112 lines
2.8 KiB
Nix
112 lines
2.8 KiB
Nix
{ config, lib, ... }:
|
|
let
|
|
cfg = config.youthlic.containers.forgejo;
|
|
in
|
|
{
|
|
options = {
|
|
youthlic.containers.forgejo = {
|
|
enable = lib.mkEnableOption "forgejo container";
|
|
domain = lib.mkOption {
|
|
type = lib.types.nonEmptyStr;
|
|
example = "forgejo.example.com";
|
|
};
|
|
sshPort = lib.mkOption {
|
|
type = lib.types.port;
|
|
default = 2222;
|
|
};
|
|
httpPort = lib.mkOption {
|
|
type = lib.types.port;
|
|
default = 8480;
|
|
};
|
|
};
|
|
};
|
|
config = lib.mkIf cfg.enable {
|
|
youthlic.containers.enable = true;
|
|
containers."forgejo" = {
|
|
ephemeral = true;
|
|
autoStart = true;
|
|
privateNetwork = true;
|
|
hostBridge = "${config.youthlic.containers.bridgeName}";
|
|
localAddress = "192.168.111.101/24";
|
|
bindMounts = {
|
|
"/var/lib/forgejo" = {
|
|
hostPath = "/mnt/containers/forgejo/state";
|
|
isReadOnly = false;
|
|
};
|
|
"/var/lib/postgresql" = {
|
|
hostPath = "/mnt/containers/forgejo/dataset";
|
|
isReadOnly = false;
|
|
};
|
|
};
|
|
forwardPorts = [
|
|
{
|
|
containerPort = cfg.sshPort;
|
|
hostPort = 2222;
|
|
protocol = "tcp";
|
|
}
|
|
{
|
|
containerPort = cfg.sshPort;
|
|
hostPort = 2222;
|
|
protocol = "udp";
|
|
}
|
|
];
|
|
|
|
config =
|
|
{ lib, ... }:
|
|
{
|
|
imports = [
|
|
./../programs/forgejo.nix
|
|
./../programs/postgresql.nix
|
|
];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/forgejo 770 forgejo forgejo -"
|
|
"d /var/lib/postgresql 770 postgres postgres -"
|
|
];
|
|
|
|
youthlic.programs = {
|
|
forgejo = {
|
|
enable = true;
|
|
domain = cfg.domain;
|
|
sshPort = cfg.sshPort;
|
|
httpPort = cfg.httpPort;
|
|
database = {
|
|
user = "forgejo";
|
|
};
|
|
};
|
|
postgresql = {
|
|
enable = true;
|
|
database = "forgejo";
|
|
auth_method = "peer";
|
|
version = "17";
|
|
};
|
|
};
|
|
|
|
systemd.services.forgejo = {
|
|
wants = [ "postgresql.service" ];
|
|
requires = [ "postgresql.service" ];
|
|
after = [ "postgresql.service" ];
|
|
wantedBy = [ "default.target" ];
|
|
};
|
|
|
|
networking = {
|
|
defaultGateway = "192.168.111.1";
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [
|
|
cfg.httpPort
|
|
cfg.sshPort
|
|
];
|
|
allowedUDPPorts = [
|
|
cfg.httpPort
|
|
cfg.sshPort
|
|
];
|
|
};
|
|
useHostResolvConf = lib.mkForce false;
|
|
};
|
|
services.resolved.enable = true;
|
|
system.stateVersion = "24.11";
|
|
};
|
|
};
|
|
};
|
|
}
|