cluster/services/forge: init

cluster/services/forge/credentials/forgejo-db-credentials.age

@@ -0,0 +1,13 @@
+age-encryption.org/v1
+-> ssh-ed25519 NO562A YQQrnpQI/qyEZugiRwsrPbW4oMYK/rlmRKAdD3JjYz4
+JRGFqNc4BVflfR4WUuEOym39IhZlUI778NtOFtxE8eY
+-> ssh-ed25519 5/zT0w utH25Xa9WQK9hXbKWsEWK5LJtCbhjpDX6JaomxnRaCI
+2MfxxDjs0doUTVsGP9942rx1tyCYsDxhlDo1542BhKQ
+-> ssh-ed25519 d3WGuA 6qD02cluQEBqEvupHf93Onlpv8QJJSl/bJm/XqyD+gQ
+bLz/ULSaIW6HnPXDKD5dxCbQWv0VC2R+E5wlj7VxOc0
+-> Ovax-grease ^1$]}H G4 FpDF XKHkj{
+IVdVFYcVe9PoHCCqM3GG1pM6xgTZ5r8XWlkBjlQimgaDArotF4dPpsSTpyc
+--- wdTYr6EpFPFsDJI0qQf74c6ce+v5ek6j+mgAx2CI9uI
+ÜA³×oÈð:±­‹`ÜVd±å(Kät:fk¼’}3*#MJš<4A>Áõ]ê,¤éÐÈÍ69i›l`ÛÆJKwAè8­y@Ýœ¯à+&ðÖ©s]ÅÓ–›Ç>~Ší„+Úô
+üÁ»<C381>qa©h<C2A9>( YÕ<17>eÇjýI•ê·/ð^å~Ý’wÊ
+ÆÜßÌZî!^þRˆéÿv­¾…ïk‹Êp»ÛPÌ)ý̆ÍpÓV5²F΄ÆÚÙÚÞhBÇ»ßb#Š<>´ùºãi”»¸9ìQy¹¾<C2B9>Êè‹}€ß	ƒ¬E}~ZHûjmyq{òxŠ–Éôß<C3B4>"”éÀ´C#šójÿÐ.ò§yÔ£¸v¦
<0A>ÉÐòê<1“Œúâ¾ìßzâš#/êGñ?që

cluster/services/forge/default.nix

@@ -0,0 +1,6 @@
+{
+  services.forge = {
+    nodes.server = [ "VEGAS" ];
+    nixos.server = ./server.nix;
+  };
+}

cluster/services/forge/server.nix

@@ -0,0 +1,91 @@
+{ cluster, config, depot, lib, pkgs, tools, ... }:
+
+let
+  inherit (tools.meta) domain;
+  inherit (tools.nginx) vhosts;
+  inherit (config.age) secrets;
+
+  patroni = cluster.config.links.patroni-pg-access;
+
+  host = "forge.${domain}";
+
+  link = config.links.forge;
+
+  exe = lib.getExe config.services.gitea.package;
+in
+
+{
+  age.secrets = {
+    forgejoOidcSecret = {
+      file = ./credentials/forgejo-oidc-secret.age;
+      owner = "gitea";
+    };
+    forgejoDbCredentials = {
+      file = ./credentials/forgejo-db-credentials.age;
+      owner = "gitea";
+    };
+  };
+
+  links.forge.protocol = "http";
+
+  services.gitea = {
+    enable = true;
+    package = depot.packages.forgejo;
+    appName = "The Forge";
+    stateDir = "/srv/storage/private/forge";
+    database = {
+      createDatabase = false;
+      type = "postgres";
+      host = patroni.ipv4;
+      inherit (patroni) port;
+      name = "forge";
+      user = "forge";
+      passwordFile = secrets.forgejoDbCredentials.path;
+    };
+    settings = {
+      server = {
+        DOMAIN = host;
+        ROOT_URL = "https://${host}/";
+        PROTOCOL = link.protocol;
+        HTTP_ADDR = link.ipv4;
+        HTTP_PORT = link.port;
+      };
+      oauth2_client = {
+        REGISTER_EMAIL_CONFIRM = false;
+        ENABLE_AUTO_REGISTRATION = true;
+        ACCOUNT_LINKING = "auto";
+        UPDATE_AVATAR = true;
+      };
+      session.COOKIE_SECURE = true;
+      service = {
+        DISABLE_REGISTRATION = false;
+        ALLOW_ONLY_INTERNAL_REGISTRATION = false;
+        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+      };
+      log.ENABLE_XORM_LOG = false;
+      # enabling this will leak secrets to the log
+      database.LOG_SQL = false;
+    };
+  };
+
+  services.nginx.virtualHosts."${host}" = vhosts.proxy link.url;
+
+  systemd.services.gitea.preStart = let
+    providerName = "PrivateVoidAccount";
+    args = lib.escapeShellArgs [
+      "--name" providerName
+      "--provider" "openidConnect"
+      "--key" "net.privatevoid.forge1"
+      "--auto-discover-url" "https://login.${domain}/auth/realms/master/.well-known/openid-configuration"
+      "--group-claim-name" "groups"
+      "--admin-group" "/forge_admins@${domain}"
+    ];
+  in lib.mkAfter /*bash*/ ''
+    providerId="$(${exe} admin auth list | ${pkgs.gnugrep}/bin/grep -w '${providerName}' | cut -f1)"
+    if [[ -z "$providerId" ]]; then
+      FORGEJO_ADMIN_OAUTH2_SECRET="$(< ${secrets.forgejoOidcSecret.path})" ${exe} admin auth add-oauth ${args}
+    else
+      FORGEJO_ADMIN_OAUTH2_SECRET="$(< ${secrets.forgejoOidcSecret.path})" ${exe} admin auth update-oauth --id "$providerId" ${args}
+    fi
+  '';
+}

secrets.nix

@@ -15,6 +15,8 @@ in with hosts;
   "cluster/services/dns/pdns-admin-secret.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "cluster/services/dns/pdns-api-key.age".publicKeys = max ++ map systemKeys [ checkmate thunderskin VEGAS prophet ];
   "cluster/services/dns/pdns-db-credentials.age".publicKeys = max ++ map systemKeys [ checkmate VEGAS prophet ];
+  "cluster/services/forge/credentials/forgejo-oidc-secret.age".publicKeys = max ++ map systemKeys [ VEGAS ];
+  "cluster/services/forge/credentials/forgejo-db-credentials.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "cluster/services/hercules-ci-multi-agent/secrets/hci-cache-config.age".publicKeys = max ++ map systemKeys [ VEGAS prophet ];
   "cluster/services/hercules-ci-multi-agent/secrets/hci-cache-credentials-prophet.age".publicKeys = max ++ map systemKeys [ prophet ];
   "cluster/services/hercules-ci-multi-agent/secrets/hci-cache-credentials-VEGAS.age".publicKeys = max ++ map systemKeys [ VEGAS ];