wip forgejo

common/_containers/forgejo.nix

@@ -0,0 +1,182 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  name = "forgejo";
+
+  hostDataDir = "/var/lib/${name}";
+  hostAddress6 = "fc00::1";
+  containerAddress6 = "fc00::2";
+
+  binds = [
+    # Postgres data, must use postgres user in container and host
+    {
+      host = "${hostDataDir}/postgres";
+      # Adjust based on container postgres data dir
+      container = "/var/lib/postgresql/17";
+      user = "postgres";
+      uid = config.ids.uids.postgres;
+      gid = config.ids.gids.postgres;
+    }
+    # Postgres backups
+    {
+      host = "${hostDataDir}/backups/postgres";
+      container = "/var/backup/postgresql";
+      user = "postgres";
+      uid = config.ids.uids.postgres;
+      gid = config.ids.gids.postgres;
+    }
+    # App data, uses custom user uid
+    {
+      host = "${hostDataDir}/data";
+      container = "/var/lib/forgejo";
+      user = "forgejo";
+      uid = 115;
+      gid = 115;
+    }
+  ];
+  uniqueUsers = lib.foldl' (
+    acc: bind: if lib.lists.any (item: item.user == bind.user) acc then acc else acc ++ [ bind ]
+  ) [ ] binds;
+  users = {
+    users = lib.listToAttrs (
+      lib.map (u: {
+        name = u.user;
+        value = {
+          isSystemUser = true;
+          name = u.user;
+          uid = u.uid;
+          group = u.user;
+        };
+      }) uniqueUsers
+    );
+
+    groups = lib.listToAttrs (
+      lib.map (g: {
+        name = g.user;
+        value.gid = g.gid;
+      }) uniqueUsers
+    );
+  };
+in
+{
+  # Ensure users exists on host machine with same IDs as container
+  inherit users;
+
+  # Ensure directories exist on host machine
+  system.activationScripts.createMediaServerDirs = ''
+    ${lib.concatStringsSep "\n" (
+      lib.map (bind: ''
+        mkdir -p ${bind.host}
+        chown -R ${toString bind.user}:${toString bind.gid} ${bind.host}
+        chmod -R 750 ${bind.host}
+      '') binds
+    )}
+  '';
+
+  containers.${name} = {
+    ephemeral = true;
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress6 = hostAddress6;
+    localAddress6 = containerAddress6;
+    bindMounts = lib.foldl (
+      acc: bind:
+      {
+        "${bind.container}" = {
+          hostPath = bind.host;
+          isReadOnly = false;
+        };
+      }
+      // acc
+    ) { } binds;
+    config =
+      { config, pkgs, ... }:
+      {
+        system.stateVersion = "24.11";
+
+        networking = {
+          firewall = {
+            enable = true;
+            allowedTCPPorts = [ 3000 3032 ];
+          };
+          # Use systemd-resolved inside the container
+          # Workaround for bug https://github.com/NixOS/nixpkgs/issues/162686
+          useHostResolvConf = lib.mkForce false;
+        };
+
+        services.resolved.enable = true;
+
+        # Ensure users exist on container
+        inherit users;
+
+        services.postgresql = {
+          enable = true;
+          package = pkgs.postgresql_17.withJIT;
+          enableJIT = true;
+          authentication = ''
+            local all all trust
+            host all all 127.0.0.1/8 trust
+            host all all ::1/128 trust
+            host all all fc00::1/128 trust
+          '';
+        };
+
+        # Backup database
+        services.postgresqlBackup = {
+          enable = true;
+        };
+
+        services.forgejo = {
+          enable = true;
+          dump = {
+            enable = true;
+            type = "tar.gz";
+          };
+          database = {
+            type = "postgres";
+          };
+          settings = {
+            DEFAULT = {
+              APP_NAME = "Josh's Git";
+            };
+            server = {
+              PROTOCOL = "http";
+              # DOMAIN = "git.joshuabell.xyz";
+              HTTP_ADDR = "0.0.0.0";
+              HTTP_PORT = 3000;
+
+              START_SSH_SERVER = true;
+              # SSH_DOMAIN = "git.joshuabell.xyz";
+              SSH_LISTEN_HOST = "0.0.0.0";
+              SSH_LISTEN_PORT = 3032; # actual listen port
+              SSH_PORT = 3032; # used in UI
+
+              LANDING_PAGE = "explore";
+            };
+            service = {
+              DISABLE_REGISTRATION = true;
+              ENABLE_BASIC_AUTHENTICATION = false;
+              DISABLE_USERS_PAGE = true;
+              DISABLE_ORGANIZATIONS_PAGE = true;
+            };
+            repository = {
+              DISABLE_STARS = true;
+              DEFAULT_PRIVATE = "private";
+            };
+            admin = {
+              DISABLE_REGULAR_ORG_CREATION = true;
+              USER_DISABLED_FEATURES = "deletion";
+            };
+            other = {
+              SHOW_FOOTER_POWERED_BY = false;
+              SHOW_FOOTER_VERSION = false;
+              SHOW_FOOTER_TEMPLATE_LOAD_TIME = false;
+            };
+          };
+        };
+      };
+  };
+}