dotfiles

My PC Dotfiles & Website
git clone https://github.com/maydayv7/dotfiles

git-hosting.nix (3203B)

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
## Gitea Code Hosting ##
_: {
  flake.modules.nixos.git-hosting = {
    config,
    options,
    lib,
    ...
  }: let
    inherit
      (lib)
      mkEnableOption
      mkIf
      mkOption
      types
      ;
    inherit (config.apps.git.hosting) enable domain secret;
    opt = options.apps.git.hosting;
  in {
    options.apps.git.hosting = {
      enable = mkEnableOption "Enable Gitea Code Hosting";
      domain = mkOption {
        description = "Website Domain Name";
        type = types.str;
        default = "";
        example = "maydayv7.net";
      };
      secret = mkOption {
        description = "Path to Cloudfare Authentication Credentials";
        type = types.str;
        default = "";
      };
    };

    config = mkIf enable {
      assertions = [
        {
          assertion = domain != "";
          message = opt.domain.description + " must be set";
        }
        {
          assertion = secret != "";
          message = opt.secret.description + " must be set";
        }
      ];

      # User Configuration
      users.users.git = {
        useDefaultShell = true;
        home = "/var/lib/gitea";
        group = "gitea";
        isSystemUser = true;
      };

      # Gitea Settings
      services.gitea = {
        enable = true;
        lfs.enable = true;

        # Security
        user = "git";
        database.user = "git";
        cookieSecure = true;
        disableRegistration = true;

        # Repository
        inherit domain;
        appName = "Code Hosting";
        rootUrl = "https://${domain}";
        httpPort = 7000;
        settings.ui.DEFAULT_THEME = "arc-green";
      };

      # NGINX Secured Reverse Proxy
      environment.persist.directories = ["/srv"];
      networking.firewall = {
        allowedUDPPorts = [7000];
        allowedTCPPorts = [
          80
          443
          7000
        ];
      };

      security.acme = {
        acceptTerms = true;
        email = "accounts+acme@${domain}";
        certs."${domain}" = {
          group = "nginx";
          email = "admin@${domain}";
          dnsProvider = "cloudflare";
          credentialsFile = secret;
          extraLegoFlags = ["--dns.resolvers=8.8.8.8:53"];
        };
      };

      services.nginx = {
        enable = true;

        # Security
        clientMaxBodySize = "1g";
        commonHttpConfig = ''
          client_body_buffer_size 4k;
          large_client_header_buffers 2 4k;
          map $sent_http_content_type $expires {
            default                off;
            text/html              10m;
            text/css               max;
            application/javascript max;
            application/pdf        max;
            ~image/                max;
          }
        '';

        # Recommended Defaults
        recommendedGzipSettings = true;
        recommendedOptimisation = true;
        recommendedProxySettings = true;
        recommendedTlsSettings = true;

        # Code Hosting
        virtualHosts."${domain}" = {
          forceSSL = true;
          useACMEHost = "${domain}";
          root = "/srv/www/${domain}";
          locations."/".proxyPass = "http://127.0.0.1:7000";
        };
      };
    };
  };
}