85 lines
2.3 KiB
Nix
85 lines
2.3 KiB
Nix
{ config, lib, ... }:
|
|
|
|
let
|
|
secretsPath = "/var/secrets/sourcehut";
|
|
fqdn = "srht.c8h4.io";
|
|
in {
|
|
services.postgresql.enable = true;
|
|
|
|
services.sourcehut = {
|
|
enable = true;
|
|
services = [ "git" "meta" ];
|
|
redis.enable = true;
|
|
postgresql.enable = true;
|
|
meta = {
|
|
enable = true;
|
|
gunicorn.extraArgs =
|
|
[ "--bind [::1]:${toString config.services.sourcehut.meta.port}" ];
|
|
};
|
|
git = {
|
|
enable = true;
|
|
user = "git";
|
|
gunicorn.extraArgs =
|
|
[ "--bind [::1]:${toString config.services.sourcehut.git.port}" ];
|
|
};
|
|
|
|
nginx = {
|
|
enable = true;
|
|
virtualHost.useACMEHost = fqdn;
|
|
};
|
|
|
|
settings = {
|
|
"sr.ht" = {
|
|
environment = "production";
|
|
global-domain = fqdn;
|
|
owner-name = "Christoph Heiss";
|
|
owner-email = "christoph@c8h4.io";
|
|
network-key = "${secretsPath}/network-key";
|
|
service-key = "${secretsPath}/service-key";
|
|
};
|
|
|
|
"meta.sr.ht".origin = "https://meta.${fqdn}";
|
|
|
|
"meta.sr.ht::settings" = {
|
|
user-invites = 0;
|
|
registration = false;
|
|
};
|
|
|
|
"git.sr.ht" = {
|
|
oauth-client-id = fqdn;
|
|
oauth-client-secret = "${secretsPath}/oauth-client-secret";
|
|
outgoing-domain = "https://git.${fqdn}";
|
|
origin = "https://git.${fqdn}";
|
|
};
|
|
|
|
mail = {
|
|
smtp-from = "srht@c8h4.io";
|
|
pgp-key-id = "6C28803321A0F6C53B78A2AF3D84AB70408524DD";
|
|
pgp-pubkey = "${secretsPath}/pgp-pubkey";
|
|
pgp-privkey = "${secretsPath}/pgp-privkey";
|
|
};
|
|
|
|
webhooks.private-key = "${secretsPath}/webhooks-private-key";
|
|
};
|
|
};
|
|
|
|
security.acme.certs.${fqdn} = {
|
|
extraDomainNames = [ "*.srht.c8h4.io" ];
|
|
group = "nginx";
|
|
};
|
|
|
|
systemd.services = {
|
|
metasrht.serviceConfig.BindReadOnlyPaths = [ secretsPath ];
|
|
metasrht-api.serviceConfig.BindReadOnlyPaths = [ secretsPath ];
|
|
metasrht-webhooks.serviceConfig.BindReadOnlyPaths = [ secretsPath ];
|
|
gitsrht.serviceConfig.BindReadOnlyPaths = [ secretsPath ];
|
|
gitsrht-api.serviceConfig.BindReadOnlyPaths = [ secretsPath ];
|
|
gitsrht-periodic.serviceConfig.BindReadOnlyPaths = [ secretsPath ];
|
|
gitsrht-webhooks.serviceConfig.BindReadOnlyPaths = [ secretsPath ];
|
|
};
|
|
|
|
services.openssh.settings = { AllowUsers = lib.mkForce "christoph git"; };
|
|
|
|
users.users.git.password = "*";
|
|
}
|