forgejo reactivate

modules/hosts/soteria/default.nix

@@ -3,9 +3,11 @@
 let
   username = "john";
   hostname = "soteria";
+  forgejoDomain = "forgejo.john-stream.com";
   ipv4 = "192.168.1.233";
   ipv6 = "fded:fb16:653e:25da:be24:11ff:fe54:aa39";
-  names = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
+  sshNames = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
+  mtlsNames = sshNames ++ [ forgejoDomain ];
 in
 {
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
@@ -42,19 +44,24 @@ in
         mtls = {
           enable = true;
           subject = hostname;
-          san = names;
+          san = mtlsNames;
+          certDir = "/etc/mtls";
           # lifetime = "12h";
           # renew.onCalendar = "*:3/15";
           # renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
           # certReaders = [ config.services.forgejo.user "restic" ];
         };
 
-        # forgejo = {
-        #   enable = true;
-        #   root_url = "https://forgejo.john-stream.com";
-        #   https = true;
-        #   port = 443;
-        # };
+        forgejo = {
+          enable = true;
+          root_url = "https://forgejo.john-stream.com";
+          https = true;
+          port = 443;
+          pocketId = {
+            enable = true;
+            discoveryUrl = "https://pocketid.john-stream.com/.well-known/openid-configuration";
+          };
+        };
 
         # resticServer = {
         #   enable = true;
@@ -79,7 +86,7 @@ in
           provisioner = "admin";
           host = {
             enable = true;
-            extraPrincipals = names;
+            extraPrincipals = sshNames;
             autoRenew = true;
           };
           user.enable = true;