From e68ec76011cde5d6293848166c9ba75b97b2f22b Mon Sep 17 00:00:00 2001
From: Max <max@privatevoid.net>
Date: Thu, 4 Jul 2024 00:26:07 +0200
Subject: [PATCH] cluster/services/forge: switch to s3 storage

---
 .../credentials/forgejo-s3-access-key-id.age  |   9 +++++++
 .../forgejo-s3-secret-access-key.age          | Bin 0 -> 497 bytes
 cluster/services/forge/server.nix             |  23 ++++++++++++++++++
 secrets.nix                                   |   2 ++
 4 files changed, 34 insertions(+)
 create mode 100644 cluster/services/forge/credentials/forgejo-s3-access-key-id.age
 create mode 100644 cluster/services/forge/credentials/forgejo-s3-secret-access-key.age

diff --git a/cluster/services/forge/credentials/forgejo-s3-access-key-id.age b/cluster/services/forge/credentials/forgejo-s3-access-key-id.age
new file mode 100644
index 0000000..1d3cdce
--- /dev/null
+++ b/cluster/services/forge/credentials/forgejo-s3-access-key-id.age
@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> ssh-ed25519 NO562A 5NtIVE60zj6mR2+/2N0eS6lWTkddt3rsDWHZpNefLAo
+5b8sLEf76HReLUuBcTVjTOnzjrVdwcxnG0TraO+eHww
+-> ssh-ed25519 5/zT0w RbikYmV32iG1QgMDiObNPV+GZOW35K6hbx2n2eLCvno
+bXVeCmC2UpnTx8Udpx657mMGqRvYO7Gn53YwtW6NJEk
+-> ssh-ed25519 d3WGuA 4+sPg6CCmOxlJUls3qZpWvN+f2V4SHRXhrBxKQPQyho
+z2TCvvpOZ8Nh4IQ0oPKD1yj0dP3rnLMzuvRpZxE2SSU
+--- aj9laXQ3ccpGvhDpYIrpPzxfC4G6A5LdCkaWFSgUXUY
+0žÜ¾KÿWðúÉ=þ,nÃÑðŽ—½O{9Z±HÇN\—ûwšᇎ#›•Ù´gYÊD¬PåJÿÀ
\ No newline at end of file
diff --git a/cluster/services/forge/credentials/forgejo-s3-secret-access-key.age b/cluster/services/forge/credentials/forgejo-s3-secret-access-key.age
new file mode 100644
index 0000000000000000000000000000000000000000..5637d4d41c350bcbc9a3436a0fe728f282f46211
GIT binary patch
literal 497
zcmZ9_t8>$E003YFf(v4jafirZ5WOs~C20kNw8_#g{UuG8HYLpD-R9La51IsrL%?xh
zikLuccW~Tr=ot>NNyJdVRqc*Duo(Qlf8aAb2XSI6t&)5;kGJNjhd#j}WCzZ&DdN}!
zMd2-2k|~;CVU@+*teG>mv*650M>9pL8+1`Sl!x3z+g>mx(@gZ7u<$t~f)IqYD0+3P
zJtRezwIz4IJ$4eX9CXWROVkU!SoF&%^{#FdTC3O+4x?5&#x#T0YaQKNFmx=%1Ybp?
zU9yLz%gQxb(yxS~)D)-~QFKF<{T^>;R%M0_AaYr=Gm!yfT6y_M8h45gt)dNQ`|4(s
znozKCYY5!ZpO?H+0wZk_Gfs<2ydTqwE;vC(2(w;TrTn7uEoeZfqr%EvE|R_OlvO=h
zp0ovq<2y4AlXB1XW514S3{QIyf*`O2Qa}`5qKczB@(rO7888;qJu(QFwiVT*B#0H+
z-XEd?bhi2Z_xj}P7IC(I);&03FQw}j{+G|U(2qygjDvgb&sXnH@BjJmWAOU##=q14
z>eKqgOKp|D5vXJ3>E*W_?FJ5htqvc*yLluZZ`?V*`yhWC4R_BU9uDx^&->WLfBt>3
AHvj+t

literal 0
HcmV?d00001

diff --git a/cluster/services/forge/server.nix b/cluster/services/forge/server.nix
index 2de93b3..ce4cefc 100644
--- a/cluster/services/forge/server.nix
+++ b/cluster/services/forge/server.nix
@@ -20,6 +20,7 @@ in
     before = [ "forgejo.service" ];
     incantations = i: [
       (i.execShell "chown -R forgejo:forgejo /srv/storage/private/forge")
+      (i.execShell "rm -rf /srv/storage/private/forge/data/{attachments,lfs,avatars,repo-avatars,repo-archive,packages,actions_log,actions_artifacts}")
     ];
   };
 
@@ -32,6 +33,14 @@ in
       file = ./credentials/forgejo-db-credentials.age;
       owner = "forgejo";
     };
+    forgejoS3AccessKeyID = {
+      file = ./credentials/forgejo-s3-access-key-id.age;
+      owner = "forgejo";
+    };
+    forgejoS3SecretAccessKey = {
+      file = ./credentials/forgejo-s3-secret-access-key.age;
+      owner = "forgejo";
+    };
   };
 
   links.forge.protocol = "http";
@@ -72,10 +81,24 @@ in
         ALLOW_ONLY_INTERNAL_REGISTRATION = false;
         ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
       };
+      storage = {
+        STORAGE_TYPE = "minio";
+        MINIO_ENDPOINT = cluster.config.links.garageS3.hostname;
+        MINIO_BUCKET = "forgejo";
+        MINIO_USE_SSL = true;
+        MINIO_BUCKET_LOOKUP = "path";
+        SERVE_DIRECT = true;
+      };
       log.ENABLE_XORM_LOG = false;
       # enabling this will leak secrets to the log
       database.LOG_SQL = false;
     };
+    secrets = {
+      storage = {
+        MINIO_ACCESS_KEY_ID = secrets.forgejoS3AccessKeyID.path;
+        MINIO_SECRET_ACCESS_KEY = secrets.forgejoS3SecretAccessKey.path;
+      };
+    };
   };
 
   services.nginx.virtualHosts."${host}" = vhosts.proxy link.url;
diff --git a/secrets.nix b/secrets.nix
index 0e77cc6..471c12b 100644
--- a/secrets.nix
+++ b/secrets.nix
@@ -17,6 +17,8 @@ in with hosts;
   "cluster/services/dns/acme-dns-db-credentials.age".publicKeys = max ++ map systemKeys [ checkmate VEGAS prophet ];
   "cluster/services/forge/credentials/forgejo-oidc-secret.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "cluster/services/forge/credentials/forgejo-db-credentials.age".publicKeys = max ++ map systemKeys [ VEGAS ];
+  "cluster/services/forge/credentials/forgejo-s3-access-key-id.age".publicKeys = max ++ map systemKeys [ VEGAS ];
+  "cluster/services/forge/credentials/forgejo-s3-secret-access-key.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "cluster/services/hercules-ci-multi-agent/secrets/hci-cache-config.age".publicKeys = max ++ map systemKeys [ VEGAS prophet ];
   "cluster/services/hercules-ci-multi-agent/secrets/hci-cache-credentials-prophet.age".publicKeys = max ++ map systemKeys [ prophet ];
   "cluster/services/hercules-ci-multi-agent/secrets/hci-cache-credentials-VEGAS.age".publicKeys = max ++ map systemKeys [ VEGAS ];