nixos-config/machines/renge/services/gitea.nix

{ config, lib, pkgs, ... }:
let
  cfg = config.services.gitea;
in
{
  sops.secrets.gitea-mail = {
    owner = cfg.user;
    sopsFile = ../secrets.yaml;
  };
  systemd.services.gitea.serviceConfig.SupplementaryGroups = lib.singleton "keys";

  services.gitea = {
    enable = true;

    appName = "sbrudergit";
    lfs = {
      enable = true;
    };
    database.type = "postgres";
    mailerPasswordFile = config.sops.secrets.gitea-mail.path;
    settings = {
      mailer = {
        ENABLED = true;
        HOST = "vueko.sbruder.de:587";
        FROM = "gitea@sbruder.de";
        USER = "gitea@sbruder.de";
      };
      avatar = {
        DISABLE_GRAVATAR = true;
      };
      server = {
        # http server
        DOMAIN = "git.sbruder.de";
        PROTOCOL = "http+unix";
        ROOT_URL = "https://git.sbruder.de/";

        # privacy
        DISABLE_ROUTER_LOG = true;
        OFFLINE_MODE = true;

        # internal ssh server
        BUILTIN_SSH_SERVER_USER = "git";
        START_SSH_SERVER = true;
        SSH_PORT = 2022;
        SSH_SERVER_HOST_KEYS = "ssh/gitea.ed25519,ssh/gitea.rsa";
      };
      service = {
        DEFAULT_ALLOW_CREATE_ORGANIZATION = false;
        DEFAULT_KEEP_EMAIL_PRIVATE = true;
        ENABLE_NOTIFY_MAIL = true;
        NO_REPLY_ADDRESS = "users.git.sbruder.de";
        REGISTER_EMAIL_CONFIRM = true;
      };
      session = {
        PROVIDER = "file";
        COOKIE_SECURE = true;
      };
      log = {
        LEVEL = "Warn";
      };
    };
  };

  networking.firewall.allowedTCPPorts = [ cfg.settings.server.SSH_PORT ];

  services.nginx.virtualHosts."git.sbruder.de" = {
    enableACME = true;
    forceSSL = true;

    locations."/" = {
      proxyPass = "http://unix:/run/gitea/gitea.sock";
    };

    extraConfig = ''
      client_max_body_size 1G; # Git LFS
    '';
  };
}