privatevoid.net/depot
1
1
Fork 0
Code Issues 23 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

cluster/services/forge: switch to s3 storage

Browse source
This commit is contained in:
Max Headroom 2024-07-04 00:26:07 +02:00
parent b13746f395
commit e68ec76011
4 changed files with 34 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
cluster/services/forge/credentials/forgejo-s3-access-key-id.age Normal file
View file

@ -0,0 +1,9 @@
age-encryption.org/v1
-> ssh-ed25519 NO562A 5NtIVE60zj6mR2+/2N0eS6lWTkddt3rsDWHZpNefLAo
5b8sLEf76HReLUuBcTVjTOnzjrVdwcxnG0TraO+eHww
-> ssh-ed25519 5/zT0w RbikYmV32iG1QgMDiObNPV+GZOW35K6hbx2n2eLCvno
bXVeCmC2UpnTx8Udpx657mMGqRvYO7Gn53YwtW6NJEk
-> ssh-ed25519 d3WGuA 4+sPg6CCmOxlJUls3qZpWvN+f2V4SHRXhrBxKQPQyho
z2TCvvpOZ8Nh4IQ0oPKD1yj0dP3rnLMzuvRpZxE2SSU
--- aj9laXQ3ccpGvhDpYIrpPzxfC4G6A5LdCkaWFSgUXUY
0žÜ¾K ÿWðúÉ=þ,nÃÑðŽ—½O{9Z±HÇN\—ûwšᇎ#›•Ù´gYÊD¬PåJÿÀ

BIN
cluster/services/forge/credentials/forgejo-s3-secret-access-key.age Normal file
View file

Binary file not shown.

23
cluster/services/forge/server.nix
View file

@ -20,6 +20,7 @@ in
before = [ "forgejo.service" ];
incantations = i: [
(i.execShell "chown -R forgejo:forgejo /srv/storage/private/forge")
(i.execShell "rm -rf /srv/storage/private/forge/data/{attachments,lfs,avatars,repo-avatars,repo-archive,packages,actions_log,actions_artifacts}")
];
};
@ -32,6 +33,14 @@ in
file = ./credentials/forgejo-db-credentials.age;
owner = "forgejo";
};
forgejoS3AccessKeyID = {
file = ./credentials/forgejo-s3-access-key-id.age;
owner = "forgejo";
};
forgejoS3SecretAccessKey = {
file = ./credentials/forgejo-s3-secret-access-key.age;
owner = "forgejo";
};
};
links.forge.protocol = "http";
@ -72,10 +81,24 @@ in
ALLOW_ONLY_INTERNAL_REGISTRATION = false;
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
};
storage = {
STORAGE_TYPE = "minio";
MINIO_ENDPOINT = cluster.config.links.garageS3.hostname;
MINIO_BUCKET = "forgejo";
MINIO_USE_SSL = true;
MINIO_BUCKET_LOOKUP = "path";
SERVE_DIRECT = true;
};
log.ENABLE_XORM_LOG = false;
# enabling this will leak secrets to the log
database.LOG_SQL = false;
};
secrets = {
storage = {
MINIO_ACCESS_KEY_ID = secrets.forgejoS3AccessKeyID.path;
MINIO_SECRET_ACCESS_KEY = secrets.forgejoS3SecretAccessKey.path;
};
};
};
services.nginx.virtualHosts."${host}" = vhosts.proxy link.url;

2
secrets.nix
View file

@ -17,6 +17,8 @@ in with hosts;
"cluster/services/dns/acme-dns-db-credentials.age".publicKeys = max ++ map systemKeys [ checkmate VEGAS prophet ];
"cluster/services/forge/credentials/forgejo-oidc-secret.age".publicKeys = max ++ map systemKeys [ VEGAS ];
"cluster/services/forge/credentials/forgejo-db-credentials.age".publicKeys = max ++ map systemKeys [ VEGAS ];
"cluster/services/forge/credentials/forgejo-s3-access-key-id.age".publicKeys = max ++ map systemKeys [ VEGAS ];
"cluster/services/forge/credentials/forgejo-s3-secret-access-key.age".publicKeys = max ++ map systemKeys [ VEGAS ];
"cluster/services/hercules-ci-multi-agent/secrets/hci-cache-config.age".publicKeys = max ++ map systemKeys [ VEGAS prophet ];
"cluster/services/hercules-ci-multi-agent/secrets/hci-cache-credentials-prophet.age".publicKeys = max ++ map systemKeys [ prophet ];
"cluster/services/hercules-ci-multi-agent/secrets/hci-cache-credentials-VEGAS.age".publicKeys = max ++ map systemKeys [ VEGAS ];