tbarnouin/nixos-hypervisor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add forgejo crowdsec config
Some checks are pending
/ Build Nix targets (push) Waiting to run
Details

Browse source
This commit is contained in:
Théo Barnouin 2025-04-14 14:39:52 +02:00
parent 8b007885cd
commit 6d7d5578c4
3 changed files with 56 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
secrets.nix
View file

@ -22,6 +22,7 @@ in {
"services/onlyoffice/secrets/office-jwtpass.age".publicKeys = [tbarnouin onlyoffice];
"services/forgejo/secrets/forgejoDBPass.age".publicKeys = [tbarnouin forgejo];
"secrets/forgejo-lapi-key.age".publicKeys = [tbarnouin forgejo];
"services/postgresql/secrets/nextcloudDBPass.age".publicKeys = [tbarnouin postgresql];
"services/postgresql/secrets/giteaDBPass.age".publicKeys = [tbarnouin postgresql];

13
secrets/forgejo-lapi-key.age Normal file
View file

@ -0,0 +1,13 @@
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHNzaC1lZDI1NTE5IE9Xa1ZYdyB4VGtJ
UkVTZEFxYWoySEhYSE5wV1dRSnRvQU1PTE1zZEphQ0p6bDRobDBnCmFJWENjQWRV
REt2Vk10MGpyQVdPa2ZkYVFCRjE0QzRBbzBYeHBuNFMzV3cKLT4gc3NoLWVkMjU1
MTkgeHFteWpBIFFoSWRzbFREcVVqZmRiOVc4dmh5K1JHSTdVZ1preUZqYmltNS9H
RVFCU00KVm9kc280Um92Zm5CelNma0tocldUM3dVWnpNNHlyMUtrOWNab1gvL2RY
VQotPiBUP11DVVAyQS1ncmVhc2UgeSBnTWw0NiA8eyQzYmogKTR2YWZECjl0eUVj
R0xaUU9JVVM3YmdJanIyY0lGdkJQLzJ3MjlpSzFkVnMrNjgKLS0tIDgxR0VPcURB
QVdvNmExWmhiME84WGJvMWRvdkk3WXE2QU5KWDlMUEppeTgKMXBkE7U4ukLRVPd6
kPY/317m8T6++gCVZLdUm7waz/7/XvTY2ZBLD4As8/N2WEUwTRhpzRsFLlq8nQed
kSRfawqJzoRvlDdDoTYZdkeFTtq41IjnNecvcOXQu+L6e7hlN8m7L/IIZds3mfkK
QUM6FoDNCNiYx2ZaOtLaYjCmsiSN83euLidycYqN+vb3W06GiNIWCQTHFR0=
-----END AGE ENCRYPTED FILE-----

59
services/forgejo/default.nix
View file

@ -14,24 +14,49 @@ in {
};
};
config = lib.mkIf cfg.enable {
age.secrets.forgejoDBPass.file = ./secrets/forgejoDBPass.age;
services.forgejo = {
enable = true;
package = pkgs.forgejo;
user = "tbarnouin";
settings = {
server.HTTP_PORT = 3000;
server.DISABLE_SSH = true;
server.ROOT_URL = "https://git.le43.eu";
service.DISABLE_REGISTRATION = true;
age.secrets = {
forgejo-lapi-key = {
file = ../../secrets/forgejo-lapi-key.age;
owner = "crowdsec";
};
database = {
createDatabase = false;
type = "postgres";
host = "${cfg.pgsql_ip}";
name = "gitea";
user = "gitea";
passwordFile = config.age.secrets.forgejoDBPass.path;
forgejoDBPass.file = ./secrets/forgejoDBPass.age;
};
services = {
crowdsec = {
hub.collections = [
"LePresidente/gitea"
];
settings.lapi.credentialsFile = "${config.age.secrets.forgejo-lapi-key.path}";
localConfig = {
acquisitions = [
{
source = "journalctl";
journalctl_filter = [ "_SYSTEMD_UNIT=forgejo.service" ];
labels = {
type = "syslog";
};
}
];
};
};
forgejo = {
enable = true;
package = pkgs.forgejo;
user = "tbarnouin";
settings = {
server.HTTP_PORT = 3000;
server.DISABLE_SSH = true;
server.ROOT_URL = "https://git.le43.eu";
service.DISABLE_REGISTRATION = true;
};
database = {
createDatabase = false;
type = "postgres";
host = "${cfg.pgsql_ip}";
name = "gitea";
user = "gitea";
passwordFile = config.age.secrets.forgejoDBPass.path;
};
};
};
networking.firewall.allowedTCPPorts = [3000];