dotfiles

  1## Gitea Code Hosting ##
  2_: {
  3  flake.modules.nixos.git-hosting = {
  4    config,
  5    options,
  6    lib,
  7    ...
  8  }: let
  9    inherit
 10      (lib)
 11      mkEnableOption
 12      mkIf
 13      mkOption
 14      types
 15      ;
 16    inherit (config.apps.git.hosting) enable domain secret;
 17    opt = options.apps.git.hosting;
 18  in {
 19    options.apps.git.hosting = {
 20      enable = mkEnableOption "Enable Gitea Code Hosting";
 21      domain = mkOption {
 22        description = "Website Domain Name";
 23        type = types.str;
 24        default = "";
 25        example = "maydayv7.net";
 26      };
 27      secret = mkOption {
 28        description = "Path to Cloudfare Authentication Credentials";
 29        type = types.str;
 30        default = "";
 31      };
 32    };
 33
 34    config = mkIf enable {
 35      assertions = [
 36        {
 37          assertion = domain != "";
 38          message = opt.domain.description + " must be set";
 39        }
 40        {
 41          assertion = secret != "";
 42          message = opt.secret.description + " must be set";
 43        }
 44      ];
 45
 46      # User Configuration
 47      users.users.git = {
 48        useDefaultShell = true;
 49        home = "/var/lib/gitea";
 50        group = "gitea";
 51        isSystemUser = true;
 52      };
 53
 54      # Gitea Settings
 55      services.gitea = {
 56        enable = true;
 57        lfs.enable = true;
 58
 59        # Security
 60        user = "git";
 61        database.user = "git";
 62        cookieSecure = true;
 63        disableRegistration = true;
 64
 65        # Repository
 66        inherit domain;
 67        appName = "Code Hosting";
 68        rootUrl = "https://${domain}";
 69        httpPort = 7000;
 70        settings.ui.DEFAULT_THEME = "arc-green";
 71      };
 72
 73      # NGINX Secured Reverse Proxy
 74      environment.persist.directories = ["/srv"];
 75      networking.firewall = {
 76        allowedUDPPorts = [7000];
 77        allowedTCPPorts = [
 78          80
 79          443
 80          7000
 81        ];
 82      };
 83
 84      security.acme = {
 85        acceptTerms = true;
 86        email = "accounts+acme@${domain}";
 87        certs."${domain}" = {
 88          group = "nginx";
 89          email = "admin@${domain}";
 90          dnsProvider = "cloudflare";
 91          credentialsFile = secret;
 92          extraLegoFlags = ["--dns.resolvers=8.8.8.8:53"];
 93        };
 94      };
 95
 96      services.nginx = {
 97        enable = true;
 98
 99        # Security
100        clientMaxBodySize = "1g";
101        commonHttpConfig = ''
102          client_body_buffer_size 4k;
103          large_client_header_buffers 2 4k;
104          map $sent_http_content_type $expires {
105            default                off;
106            text/html              10m;
107            text/css               max;
108            application/javascript max;
109            application/pdf        max;
110            ~image/                max;
111          }
112        '';
113
114        # Recommended Defaults
115        recommendedGzipSettings = true;
116        recommendedOptimisation = true;
117        recommendedProxySettings = true;
118        recommendedTlsSettings = true;
119
120        # Code Hosting
121        virtualHosts."${domain}" = {
122          forceSSL = true;
123          useACMEHost = "${domain}";
124          root = "/srv/www/${domain}";
125          locations."/".proxyPass = "http://127.0.0.1:7000";
126        };
127      };
128    };
129  };
130}