add gitea

hosts/fw.cloonar.com/configuration.nix

@@ -23,7 +23,7 @@
     ./modules/omada.nix
 
     # git
-    # ./modules/gitea.nix
+    ./modules/gitea.nix
     # ./modules/drone/server.nix
     # ./modules/drone/runner.nix
     ./modules/fwmetrics.nix

hosts/fw.cloonar.com/modules/gitea.nix

@@ -1,36 +1,78 @@
 { config, ... }:
 let
   domain = "git.cloonar.com";
+  ip = "10.42.97.3";
 in
 {
+  security.acme.certs."${domain}" = {
+    domain = "${domain}";
+    group = "gitea";
+  };
   services.nginx.virtualHosts."${domain}" = {
     enableACME = true;
     forceSSL = true;
     locations."/" = {
-      proxyPass = "http://localhost:3001/";
+      proxyPass = "https://${ip}/";
     };
   };
 
-  services.gitea = {
+  users.users.gitea = {
-    enable = true;
+    isSystemUser = true;
-    appName = "Cloonar Gitea server"; # Give the site a name
+    group = "gitea";
-    settings = {
+    home = "/var/lib/gitea";
-      server = {
+    createHome = true;
-        ROOT_URL = "https://${domain}/";
-        HTTP_PORT = 3001;
-        DOMAIN = domain;
   };
-      openid = {
+  users.groups.gitea = { };
-        ENABLE_OPENID_SIGNIN = false;
+  users.groups.docker.members = [ "gitea" ];
-        ENABLE_OPENID_SIGNUP = true;
+
-        WHITELISTED_URIS     = "auth.example.com";
+
+  environment.etc."gitea/app.ini".source = ''
+    APP_NAME = Cloonar Gitea server
+    RUN_USER = gitea
+    RUN_MODE = prod
+
+    [cron.update_checker]
+    ENABLED=false
+
+    [openid]
+    ENABLE_OPENID_SIGNIN=false
+    ENABLE_OPENID_SIGNUP=true
+    WHITELISTED_URIS=auth.cloonar.com
+
+    [server]
+    DISABLE_SSH=false
+    DOMAIN=git.cloonar.com
+    HTTP_ADDR=0.0.0.0
+    HTTP_PORT=443
+    PROTOCOL=https
+    ROOT_URL=https://git.cloonar.com/
+    SSH_PORT=22
+    CERT_FILE=/bitnami/gitea/ssl/fullchain.pem
+    KEY_FILE=/bitnami/gitea/ssl/key.pem
+
+    [service]
+    ALLOW_ONLY_EXTERNAL_REGISTRATION=true
+    DISABLE_REGISTRATION=false
+    SHOW_REGISTRATION_BUTTON=false
+
+    [webhook]
+    ALLOWED_HOST_LIST=drone.cloonar.com
+  '';
+
+  # TODO: check if we can run docker service as other user than root
+  virtualisation = {
+    oci-containers.containers = {
+      omada = {
+        image = "bitnami/gitea:1";
+        volumes = [
+          "/var/lib/gitea:/bitnami/gitea"
+          "/etc/gitea/app.ini:/bitnami/gitea/custom/conf/app.ini:ro"
+          "/var/lib/acme/git.cloonar.com:/bitnami/gitea/ssl:ro"
+        ];
+        extraOptions = [
+          "--ip=${ip}"
+        ];
       };
-      service = {
-        DISABLE_REGISTRATION                          = false;
-        ALLOW_ONLY_EXTERNAL_REGISTRATION              = true;
-        SHOW_REGISTRATION_BUTTON                      = false;
-      };
-      webhook.ALLOWED_HOST_LIST = "drone.cloonar.com";
     };
   };
 }