home lab init

nixos/hosts/forgejo/README.md

@@ -0,0 +1,17 @@
+🥇 Phase 1: Git + Secrets
+
+    ✅ Set up Forgejo VM (NixOS declarative)
+
+    ✅ Set up sops-nix + age keys (can live in the Git repo)
+
+    ✅ Push flake + ansible + secrets to Forgejo
+
+    ✅ Write a basic README with how to rebuild infra
+
+🥈 Phase 2: GitOps
+
+    🔁 Add CI runner VM
+
+    🔁 Configure runner to deploy (nixos-rebuild or ansible-playbook) on commit
+
+    🔁 Optional: add webhooks to auto-trigger via Forgejo

nixos/hosts/forgejo/database.nix

@@ -0,0 +1,31 @@
+{ lib, pkgs, config, ... }:
+
+{
+  systemd.services.forgejo = {
+    after = [ "postgresql.service" ];
+    requires = [ "postgresql.service" ];
+  };
+
+  services.postgresql = {
+    enable = true;
+    ensureDatabases = [ "forgejo" ];
+    ensureUsers = [
+      {
+        name = "forgejo";
+        ensureDBOwnership = true;
+      }
+    ];
+    authentication = pkgs.lib.mkOverride 10 ''
+      #type database  DBuser  auth-method
+      local all       all     trust
+    '';
+  };
+
+  services.prometheus.exporters.postgres = {
+    enable = true;
+    listenAddress = "0.0.0.0";
+    port = 9187;
+  };
+  networking.firewall.allowedTCPPorts = [ 9187 ];
+
+}

nixos/hosts/forgejo/forgejo.nix

@@ -0,0 +1,65 @@
+{ lib, pkgs, config, ... }:
+let
+  cfg = config.services.forgejo;
+  srv = cfg.settings.server;
+  domain = "git.procopius.dk";
+in
+{
+  users.users.plasmagoat.extraGroups = [ "forgejo" ];
+
+  services.forgejo = {
+    enable = true;
+    user = "forgejo";
+    group = "forgejo";
+    stateDir = "/srv/forgejo";
+    settings = {
+      # https://forgejo.org/docs/latest/admin/config-cheat-sheet/
+      server = {
+        DOMAIN = domain;
+        ROOT_URL = "https://${srv.DOMAIN}/";
+        PROTOCOL = "http";
+        HTTP_PORT = 3000;
+      };
+      database = {
+        DB_TYPE = lib.mkForce "postgres";
+        HOST = "/run/postgresql";
+        NAME = "forgejo";
+        USER = "forgejo";
+      };
+      service = {
+        DISABLE_REGISTRATION = true;
+      };
+      metrics = {
+        ENABLED = true;
+        ENABLED_ISSUE_BY_REPOSITORY = true;
+        ENABLED_ISSUE_BY_LABEL = true;
+      };
+      # log = {
+      #   ROOT_PATH = "/var/log/forgejo";
+      #   MODE = "file";
+      #   LEVEL = "Info";
+      # };
+
+      security = {
+        INSTALL_LOCK = true;
+        SECRET_KEY = "changeme";  # can be another secret
+      };
+    };
+  };
+
+  sops.secrets.forgejo-admin-password.owner = "forgejo";
+  sops.secrets.forgejo-db-password.owner = "forgejo";
+
+  systemd.services.forgejo.preStart = let
+    adminCmd = "${lib.getExe cfg.package} admin user";
+    user = "plasmagoat"; # Note, Forgejo doesn't allow creation of an account named "admin"
+    pwd = config.sops.secrets.forgejo-admin-password;
+  in ''
+    ${adminCmd} create --admin --email "root@localhost" --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
+    ## uncomment this line to change an admin user which was already created
+    # ${adminCmd} change-password --username ${user} --password "$(tr -d '\n' < ${pwd.path})" || true
+  '';
+
+  # Optional: firewall
+  networking.firewall.allowedTCPPorts = [ 3000 ];
+}

nixos/hosts/forgejo/host.nix

@@ -0,0 +1,12 @@
+{ config, pkgs, modulesPath, lib, ... }:
+
+{
+  imports = [
+    ../../templates/base.nix
+    ../../secrets/sops.nix
+    ./networking.nix
+    ./storage.nix
+    ./forgejo.nix
+    ./database.nix
+  ];
+}

nixos/hosts/forgejo/networking.nix

@@ -0,0 +1,6 @@
+{ config, lib, pkgs, ... }: {
+
+  networking = {
+    hostName = "forgejo";
+  };
+}

nixos/hosts/forgejo/storage.nix

@@ -0,0 +1,29 @@
+{
+  # services.nfs.client = {
+  #   enable = true;
+  #   idmapd.enable = true;
+  # };
+
+  # environment.etc."idmapd.conf".text = ''
+  #   [General]
+  #   Domain = localdomain
+
+  #   [Mapping]
+  #   Nobody-User = nobody
+  #   Nobody-Group = nogroup
+  # '';
+
+  boot.supportedFilesystems = [ "nfs" ];
+
+  services.rpcbind.enable = true;
+
+  fileSystems."/srv/forgejo" = {
+    device = "192.168.1.226:/volume1/data/forgejo";
+    fsType = "nfs4";
+    options = [ "x-systemd.automount" "noatime" "_netdev" ];
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /srv/forgejo 0750 forgejo forgejo -"
+  ];
+}