services: forgejo: init

services/default.nix

@@ -3,6 +3,7 @@
     ./vaultwarden.nix
     ./fail2ban.nix
     ./fava.nix
+    ./forgejo
     ./gitea
     ./immich.nix
     ./jellyfin.nix

services/forgejo/default.nix

@@ -0,0 +1,126 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  inherit
+    (lib)
+    mkEnableOption
+    mkIf
+    mkOption
+    ;
+
+  cfg = config.my.services.forgejo;
+  my = config.my;
+
+  domain = config.networking.domain;
+  hostname = config.networking.hostName;
+  fqdn = "${hostname}.${domain}";
+
+  forgejoUser = "git";
+in {
+  options.my.services.forgejo = let
+    inherit (lib) types;
+  in {
+    enable = mkEnableOption "Personal Git hosting with Forgejo";
+
+    privatePort = mkOption {
+      type = types.port;
+      default = 8082;
+      example = 8082;
+      description = "Port to serve the app";
+    };
+  };
+
+  config = mkIf cfg.enable {
+    # use git as user to have `git clone git@git.domain`
+    users.users.${forgejoUser} = {
+      description = "Forgejo Service";
+      home = config.services.forgejo.stateDir;
+      useDefaultShell = true;
+      group = forgejoUser;
+
+      # the systemd service for the forgejo module seems to hardcode the group as
+      # forgejo, so, uh, just in case?
+      extraGroups = ["forgejo"];
+
+      isSystemUser = true;
+    };
+    users.groups.${forgejoUser} = {};
+
+    services.forgejo = {
+      enable = true;
+      user = forgejoUser;
+      appName = "Personal Forge";
+      lfs.enable = true;
+
+      settings = {
+        server = {
+          ROOT_URL = "https://git.${domain}/";
+          DOMAIN = "git.${domain}";
+          HTTP_ADDR = "127.0.0.1";
+          HTTP_PORT = cfg.privatePort;
+        };
+        log.LEVEL = "Warn"; # [ "Trace" "Debug" "Info" "Warn" "Error" "Critical" ]
+        other.SHOW_FOOTER_VERSION = false;
+        repository = {
+          ENABLE_PUSH_CREATE_USER = true;
+          DEFAULT_BRANCH = "main";
+        };
+
+        # NOTE: temporarily remove this for initial setup
+        service.DISABLE_REGISTRATION = true;
+
+        # only send cookies via HTTPS
+        session.COOKIE_SECURE = true;
+      };
+
+      # NixOS module uses `forgejo dump` to backup repositories and the database,
+      # but it produces a single .zip file that's not very restic friendly.
+      # I configure my backup system manually below.
+      dump.enable = false;
+
+      database = {
+        type = "postgres";
+        # user needs to be the same as forgejo user
+        user = forgejoUser;
+        name = forgejoUser;
+      };
+    };
+
+    # FIXME: Borg *could* be backing up files while they're being edited by
+    # forgejo, so it may produce corrupt files in the snapshot if I push stuff
+    # around midnight. I'm not sure how `forgejo dump` handles this either,
+    # though.
+    my.services.restic-backup = {
+      paths = [
+        config.services.forgejo.lfs.contentDir
+        config.services.forgejo.repositoryRoot
+      ];
+    };
+
+    # NOTE: no need to use postgresql.ensureDatabases because the forgejo module
+    # takes care of this automatically
+    services.postgresqlBackup = {
+      databases = [config.services.forgejo.database.name];
+    };
+
+    services.nginx = {
+      virtualHosts = {
+        "git.${domain}" = {
+          forceSSL = true;
+          useACMEHost = fqdn;
+
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:${toString cfg.privatePort}";
+          };
+        };
+      };
+    };
+
+    security.acme.certs.${fqdn}.extraDomainNames = ["git.${domain}"];
+
+    systemd.services.forgejo.preStart = "${pkgs.coreutils}/bin/ln -sfT ${./templates} ${config.services.forgejo.stateDir}/custom/templates";
+  };
+}

services/forgejo/templates/home.tmpl

@@ -0,0 +1,17 @@
+{{template "base/head" .}}
+<div class="page-content home">
+	<div class="ui stackable middle very relaxed page grid">
+		<div class="sixteen wide center aligned centered column">
+			<div>
+				<img class="logo" width="220" height="220" src="{{AssetUrlPrefix}}/img/logo.svg"/>
+			</div>
+			<div class="hero">
+				<h1 class="ui icon header title">
+					{{AppName}}
+				</h1>
+				<h2>alarsyo's personal projects are hosted here</h2>
+			</div>
+		</div>
+	</div>
+</div>
+{{template "base/footer" .}}