john/dendritic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

forgejo reactivate

Browse Source
This commit is contained in:
John Lancaster
2026-07-10 00:04:34 -05:00
parent b21bfd6bb4
commit 25ecb7ad06
5 changed files with 151 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/features/forgejo.nix
+88 -9
View File
@@ -11,6 +11,23 @@
type = lib.types.str;
};
pocketId = {
enable = lib.mkEnableOption "Configure Pocket ID as a Forgejo OIDC provider";
discoveryUrl = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
example = "https://id.example.com";
description = "OpenID Connect discovery URL for Pocket ID.";
};
name = lib.mkOption {
type = lib.types.str;
default = "pocket-id";
description = "Forgejo external auth source name for Pocket ID.";
};
};
port = lib.mkOption {
type = lib.types.port;
default = 3000;
@@ -27,8 +44,20 @@
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = !cfg.pocketId.enable || cfg.pocketId.discoveryUrl != null;
message = "forgejo.pocketId.discoveryUrl must be set when forgejo.pocketId.enable is true.";
}
];
networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];
mtls = lib.mkIf cfg.https {
certReaders = lib.mkAfter [ config.services.forgejo.user ];
renew.reloadUnits = lib.mkAfter [ "forgejo.service" ];
};
systemd.services.forgejo.serviceConfig = lib.mkIf needsPrivilegedPort {
AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
@@ -40,6 +69,9 @@
"forgejo/internal_token".owner = config.services.forgejo.user;
"forgejo/jwt_secret".owner = config.services.forgejo.user;
"forgejo/lfs_jwt_secret".owner = config.services.forgejo.user;
} // lib.optionalAttrs cfg.pocketId.enable {
"forgejo/pocket_id/client_id".owner = config.services.forgejo.user;
"forgejo/pocket_id/client_secret".owner = config.services.forgejo.user;
};
services = {
@@ -48,9 +80,7 @@
lfs.enable = true;
database.type = "postgres";
settings = {
DEFAULT = {
RUN_MODE = "dev";
};
DEFAULT.RUN_MODE = "dev";
server = lib.mkMerge [
{
HTTP_PORT = cfg.port;
@@ -71,13 +101,9 @@
ACCOUNT_LINKING = "login";
REGISTER_EMAIL_CONFIRM = false;
};
repository = {
ENABLE_PUSH_CREATE_USER = true;
};
repository.ENABLE_PUSH_CREATE_USER = true;
ui.SHOW_USER_EMAIL = false;
markup = {
ENABLED = true;
};
markup.ENABLED = true;
};
secrets = {
@@ -109,6 +135,59 @@
--work-path ${config.services.forgejo.dump.backupDir}
'';
systemd.services.forgejo-pocket-id-oidc = lib.mkIf cfg.pocketId.enable {
description = "Ensure Pocket ID OIDC auth source exists in Forgejo";
after = [ "forgejo.service" ];
requires = [ "forgejo.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
User = config.services.forgejo.user;
Group = config.services.forgejo.group;
WorkingDirectory = config.services.forgejo.stateDir;
};
script = ''
set -euo pipefail
client_id="$(<${config.sops.secrets."forgejo/pocket_id/client_id".path})"
client_secret="$(<${config.sops.secrets."forgejo/pocket_id/client_secret".path})"
provider_name="${cfg.pocketId.name}"
forgejo_bin="${lib.getExe config.services.forgejo.package}"
forgejo_config="${config.services.forgejo.customDir}/conf/app.ini"
forgejo_work_path="${config.services.forgejo.stateDir}"
auth_id="$(
"$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth list \
| ${lib.getExe' pkgs.gawk "awk"} '$2 == "'"$provider_name"'" { print $1; exit }'
)"
if [ -n "$auth_id" ]; then
"$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth update-oauth \
--id "$auth_id" \
--name "$provider_name" \
--provider openidConnect \
--key "$client_id" \
--secret "$client_secret" \
--auto-discover-url "${cfg.pocketId.discoveryUrl}" \
--scopes openid \
--scopes profile \
--scopes email
else
"$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth add-oauth \
--name "$provider_name" \
--provider openidConnect \
--key "$client_id" \
--secret "$client_secret" \
--auto-discover-url "${cfg.pocketId.discoveryUrl}" \
--scopes openid \
--scopes profile \
--scopes email
fi
'';
};
environment.systemPackages =
let
systemctl = lib.getExe' pkgs.systemd "systemctl";
modules/features/mtls/config.nix
+5
View File
@@ -28,6 +28,11 @@
type = lib.types.str;
default = "${config.certDir}/mtls.pem";
};
certGroup = lib.mkOption {
description = "Group that should be granted read access to generated certificate material.";
type = lib.types.str;
default = "mtls";
};
subject = lib.mkOption {
description = "Subject for the cert";
type = lib.types.str;
modules/features/mtls/mtls-wrappers.nix
+13 -1
View File
@@ -11,7 +11,11 @@ in
binName = "mtls-generate";
package = config.pkgs.step-cli;
extraPackages = with config.pkgs; [ coreutils step-cli systemd ];
preHook = "mkdir -p ${config.certDir}";
preHook = ''
mkdir -p "${config.certDir}"
chgrp "${config.certGroup}" "${config.certDir}"
chmod 0750 "${config.certDir}"
'';
args = [
"ca" "certificate"
"${config.subject}" "${config.certFile}" "${config.keyFile}"
@@ -25,7 +29,11 @@ in
++ lib.optionals config.overwrite [ "-f" ]
++ mkSANArgs config.SANs;
postHook = ''
chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}"
chmod 0640 "${config.certFile}" "${config.keyFile}"
(umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
chgrp "${config.certGroup}" "${config.bundleFile}"
chmod 0640 "${config.bundleFile}"
'';
};
});
@@ -45,7 +53,11 @@ in
"${config.certFile}" "${config.keyFile}"
];
postHook = ''
chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}"
chmod 0640 "${config.certFile}" "${config.keyFile}"
(umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
chgrp "${config.certGroup}" "${config.bundleFile}"
chmod 0640 "${config.bundleFile}"
'';
systemd = {