From: alexion Date: Thu, 22 Oct 2026 19:51:32 -0400 Subject: [PATCH] feat(nixos): deploy Gitea on Pikachu --- configs/nixos/README.md | 2 +- configs/nixos/guests/gitea.nix | 48 +++++++++++++++++ configs/nixos/guests/reverse-proxy.nix | 15 ++---- configs/nixos/hosts/pikachu/default.nix | 15 ++++++ configs/nixos/modules/network/ssh.nix | 7 ++- configs/nixos/modules/services/gitea.nix | 69 ++++++++++++++++++++++++ 6 files changed, 142 insertions(+), 14 deletions(-) create mode 100644 configs/nixos/guests/gitea.nix create mode 100644 configs/nixos/modules/services/gitea.nix diff --git a/configs/nixos/README.md b/configs/nixos/README.md index 2098e44..f199b6d 100644 --- a/configs/nixos/README.md +++ b/configs/nixos/README.md @@ -102,7 +102,7 @@ Confirm you have connectivity (`ping -c1 github.com`) before continuing. Clone the monorepo onto the live ISO and work from that local checkout: ```console -$ git clone ssh://gitea@git.alexion.dev:2022/alexion/dev.git +$ git clone ssh://gitea@git.alexion.dev/alexion/dev.git $ cd dev ``` diff --git a/configs/nixos/guests/gitea.nix b/configs/nixos/guests/gitea.nix new file mode 100644 index 0000000..bc61fbd --- /dev/null +++ b/configs/nixos/guests/gitea.nix @@ -0,0 +1,48 @@ +{ + config, + lib, + registry, + ... +}: +let + cfg = config.guests.gitea; +in +{ + options.guests.gitea.dataPath = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + example = "/srv/gitea"; + description = "Host path mounted as Gitea's state directory."; + }; + + config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = cfg.dataPath != null; + message = "guests.gitea.dataPath must point at the host directory that stores Gitea state."; + } + ]; + + registry.homepage.${config.networking.hostName}.gitea = { + tab = "Apps"; + section = "Other"; + name = "Gitea"; + description = "Git forge"; + icon = "gitea.png"; + }; + + guests.gitea = { + interior.modules.services.gitea = { + enable = true; + reverseProxyAddress = registry.address.${config.networking.hostName}."reverse-proxy"; + }; + + mounts."/var/lib/gitea" = { + directory = cfg.dataPath; + owner = config.registry."stable-uid".${config.networking.hostName}.gitea; + group = "storage"; + mode = "2770"; + }; + }; + }; +} diff --git a/configs/nixos/guests/reverse-proxy.nix b/configs/nixos/guests/reverse-proxy.nix index 3ad5fa9..eaa646f 100644 --- a/configs/nixos/guests/reverse-proxy.nix +++ b/configs/nixos/guests/reverse-proxy.nix @@ -1,11 +1,9 @@ { config, lib, + registry, ... }: -let - giteaSshBackend = "10.23.20.45:2022"; -in { config = lib.mkIf config.guests.reverse-proxy.enable { guests.reverse-proxy = { @@ -13,11 +11,6 @@ in modules.services.reverse-proxy.enable = true; services.nginx.virtualHosts = { - "git.alexion.dev" = { - forceSSL = true; - enableACME = true; - locations."/".proxyPass = "http://10.23.20.32"; - }; "photos.alexion.dev" = { forceSSL = true; enableACME = true; @@ -45,12 +38,12 @@ in }; }; - networking.firewall.allowedTCPPorts = [ 2022 ]; + networking.firewall.allowedTCPPorts = [ 22 ]; services.nginx.streamConfig = '' server { - listen 2022; - proxy_pass ${giteaSshBackend}; + listen 22; + proxy_pass ${registry.address.${config.networking.hostName}.gitea}:2222; } ''; }; diff --git a/configs/nixos/hosts/pikachu/default.nix b/configs/nixos/hosts/pikachu/default.nix index 2b81737..4751e11 100644 --- a/configs/nixos/hosts/pikachu/default.nix +++ b/configs/nixos/hosts/pikachu/default.nix @@ -96,6 +96,21 @@ }; }; + guests.gitea = { + enable = true; + vlan = 20; + address = "10.23.20.206"; + dataPath = "/pikachu/data/gitea"; + reverseProxy = { + enable = true; + route = { + domain = "git.alexion.dev"; + protocol = "https"; + port = 3000; + }; + }; + }; + guests.romm = { enable = true; vlan = 20; diff --git a/configs/nixos/modules/network/ssh.nix b/configs/nixos/modules/network/ssh.nix index 3a20988..78d1db7 100644 --- a/configs/nixos/modules/network/ssh.nix +++ b/configs/nixos/modules/network/ssh.nix @@ -33,11 +33,14 @@ let }); extraTargets = { - # TODO: Pin Gitea's host key after migrating it from Proxmox. gitea = { hostName = "git.alexion.dev"; - port = 2022; user = "gitea"; + hostKeys = [ + "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBFcUl17AcZz1wS8ek2yS/bu5NRTX4ViYTuFOSnp8leHmirP3Zk5QlC33hodQp09J6EA6Vl8zUowy4qLud7BMurQ=" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkK2W2Ev+9RXa2PNXiNPPCPF5ln2+M2jHiGoZ4cPYxX" + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDZSeU1iRHoaIXgbYe0kAiOAASw9LrQhu54RNCoTQ2O1rbqgnnKO2qbYJvfmUWL7jqEkEotgUBy4Xqxgfl7rXGQ9viWZe+i2tKwJdGsabNLJ+QTDCNyGCd22s1Hhl7n68JvuLTENXl4WpH56MB3yjFmK9onLHHcLG+rWiR0I6Yn264LfNVX0RuZK7TlG0tUKJR5bQBXGT6PxAE1IceYRgbgM0BYq4nakNg/s4ZSpmJFrrGfCHNsnHiEmFAXRFrGwf+0ef2STDukM/ADLziPXu0Ge7k72/UPvtEdcpgvzIDMJ2EznKTnxIoZnFkrDqhGOo8DnXK+cFVKAkkC6NgWQpO6fNnY+MEDgSb0fr/rGcwzUa1p+fON5/zEYxsAtKyAeP4D7OEAo65lsSKqi1tbt521miTobp0NOT8p4tGgHTwmshbqlmUZz0DVexN6uc7yzoHu4V/oYomEWP/j/E2uuvLi57AaJbM3Z/oAHUtrHFK9A9FFggyzpETZE7qWA9BhO/pJQUsjdWRm0pUHsPlf9Uqqit2BKVERiMSlHsBKch4tIk4ryZBazWunDD+QFcllKG74nMVISZ7i8q9IfNy+PWQuJIEm5XrT9W5pnkBIWrePlcAcPo080ALigmyhH+WOPiyO+dfueeq6PVdu2Voc+6FvtylRcn4u8O+E5Wq5amvQAQ==" + ]; aliases = [ "gitea" "git.alexion.dev" diff --git a/configs/nixos/modules/services/gitea.nix b/configs/nixos/modules/services/gitea.nix new file mode 100644 index 0000000..d69723c --- /dev/null +++ b/configs/nixos/modules/services/gitea.nix @@ -0,0 +1,69 @@ +{ + config, + lib, + ... +}: +let + cfg = config.modules.services.gitea; +in +{ + options.modules.services.gitea = { + enable = lib.mkEnableOption "Gitea"; + + reverseProxyAddress = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = null; + description = "IP address of the reverse proxy trusted to forward client headers."; + }; + }; + + config = lib.mkMerge [ + { + registry."stable-uid".${config.networking.hostName}.gitea = 20007; + } + + (lib.mkIf cfg.enable { + users.users.gitea = { + isSystemUser = true; + uid = config.registry."stable-uid".${config.networking.hostName}.gitea; + group = "storage"; + home = "/var/lib/gitea"; + }; + + networking.firewall.allowedTCPPorts = [ + 2222 + 3000 + ]; + + services.gitea = { + enable = true; + user = "gitea"; + group = "storage"; + stateDir = "/var/lib/gitea"; + repositoryRoot = "/var/lib/gitea/repositories"; + lfs = { + enable = true; + contentDir = "/var/lib/gitea/data/lfs"; + }; + database.type = "sqlite3"; + settings = { + server = { + HTTP_ADDR = "0.0.0.0"; + HTTP_PORT = 3000; + ROOT_URL = "https://git.alexion.dev/"; + SSH_DOMAIN = "git.alexion.dev"; + SSH_PORT = 22; + START_SSH_SERVER = true; + SSH_LISTEN_HOST = "0.0.0.0"; + SSH_LISTEN_PORT = 2222; + } + // lib.optionalAttrs (cfg.reverseProxyAddress != null) { + REVERSE_PROXY_TRUSTED_PROXIES = "${cfg.reverseProxyAddress}/32"; + }; + service.DISABLE_REGISTRATION = true; + session.COOKIE_SECURE = true; + }; + }; + }) + ]; +} -- 2.55.0