From e45c34c465ecfc1d4f166fc2b5d62e87a10f6fd1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Felix=20Schr=C3=B6ter?= <dev@felschr.com>
Date: Fri, 17 Jan 2025 13:34:14 +0100
Subject: [PATCH] feat(home-server): add forgejo

---
 hosts/home-server.nix        |  2 ++
 services/forgejo/default.nix | 45 ++++++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 services/forgejo/default.nix

diff --git a/hosts/home-server.nix b/hosts/home-server.nix
index a8c04c3..760e49c 100644
--- a/hosts/home-server.nix
+++ b/hosts/home-server.nix
@@ -29,6 +29,7 @@ in
     ../services/mail.nix
     ../services/lldap.nix
     ../services/authelia.nix
+    ../services/forgejo
     ../services/restic/home-server.nix
     ../services/samba/home-server.nix
     # ../services/kodi.nix
@@ -89,6 +90,7 @@ in
     "openpgpkey.felschr.com"
     "ldap.felschr.com"
     "auth.felschr.com"
+    "git.felschr.com"
     "home.felschr.com"
     "esphome.felschr.com"
     "matrix.felschr.com"
diff --git a/services/forgejo/default.nix b/services/forgejo/default.nix
new file mode 100644
index 0000000..45ffc61
--- /dev/null
+++ b/services/forgejo/default.nix
@@ -0,0 +1,45 @@
+{ config, pkgs, ... }:
+
+let
+  domain = "git.felschr.com";
+  sshPort = 2222;
+in
+{
+  services.forgejo = {
+    enable = true;
+    database.type = "postgres";
+    lfs.enable = true;
+    settings = {
+      server = {
+        DOMAIN = domain;
+        PROTOCOL = "http+unix";
+        ROOT_URL = "https://${domain}/";
+        START_SSH_SERVER = true;
+        SSH_PORT = sshPort;
+        SSH_LISTEN_PORT = sshPort;
+      };
+      service.DISABLE_REGISTRATION = true;
+      ui = {
+        DEFAULT_THEME = "forgejo-dark";
+      };
+      mailer = {
+        ENABLED = true;
+        PROTOCOL = "sendmail";
+        FROM = config.programs.msmtp.accounts.default.from;
+        SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
+        SENDMAIL_ARGS = "--";
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ sshPort ];
+
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+    extraConfig = ''
+      client_max_body_size 512M;
+    '';
+    locations."/".proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
+  };
+}