Cloonar/nixos
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

feat: fw final switch to forgejo

Browse source
This commit is contained in:
Dominik Polakovics Polakovics 2026-02-01 15:23:10 +01:00
parent 25580ded3b
commit f5a0bc582d
6 changed files with 10 additions and 24 deletions
Download patch file Download diff file Expand all files Collapse all files

6
hosts/fw/configuration.nix
View file

@ -32,7 +32,6 @@
# microvm # microvm
./modules/microvm.nix ./modules/microvm.nix
./modules/gitea-vm.nix
./modules/forgejo-runner.nix ./modules/forgejo-runner.nix
./modules/dev-microvm.nix ./modules/dev-microvm.nix
# ./modules/vscode-server.nix # Add VS Code Server microvm # ./modules/vscode-server.nix # Add VS Code Server microvm
@ -45,8 +44,7 @@
./modules/web ./modules/web
# git # git
./modules/gitea.nix ./modules/forgejo.nix
./modules/forgejo.nix # Migration: autoStart=false, start after migration script
# ./modules/fwmetrics.nix # ./modules/fwmetrics.nix
# ha customers # ha customers
@ -81,7 +79,7 @@
networkPrefix = "10.42"; networkPrefix = "10.42";
# Systemd services to monitor # Systemd services to monitor
services.victoriametrics.monitoredServices = [ "ai-mailer" "container@git" "microvm@git-runner-" "microvm@fj-runner-" ]; services.victoriametrics.monitoredServices = [ "ai-mailer" "container@forgejo" "microvm@fj-runner-" ];
nixpkgs.overlays = [ nixpkgs.overlays = [
(import ./utils/overlays/packages.nix) (import ./utils/overlays/packages.nix)

3
hosts/fw/modules/dnsmasq.nix
View file

@ -103,8 +103,7 @@
"/mopidy.cloonar.com/${config.networkPrefix}.97.21" "/mopidy.cloonar.com/${config.networkPrefix}.97.21"
"/snapcast.cloonar.com/${config.networkPrefix}.97.21" "/snapcast.cloonar.com/${config.networkPrefix}.97.21"
"/lms.cloonar.com/${config.networkPrefix}.97.21" "/lms.cloonar.com/${config.networkPrefix}.97.21"
"/git.cloonar.com/${config.networkPrefix}.97.50" "/git.cloonar.com/${config.networkPrefix}.97.55"
"/forgejo.cloonar.com/${config.networkPrefix}.97.55"
"/feeds.cloonar.com/188.34.191.144" "/feeds.cloonar.com/188.34.191.144"
"/nukibridge1a753f72.cloonar.smart/${config.networkPrefix}.100.112" "/nukibridge1a753f72.cloonar.smart/${config.networkPrefix}.100.112"
"/allywatch.cloonar.com/${config.networkPrefix}.97.5" "/allywatch.cloonar.com/${config.networkPrefix}.97.5"

4
hosts/fw/modules/firewall.nix
View file

@ -118,7 +118,7 @@
iifname "smart" oifname "server" ip daddr ${config.networkPrefix}.97.20/32 tcp dport { 1883 } counter accept iifname "smart" oifname "server" ip daddr ${config.networkPrefix}.97.20/32 tcp dport { 1883 } counter accept
# Forward to git server # Forward to git server
oifname "server" ip daddr ${config.networkPrefix}.97.50 tcp dport { 22 } counter accept oifname "server" ip daddr ${config.networkPrefix}.97.55 tcp dport { 22 } counter accept
oifname "server" ip daddr ${config.networkPrefix}.97.5 tcp dport { 80, 443 } counter accept oifname "server" ip daddr ${config.networkPrefix}.97.5 tcp dport { 80, 443 } counter accept
# lan and vpn to any # lan and vpn to any
@ -167,7 +167,7 @@
chain prerouting { chain prerouting {
type nat hook prerouting priority filter; policy accept; type nat hook prerouting priority filter; policy accept;
iifname "server" ip daddr ${config.networkPrefix}.96.255 udp dport { 9 } dnat to ${config.networkPrefix}.96.255 iifname "server" ip daddr ${config.networkPrefix}.96.255 udp dport { 9 } dnat to ${config.networkPrefix}.96.255
iifname "wan" tcp dport { 22 } dnat to ${config.networkPrefix}.97.50 iifname "wan" tcp dport { 22 } dnat to ${config.networkPrefix}.97.55
iifname "wan" tcp dport { 80, 443 } dnat to ${config.networkPrefix}.97.5 iifname "wan" tcp dport { 80, 443 } dnat to ${config.networkPrefix}.97.5
iifname "wan" tcp dport { 5000 } dnat to ${config.networkPrefix}.97.51 iifname "wan" tcp dport { 5000 } dnat to ${config.networkPrefix}.97.51
iifname { "wan", "lan" } udp dport { 7777, 7778, 27015 } dnat to ${config.networkPrefix}.97.201 iifname { "wan", "lan" } udp dport { 7777, 7778, 27015 } dnat to ${config.networkPrefix}.97.201

2
hosts/fw/modules/forgejo-runner.nix
View file

@ -51,7 +51,7 @@ in {
services.gitea-actions-runner.instances.${runner} = { services.gitea-actions-runner.instances.${runner} = {
enable = true; enable = true;
url = "https://forgejo.cloonar.com"; url = "https://git.cloonar.com";
name = runner; name = runner;
tokenFile = "/run/secrets/forgejo-runner-token"; tokenFile = "/run/secrets/forgejo-runner-token";
labels = [ labels = [

11
hosts/fw/modules/forgejo.nix
View file

@ -19,13 +19,12 @@ in
users.users.forgejo = user; users.users.forgejo = user;
users.groups.forgejo = group; users.groups.forgejo = group;
# Reuse the existing git.cloonar.com ACME cert from gitea.nix security.acme.certs."git.cloonar.com" = {
security.acme.certs."forgejo.cloonar.com" = {
group = "nginx"; group = "nginx";
}; };
containers.forgejo = { containers.forgejo = {
autoStart = false; # Don't start until migration is complete autoStart = true;
ephemeral = false; # because of ssh key ephemeral = false; # because of ssh key
privateNetwork = true; privateNetwork = true;
hostBridge = "server"; hostBridge = "server";
@ -37,8 +36,7 @@ in
isReadOnly = false; isReadOnly = false;
}; };
"/var/lib/acme/forgejo/" = { "/var/lib/acme/forgejo/" = {
# hostPath = config.security.acme.certs.${domain}.directory; hostPath = config.security.acme.certs.${domain}.directory;
hostPath = config.security.acme.certs."forgejo.cloonar.com".directory;
isReadOnly = true; isReadOnly = true;
}; };
"/run/secrets/forgejo-mailer-password" = { "/run/secrets/forgejo-mailer-password" = {
@ -146,7 +144,6 @@ in
sops.secrets.forgejo-mailer-password = { sops.secrets.forgejo-mailer-password = {
owner = "forgejo"; owner = "forgejo";
# restartUnits removed - would start the container even with autoStart=false restartUnits = [ "container@forgejo.service" ];
# Re-add after migration: restartUnits = [ "container@forgejo.service" ];
}; };
} }

8
hosts/fw/modules/web/proxies.nix
View file

@ -1,13 +1,5 @@
{ config, lib, ... }: { { config, lib, ... }: {
services.nginx.virtualHosts."git.cloonar.com" = { services.nginx.virtualHosts."git.cloonar.com" = {
forceSSL = true;
enableACME = true;
acmeRoot = null;
locations."/" = {
proxyPass = "https://git.cloonar.com/";
};
};
services.nginx.virtualHosts."forgejo.cloonar.com" = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
acmeRoot = null; acmeRoot = null;