refactor
This commit is contained in:
@@ -11,181 +11,188 @@ in {
|
||||
enable = mkEnableOption "Gitea git hosting service";
|
||||
|
||||
litestream = {
|
||||
bucket = mkOption {
|
||||
type = types.str;
|
||||
description = "S3 bucket name for Litestream database replication";
|
||||
};
|
||||
bucket =
|
||||
mkOption {
|
||||
type = types.str;
|
||||
description = "S3 bucket name for Litestream database replication";
|
||||
};
|
||||
|
||||
secretFile = mkOption {
|
||||
type = types.path;
|
||||
description = "Path to the environment file containing S3 credentials for Litestream";
|
||||
};
|
||||
secretFile =
|
||||
mkOption {
|
||||
type = types.path;
|
||||
description = "Path to the environment file containing S3 credentials for Litestream";
|
||||
};
|
||||
};
|
||||
|
||||
restic = {
|
||||
bucket = mkOption {
|
||||
type = types.str;
|
||||
description = "S3 bucket name for Restic repository backups";
|
||||
};
|
||||
bucket =
|
||||
mkOption {
|
||||
type = types.str;
|
||||
description = "S3 bucket name for Restic repository backups";
|
||||
};
|
||||
|
||||
passwordFile = mkOption {
|
||||
type = types.path;
|
||||
description = "Path to the file containing the Restic repository password";
|
||||
};
|
||||
passwordFile =
|
||||
mkOption {
|
||||
type = types.path;
|
||||
description = "Path to the file containing the Restic repository password";
|
||||
};
|
||||
|
||||
environmentFile = mkOption {
|
||||
type = types.path;
|
||||
description = "Path to the environment file containing S3 credentials for Restic";
|
||||
};
|
||||
environmentFile =
|
||||
mkOption {
|
||||
type = types.path;
|
||||
description = "Path to the environment file containing S3 credentials for Restic";
|
||||
};
|
||||
};
|
||||
|
||||
s3 = {
|
||||
endpoint = mkOption {
|
||||
type = types.str;
|
||||
default = "s3.eu-central-003.backblazeb2.com";
|
||||
description = "S3 endpoint URL";
|
||||
};
|
||||
endpoint =
|
||||
mkOption {
|
||||
type = types.str;
|
||||
default = "s3.eu-central-003.backblazeb2.com";
|
||||
description = "S3 endpoint URL";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
config =
|
||||
mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = [80 443];
|
||||
|
||||
services.redis.servers.gitea = {
|
||||
enable = true;
|
||||
port = 6380;
|
||||
bind = "127.0.0.1";
|
||||
settings = {
|
||||
maxmemory = "64mb";
|
||||
maxmemory-policy = "allkeys-lru";
|
||||
services.redis.servers.gitea = {
|
||||
enable = true;
|
||||
port = 6380;
|
||||
bind = "127.0.0.1";
|
||||
settings = {
|
||||
maxmemory = "64mb";
|
||||
maxmemory-policy = "allkeys-lru";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
database = {
|
||||
type = "sqlite3";
|
||||
path = "/var/lib/gitea/data/gitea.db";
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
database = {
|
||||
type = "sqlite3";
|
||||
path = "/var/lib/gitea/data/gitea.db";
|
||||
};
|
||||
settings = {
|
||||
server = {
|
||||
ROOT_URL = "https://git.schmatzler.com/";
|
||||
DOMAIN = "git.schmatzler.com";
|
||||
HTTP_ADDR = "127.0.0.1";
|
||||
HTTP_PORT = 3000;
|
||||
LANDING_PAGE = "explore";
|
||||
};
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
security.INSTALL_LOCK = true;
|
||||
cache = {
|
||||
ADAPTER = "redis";
|
||||
HOST = "redis://127.0.0.1:6380/0?pool_size=100&idle_timeout=180s";
|
||||
ITEM_TTL = "16h";
|
||||
};
|
||||
"cache.last_commit" = {
|
||||
ITEM_TTL = "8760h";
|
||||
COMMITS_COUNT = 100;
|
||||
};
|
||||
session = {
|
||||
PROVIDER = "redis";
|
||||
PROVIDER_CONFIG = "redis://127.0.0.1:6380/1?pool_size=100&idle_timeout=180s";
|
||||
COOKIE_SECURE = true;
|
||||
SAME_SITE = "strict";
|
||||
};
|
||||
api.ENABLE_SWAGGER = false;
|
||||
};
|
||||
};
|
||||
settings = {
|
||||
server = {
|
||||
ROOT_URL = "https://git.schmatzler.com/";
|
||||
DOMAIN = "git.schmatzler.com";
|
||||
HTTP_ADDR = "127.0.0.1";
|
||||
HTTP_PORT = 3000;
|
||||
LANDING_PAGE = "explore";
|
||||
};
|
||||
service.DISABLE_REGISTRATION = true;
|
||||
security.INSTALL_LOCK = true;
|
||||
cache = {
|
||||
ADAPTER = "redis";
|
||||
HOST = "redis://127.0.0.1:6380/0?pool_size=100&idle_timeout=180s";
|
||||
ITEM_TTL = "16h";
|
||||
};
|
||||
"cache.last_commit" = {
|
||||
ITEM_TTL = "8760h";
|
||||
COMMITS_COUNT = 100;
|
||||
};
|
||||
session = {
|
||||
PROVIDER = "redis";
|
||||
PROVIDER_CONFIG = "redis://127.0.0.1:6380/1?pool_size=100&idle_timeout=180s";
|
||||
COOKIE_SECURE = true;
|
||||
SAME_SITE = "strict";
|
||||
};
|
||||
api.ENABLE_SWAGGER = false;
|
||||
};
|
||||
};
|
||||
|
||||
services.litestream = {
|
||||
enable = true;
|
||||
environmentFile = cfg.litestream.secretFile;
|
||||
settings = {
|
||||
dbs = [
|
||||
{
|
||||
path = "/var/lib/gitea/data/gitea.db";
|
||||
replicas = [
|
||||
{
|
||||
type = "s3";
|
||||
bucket = cfg.litestream.bucket;
|
||||
path = "gitea";
|
||||
endpoint = cfg.s3.endpoint;
|
||||
}
|
||||
];
|
||||
services.litestream = {
|
||||
enable = true;
|
||||
environmentFile = cfg.litestream.secretFile;
|
||||
settings = {
|
||||
dbs = [
|
||||
{
|
||||
path = "/var/lib/gitea/data/gitea.db";
|
||||
replicas = [
|
||||
{
|
||||
type = "s3";
|
||||
bucket = cfg.litestream.bucket;
|
||||
path = "gitea";
|
||||
endpoint = cfg.s3.endpoint;
|
||||
}
|
||||
];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.litestream = {
|
||||
serviceConfig = {
|
||||
User = mkForce "gitea";
|
||||
Group = mkForce "gitea";
|
||||
};
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts."git.schmatzler.com".extraConfig = ''
|
||||
header {
|
||||
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
||||
X-Content-Type-Options "nosniff"
|
||||
X-Frame-Options "DENY"
|
||||
Referrer-Policy "strict-origin-when-cross-origin"
|
||||
}
|
||||
reverse_proxy localhost:3000
|
||||
'';
|
||||
};
|
||||
|
||||
services.restic.backups.gitea = {
|
||||
repository = "s3:${cfg.s3.endpoint}/${cfg.restic.bucket}";
|
||||
paths = ["/var/lib/gitea"];
|
||||
exclude = [
|
||||
"/var/lib/gitea/log"
|
||||
"/var/lib/gitea/data/gitea.db"
|
||||
"/var/lib/gitea/data/gitea.db-shm"
|
||||
"/var/lib/gitea/data/gitea.db-wal"
|
||||
];
|
||||
passwordFile = cfg.restic.passwordFile;
|
||||
environmentFile = cfg.restic.environmentFile;
|
||||
pruneOpts = [
|
||||
"--keep-daily 7"
|
||||
"--keep-weekly 4"
|
||||
"--keep-monthly 6"
|
||||
];
|
||||
timerConfig = {
|
||||
OnCalendar = "daily";
|
||||
Persistent = true;
|
||||
RandomizedDelaySec = "1h";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.restic-backups-gitea = {
|
||||
wants = ["restic-init-gitea.service"];
|
||||
after = ["restic-init-gitea.service"];
|
||||
serviceConfig = {
|
||||
User = mkForce "gitea";
|
||||
Group = mkForce "gitea";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.restic-init-gitea = {
|
||||
description = "Initialize Restic repository for Gitea backups";
|
||||
wantedBy = ["multi-user.target"];
|
||||
after = ["network-online.target"];
|
||||
wants = ["network-online.target"];
|
||||
path = [pkgs.restic];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "gitea";
|
||||
Group = "gitea";
|
||||
RemainAfterExit = true;
|
||||
EnvironmentFile = cfg.restic.environmentFile;
|
||||
};
|
||||
script = ''
|
||||
export RESTIC_PASSWORD=$(cat ${cfg.restic.passwordFile})
|
||||
restic -r s3:${cfg.s3.endpoint}/${cfg.restic.bucket} snapshots &>/dev/null || \
|
||||
restic -r s3:${cfg.s3.endpoint}/${cfg.restic.bucket} init
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.litestream = {
|
||||
serviceConfig = {
|
||||
User = mkForce "gitea";
|
||||
Group = mkForce "gitea";
|
||||
};
|
||||
};
|
||||
|
||||
services.caddy = {
|
||||
enable = true;
|
||||
virtualHosts."git.schmatzler.com".extraConfig = ''
|
||||
header {
|
||||
Strict-Transport-Security "max-age=31536000; includeSubDomains"
|
||||
X-Content-Type-Options "nosniff"
|
||||
X-Frame-Options "DENY"
|
||||
Referrer-Policy "strict-origin-when-cross-origin"
|
||||
}
|
||||
reverse_proxy localhost:3000
|
||||
'';
|
||||
};
|
||||
|
||||
services.restic.backups.gitea = {
|
||||
repository = "s3:${cfg.s3.endpoint}/${cfg.restic.bucket}";
|
||||
paths = ["/var/lib/gitea"];
|
||||
exclude = [
|
||||
"/var/lib/gitea/log"
|
||||
"/var/lib/gitea/data/gitea.db"
|
||||
"/var/lib/gitea/data/gitea.db-shm"
|
||||
"/var/lib/gitea/data/gitea.db-wal"
|
||||
];
|
||||
passwordFile = cfg.restic.passwordFile;
|
||||
environmentFile = cfg.restic.environmentFile;
|
||||
pruneOpts = [
|
||||
"--keep-daily 7"
|
||||
"--keep-weekly 4"
|
||||
"--keep-monthly 6"
|
||||
];
|
||||
timerConfig = {
|
||||
OnCalendar = "daily";
|
||||
Persistent = true;
|
||||
RandomizedDelaySec = "1h";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.restic-backups-gitea = {
|
||||
wants = ["restic-init-gitea.service"];
|
||||
after = ["restic-init-gitea.service"];
|
||||
serviceConfig = {
|
||||
User = mkForce "gitea";
|
||||
Group = mkForce "gitea";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.restic-init-gitea = {
|
||||
description = "Initialize Restic repository for Gitea backups";
|
||||
wantedBy = ["multi-user.target"];
|
||||
after = ["network-online.target"];
|
||||
wants = ["network-online.target"];
|
||||
path = [pkgs.restic];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "gitea";
|
||||
Group = "gitea";
|
||||
RemainAfterExit = true;
|
||||
EnvironmentFile = cfg.restic.environmentFile;
|
||||
};
|
||||
script = ''
|
||||
export RESTIC_PASSWORD=$(cat ${cfg.restic.passwordFile})
|
||||
restic -r s3:${cfg.s3.endpoint}/${cfg.restic.bucket} snapshots &>/dev/null || \
|
||||
restic -r s3:${cfg.s3.endpoint}/${cfg.restic.bucket} init
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user