feat(home-server): add forgejo

hosts/home-server.nix

@@ -29,6 +29,7 @@ in
     ../services/mail.nix
     ../services/lldap.nix
     ../services/authelia.nix
+    ../services/forgejo
     ../services/restic/home-server.nix
     ../services/samba/home-server.nix
     # ../services/kodi.nix
@@ -89,6 +90,7 @@ in
     "openpgpkey.felschr.com"
     "ldap.felschr.com"
     "auth.felschr.com"
+    "git.felschr.com"
     "home.felschr.com"
     "esphome.felschr.com"
     "matrix.felschr.com"

services/forgejo/default.nix

@@ -0,0 +1,45 @@
+{ config, pkgs, ... }:
+
+let
+  domain = "git.felschr.com";
+  sshPort = 2222;
+in
+{
+  services.forgejo = {
+    enable = true;
+    database.type = "postgres";
+    lfs.enable = true;
+    settings = {
+      server = {
+        DOMAIN = domain;
+        PROTOCOL = "http+unix";
+        ROOT_URL = "https://${domain}/";
+        START_SSH_SERVER = true;
+        SSH_PORT = sshPort;
+        SSH_LISTEN_PORT = sshPort;
+      };
+      service.DISABLE_REGISTRATION = true;
+      ui = {
+        DEFAULT_THEME = "forgejo-dark";
+      };
+      mailer = {
+        ENABLED = true;
+        PROTOCOL = "sendmail";
+        FROM = config.programs.msmtp.accounts.default.from;
+        SENDMAIL_PATH = "${pkgs.system-sendmail}/bin/sendmail";
+        SENDMAIL_ARGS = "--";
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ sshPort ];
+
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+    extraConfig = ''
+      client_max_body_size 512M;
+    '';
+    locations."/".proxyPass = "http://unix:${cfg.settings.server.HTTP_ADDR}";
+  };
+}