cluster/services/forge: init
This commit is contained in:
parent
fe5b9921dd
commit
3742dd45fb
5 changed files with 112 additions and 0 deletions
|
@ -0,0 +1,13 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 NO562A YQQrnpQI/qyEZugiRwsrPbW4oMYK/rlmRKAdD3JjYz4
|
||||
JRGFqNc4BVflfR4WUuEOym39IhZlUI778NtOFtxE8eY
|
||||
-> ssh-ed25519 5/zT0w utH25Xa9WQK9hXbKWsEWK5LJtCbhjpDX6JaomxnRaCI
|
||||
2MfxxDjs0doUTVsGP9942rx1tyCYsDxhlDo1542BhKQ
|
||||
-> ssh-ed25519 d3WGuA 6qD02cluQEBqEvupHf93Onlpv8QJJSl/bJm/XqyD+gQ
|
||||
bLz/ULSaIW6HnPXDKD5dxCbQWv0VC2R+E5wlj7VxOc0
|
||||
-> Ovax-grease ^1$]}H G4 FpDF XKHkj{
|
||||
IVdVFYcVe9PoHCCqM3GG1pM6xgTZ5r8XWlkBjlQimgaDArotF4dPpsSTpyc
|
||||
--- wdTYr6EpFPFsDJI0qQf74c6ce+v5ek6j+mgAx2CI9uI
|
||||
ÜA³×oÈð:±‹`ÜVd±å(Kät:fk¼’}3*#MJš<4A>Áõ]ê,¤éÐÈÍ69i›l`ÛÆJKwAè8y@Ýœ¯à+&ðÖ©s]ÅÓ–›Ç>~Ší„+Úô
|
||||
üÁ»<C381>qa©h<C2A9>( YÕ<17>eÇjýI•ê·/ð^å~Ý’wÊ
|
||||
ÆÜßÌZî!^þRˆéÿv¾…ïk‹Êp»ÛPÌ)ý̆ÍpÓV5²F΄ÆÚÙÚÞhBÇ»ßb#Š<>´ùºãi”»¸9ìQy¹¾<C2B9>Êè‹}€ß ƒ¬E}~ZHûjmyq{òxŠ–Éôß<C3B4>"”éÀ´C#šójÿÐ.ò§yÔ£¸v¦
<0A>ÉÐòê<1“Œúâ¾ìßzâš#/êGñ?që
|
BIN
cluster/services/forge/credentials/forgejo-oidc-secret.age
Normal file
BIN
cluster/services/forge/credentials/forgejo-oidc-secret.age
Normal file
Binary file not shown.
6
cluster/services/forge/default.nix
Normal file
6
cluster/services/forge/default.nix
Normal file
|
@ -0,0 +1,6 @@
|
|||
{
|
||||
services.forge = {
|
||||
nodes.server = [ "VEGAS" ];
|
||||
nixos.server = ./server.nix;
|
||||
};
|
||||
}
|
91
cluster/services/forge/server.nix
Normal file
91
cluster/services/forge/server.nix
Normal file
|
@ -0,0 +1,91 @@
|
|||
{ cluster, config, depot, lib, pkgs, tools, ... }:
|
||||
|
||||
let
|
||||
inherit (tools.meta) domain;
|
||||
inherit (tools.nginx) vhosts;
|
||||
inherit (config.age) secrets;
|
||||
|
||||
patroni = cluster.config.links.patroni-pg-access;
|
||||
|
||||
host = "forge.${domain}";
|
||||
|
||||
link = config.links.forge;
|
||||
|
||||
exe = lib.getExe config.services.gitea.package;
|
||||
in
|
||||
|
||||
{
|
||||
age.secrets = {
|
||||
forgejoOidcSecret = {
|
||||
file = ./credentials/forgejo-oidc-secret.age;
|
||||
owner = "gitea";
|
||||
};
|
||||
forgejoDbCredentials = {
|
||||
file = ./credentials/forgejo-db-credentials.age;
|
||||
owner = "gitea";
|
||||
};
|
||||
};
|
||||
|
||||
links.forge.protocol = "http";
|
||||
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
package = depot.packages.forgejo;
|
||||
appName = "The Forge";
|
||||
stateDir = "/srv/storage/private/forge";
|
||||
database = {
|
||||
createDatabase = false;
|
||||
type = "postgres";
|
||||
host = patroni.ipv4;
|
||||
inherit (patroni) port;
|
||||
name = "forge";
|
||||
user = "forge";
|
||||
passwordFile = secrets.forgejoDbCredentials.path;
|
||||
};
|
||||
settings = {
|
||||
server = {
|
||||
DOMAIN = host;
|
||||
ROOT_URL = "https://${host}/";
|
||||
PROTOCOL = link.protocol;
|
||||
HTTP_ADDR = link.ipv4;
|
||||
HTTP_PORT = link.port;
|
||||
};
|
||||
oauth2_client = {
|
||||
REGISTER_EMAIL_CONFIRM = false;
|
||||
ENABLE_AUTO_REGISTRATION = true;
|
||||
ACCOUNT_LINKING = "auto";
|
||||
UPDATE_AVATAR = true;
|
||||
};
|
||||
session.COOKIE_SECURE = true;
|
||||
service = {
|
||||
DISABLE_REGISTRATION = false;
|
||||
ALLOW_ONLY_INTERNAL_REGISTRATION = false;
|
||||
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
|
||||
};
|
||||
log.ENABLE_XORM_LOG = false;
|
||||
# enabling this will leak secrets to the log
|
||||
database.LOG_SQL = false;
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts."${host}" = vhosts.proxy link.url;
|
||||
|
||||
systemd.services.gitea.preStart = let
|
||||
providerName = "PrivateVoidAccount";
|
||||
args = lib.escapeShellArgs [
|
||||
"--name" providerName
|
||||
"--provider" "openidConnect"
|
||||
"--key" "net.privatevoid.forge1"
|
||||
"--auto-discover-url" "https://login.${domain}/auth/realms/master/.well-known/openid-configuration"
|
||||
"--group-claim-name" "groups"
|
||||
"--admin-group" "/forge_admins@${domain}"
|
||||
];
|
||||
in lib.mkAfter /*bash*/ ''
|
||||
providerId="$(${exe} admin auth list | ${pkgs.gnugrep}/bin/grep -w '${providerName}' | cut -f1)"
|
||||
if [[ -z "$providerId" ]]; then
|
||||
FORGEJO_ADMIN_OAUTH2_SECRET="$(< ${secrets.forgejoOidcSecret.path})" ${exe} admin auth add-oauth ${args}
|
||||
else
|
||||
FORGEJO_ADMIN_OAUTH2_SECRET="$(< ${secrets.forgejoOidcSecret.path})" ${exe} admin auth update-oauth --id "$providerId" ${args}
|
||||
fi
|
||||
'';
|
||||
}
|
|
@ -15,6 +15,8 @@ in with hosts;
|
|||
"cluster/services/dns/pdns-admin-secret.age".publicKeys = max ++ map systemKeys [ VEGAS ];
|
||||
"cluster/services/dns/pdns-api-key.age".publicKeys = max ++ map systemKeys [ checkmate thunderskin VEGAS prophet ];
|
||||
"cluster/services/dns/pdns-db-credentials.age".publicKeys = max ++ map systemKeys [ checkmate VEGAS prophet ];
|
||||
"cluster/services/forge/credentials/forgejo-oidc-secret.age".publicKeys = max ++ map systemKeys [ VEGAS ];
|
||||
"cluster/services/forge/credentials/forgejo-db-credentials.age".publicKeys = max ++ map systemKeys [ VEGAS ];
|
||||
"cluster/services/hercules-ci-multi-agent/secrets/hci-cache-config.age".publicKeys = max ++ map systemKeys [ VEGAS prophet ];
|
||||
"cluster/services/hercules-ci-multi-agent/secrets/hci-cache-credentials-prophet.age".publicKeys = max ++ map systemKeys [ prophet ];
|
||||
"cluster/services/hercules-ci-multi-agent/secrets/hci-cache-credentials-VEGAS.age".publicKeys = max ++ map systemKeys [ VEGAS ];
|
||||
|
|
Loading…
Reference in a new issue