forgejo reactivate

modules/features/forgejo.nix

@@ -11,6 +11,23 @@
           type = lib.types.str;
         };
 
+        pocketId = {
+          enable = lib.mkEnableOption "Configure Pocket ID as a Forgejo OIDC provider";
+
+          discoveryUrl = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "https://id.example.com";
+            description = "OpenID Connect discovery URL for Pocket ID.";
+          };
+
+          name = lib.mkOption {
+            type = lib.types.str;
+            default = "pocket-id";
+            description = "Forgejo external auth source name for Pocket ID.";
+          };
+        };
+
         port = lib.mkOption {
           type = lib.types.port;
           default = 3000;
@@ -27,8 +44,20 @@
       };
 
       config = lib.mkIf cfg.enable {
+        assertions = [
+          {
+            assertion = !cfg.pocketId.enable || cfg.pocketId.discoveryUrl != null;
+            message = "forgejo.pocketId.discoveryUrl must be set when forgejo.pocketId.enable is true.";
+          }
+        ];
+
         networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];
 
+        mtls = lib.mkIf cfg.https {
+          certReaders = lib.mkAfter [ config.services.forgejo.user ];
+          renew.reloadUnits = lib.mkAfter [ "forgejo.service" ];
+        };
+
         systemd.services.forgejo.serviceConfig = lib.mkIf needsPrivilegedPort {
           AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
           CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
@@ -40,6 +69,9 @@
           "forgejo/internal_token".owner = config.services.forgejo.user;
           "forgejo/jwt_secret".owner = config.services.forgejo.user;
           "forgejo/lfs_jwt_secret".owner = config.services.forgejo.user;
+        } // lib.optionalAttrs cfg.pocketId.enable {
+          "forgejo/pocket_id/client_id".owner = config.services.forgejo.user;
+          "forgejo/pocket_id/client_secret".owner = config.services.forgejo.user;
         };
 
         services = {
@@ -48,9 +80,7 @@
             lfs.enable = true;
             database.type = "postgres";
             settings = {
-              DEFAULT = {
+              DEFAULT.RUN_MODE = "dev";
-                RUN_MODE = "dev";
-              };
               server = lib.mkMerge [
                 {
                   HTTP_PORT = cfg.port;
@@ -71,13 +101,9 @@
                 ACCOUNT_LINKING = "login";
                 REGISTER_EMAIL_CONFIRM = false;
               };
-              repository = {
+              repository.ENABLE_PUSH_CREATE_USER = true;
-                ENABLE_PUSH_CREATE_USER = true;
-              };
               ui.SHOW_USER_EMAIL = false;
-              markup = {
+              markup.ENABLED = true;
-                ENABLED = true;
-              };
             };
 
             secrets = {
@@ -109,6 +135,59 @@
           --work-path ${config.services.forgejo.dump.backupDir}
         '';
 
+        systemd.services.forgejo-pocket-id-oidc = lib.mkIf cfg.pocketId.enable {
+          description = "Ensure Pocket ID OIDC auth source exists in Forgejo";
+          after = [ "forgejo.service" ];
+          requires = [ "forgejo.service" ];
+          wantedBy = [ "multi-user.target" ];
+
+          serviceConfig = {
+            Type = "oneshot";
+            User = config.services.forgejo.user;
+            Group = config.services.forgejo.group;
+            WorkingDirectory = config.services.forgejo.stateDir;
+          };
+
+          script = ''
+            set -euo pipefail
+
+            client_id="$(<${config.sops.secrets."forgejo/pocket_id/client_id".path})"
+            client_secret="$(<${config.sops.secrets."forgejo/pocket_id/client_secret".path})"
+            provider_name="${cfg.pocketId.name}"
+            forgejo_bin="${lib.getExe config.services.forgejo.package}"
+            forgejo_config="${config.services.forgejo.customDir}/conf/app.ini"
+            forgejo_work_path="${config.services.forgejo.stateDir}"
+
+            auth_id="$(
+              "$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth list \
+                | ${lib.getExe' pkgs.gawk "awk"} '$2 == "'"$provider_name"'" { print $1; exit }'
+            )"
+
+            if [ -n "$auth_id" ]; then
+              "$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth update-oauth \
+                --id "$auth_id" \
+                --name "$provider_name" \
+                --provider openidConnect \
+                --key "$client_id" \
+                --secret "$client_secret" \
+                --auto-discover-url "${cfg.pocketId.discoveryUrl}" \
+                --scopes openid \
+                --scopes profile \
+                --scopes email
+            else
+              "$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth add-oauth \
+                --name "$provider_name" \
+                --provider openidConnect \
+                --key "$client_id" \
+                --secret "$client_secret" \
+                --auto-discover-url "${cfg.pocketId.discoveryUrl}" \
+                --scopes openid \
+                --scopes profile \
+                --scopes email
+            fi
+          '';
+        };
+
         environment.systemPackages =
           let
             systemctl = lib.getExe' pkgs.systemd "systemctl";

modules/features/mtls/config.nix

@@ -28,6 +28,11 @@
         type = lib.types.str;
         default = "${config.certDir}/mtls.pem";
       };
+      certGroup = lib.mkOption {
+        description = "Group that should be granted read access to generated certificate material.";
+        type = lib.types.str;
+        default = "mtls";
+      };
       subject = lib.mkOption {
         description = "Subject for the cert";
         type = lib.types.str;

modules/features/mtls/mtls-wrappers.nix

@@ -11,7 +11,11 @@ in
         binName = "mtls-generate";
         package = config.pkgs.step-cli;
         extraPackages = with config.pkgs; [ coreutils step-cli systemd ];
-        preHook = "mkdir -p ${config.certDir}";
+        preHook = ''
+          mkdir -p "${config.certDir}"
+          chgrp "${config.certGroup}" "${config.certDir}"
+          chmod 0750 "${config.certDir}"
+        '';
         args = [
           "ca" "certificate"
           "${config.subject}" "${config.certFile}" "${config.keyFile}"
@@ -25,7 +29,11 @@ in
         ++ lib.optionals config.overwrite [ "-f" ]
         ++ mkSANArgs config.SANs;
         postHook = ''
+          chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}"
+          chmod 0640 "${config.certFile}" "${config.keyFile}"
           (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
+          chgrp "${config.certGroup}" "${config.bundleFile}"
+          chmod 0640 "${config.bundleFile}"
         '';
       };
     });
@@ -45,7 +53,11 @@ in
           "${config.certFile}" "${config.keyFile}"
         ];
         postHook = ''
+          chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}"
+          chmod 0640 "${config.certFile}" "${config.keyFile}"
           (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
+          chgrp "${config.certGroup}" "${config.bundleFile}"
+          chmod 0640 "${config.bundleFile}"
         '';
 
         systemd = {

modules/hosts/soteria/default.nix

@@ -3,9 +3,11 @@
 let
   username = "john";
   hostname = "soteria";
+  forgejoDomain = "forgejo.john-stream.com";
   ipv4 = "192.168.1.233";
   ipv6 = "fded:fb16:653e:25da:be24:11ff:fe54:aa39";
-  names = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
+  sshNames = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
+  mtlsNames = sshNames ++ [ forgejoDomain ];
 in
 {
   flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
@@ -42,19 +44,24 @@ in
         mtls = {
           enable = true;
           subject = hostname;
-          san = names;
+          san = mtlsNames;
+          certDir = "/etc/mtls";
           # lifetime = "12h";
           # renew.onCalendar = "*:3/15";
           # renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
           # certReaders = [ config.services.forgejo.user "restic" ];
         };
 
-        # forgejo = {
+        forgejo = {
-        #   enable = true;
+          enable = true;
-        #   root_url = "https://forgejo.john-stream.com";
+          root_url = "https://forgejo.john-stream.com";
-        #   https = true;
+          https = true;
-        #   port = 443;
+          port = 443;
-        # };
+          pocketId = {
+            enable = true;
+            discoveryUrl = "https://pocketid.john-stream.com/.well-known/openid-configuration";
+          };
+        };
 
         # resticServer = {
         #   enable = true;
@@ -79,7 +86,7 @@ in
           provisioner = "admin";
           host = {
             enable = true;
-            extraPrincipals = names;
+            extraPrincipals = sshNames;
             autoRenew = true;
           };
           user.enable = true;

modules/hosts/soteria/secrets.yaml

@@ -1,42 +1,45 @@
 forgejo:
-    #ENC[AES256_GCM,data:/wtm0uXbiWFoGNWtlTzVuNxBR7CPm2FMB98t3AxSj5V5rltLvzF9BjgWoJCiX3ltzmU=,iv:xaZXbUIGJHxPrLRQzEQI7hgRgc0y061jIhoE3zlcMaA=,tag:fQGheCIdBKm6wE+vtj7g6A==,type:comment]
+    #ENC[AES256_GCM,data:H3xdtb9TA/VStpOzLxboPTck0iasvAAS77hVFQOI1hmIwwYNYuRXTWb9N0M9kBEv/ho=,iv:PkLd3iHLzjnsPZtfQq/LJcwHQDm+gyxQJX/jWrpRmUw=,tag:qHtHvotCqr4IGs0vi5AOhw==,type:comment]
-    secret_key: ENC[AES256_GCM,data:/jcyeDcsryLqu9Q3VnNaENb71/Tl5JUr0zDzxt8L5UCtnJ/YHA6MKItrQ9ZHFv1XROtnSfZl9D5kKomeM8EVqA==,iv:HxMKAMVQ08gkq6SWENj0/d8i9PhcgPCp5eqbztj9bSg=,tag:nO2dFWT/vfgGc/9JIDZrGw==,type:str]
+    secret_key: ENC[AES256_GCM,data:h1TOZGnV4yBX/wFVlpyxP/KhtKbjqpvxWL7/bxONfoi3PQMtkQfwWbjd/FTC72XyCAHO/yDsCtHRQjPQcyeXmw==,iv:XgdO/i8FKBCYsRfFc5JAg+9yA3TbreIJw4J8p0xif0s=,tag:TgrJREyZuc7cdUcru1Qk0w==,type:str]
-    #ENC[AES256_GCM,data:TADqVsZwXpH/zfrXNclavH8Sv++jX081UjK/Mkys5x52gU5fU0ikk478EmwzeergsHpmxxon,iv:v9HsIsud+eiko7F0u622MBrTVDsIxlpqru0Viifvqow=,tag:FLgNTW0EcGhHT6iI9I6Bsg==,type:comment]
+    #ENC[AES256_GCM,data:43sjaBcdtJol6ySQKUuhZfSM4TvS6HLrjI/CLSlFcBfIYIe8UoPK6ZSsG7u3knVc58u8YreH,iv:aHaCmk5lr05PbXAKASPy22t88f//LOEVgSRzbZ6KKow=,tag:U3wsAmEwbaKUzjwdp6ekcg==,type:comment]
-    internal_token: ENC[AES256_GCM,data:7eZM+misgHZz1p6HH9VzCAPIIFjp2vT0kyc9B1KllE+x2URyrgs5IR9SZ+T5vNdMdnlNzF25pUhKzjbak8tVN554rYWp06SczzqhLyaoHKs8iGBohMqfJkoZxxIVSB7g7GC+/SAsb719,iv:XbBXqXh/PqjEcAj0qsajR7Ij56KGT/9Spdp5T549p9I=,tag:o4ONucOkIE2VJ6VjOlPb6w==,type:str]
+    internal_token: ENC[AES256_GCM,data:tFzyCj02HXauxCqKFsZD0CB/W4FAxv4t0KSIZPPXV6a2N6PdDuL0W5+Wdd9O17E/Pa8mrourwjpqipON+FUNARp4bLsFp1bgBPeq52BLS1neSXC1YrxsO3W9/12Y5wpXI5mz7WwVJUvt,iv:uyxZlZ8vVnwkQBwNvPLgbeomyhx/lfSgi5xJyB2LLb8=,tag:oXfWY1wGL3NvlpfeGyIWxg==,type:str]
-    #ENC[AES256_GCM,data:ZqwgnKjaolJtjcy287fnDOkb/oSLnBpfWfsTeVPwbIE8YLRSoPP4gbCnHJBLq+TJNNI=,iv:zTvw4ZS6C1ifUwOijNLuTfUQ3JM+5gj1X2f/s8MwWXc=,tag:Y1yKlL+jIRHVBulGlSErog==,type:comment]
+    #ENC[AES256_GCM,data:8sFQ0j8jmDAmnl5FD6FFtHv6t34rFVu9O658hlGktKKFDpgXnj/IIaelvqSrsSlS6nA=,iv:HWYldmocbK/auGAXB/01zmC/vC58Z/2UYla6CFoaAL8=,tag:3dhcO0ip/w54Cf2pHwXqiQ==,type:comment]
-    jwt_secret: ENC[AES256_GCM,data:e59MlATOorsTIQjtTUKfX5Yo3CVsbbfuKczp1gh1m2D1kkZK3ORFztYpjg==,iv:JH3PVUmXToiThEKDkDJ8MGVMAPlIEgPSWhru+9WgNjk=,tag:FfDpaCPejpw6kGDkxJwDWw==,type:str]
+    jwt_secret: ENC[AES256_GCM,data:uIIHBk3m5DNHXRJ7pyg0Xvz1cxUFqfxUzFtBZGY59E4dPj9qHHe3RC7jEg==,iv:krZHjrU3QziSuHihpVLHaSIzHU5VZ1UUBeLBd3kWW3Y=,tag:3Z0UCV9+9nc+FU9vXFutbQ==,type:str]
-    lfs_jwt_secret: ENC[AES256_GCM,data:xi9PEKFUGRyc3YOg3JM3KrrENi9xsbeBjiz4R16SK5WDafoGFLazN6KRJQ==,iv:1IhPyQDwA8tZ22pfZJiU8TRTCLCHC/HAnKdmSGDfvcM=,tag:rLdREVSKBm67rt8ayN16Vw==,type:str]
+    lfs_jwt_secret: ENC[AES256_GCM,data:LGemlQqpCwy1HlQI3BfW6Qir8cjYgtpoyFkoKhYgGR5x+F3shCaiUNEwFA==,iv:3C3S4gUpk1szU/7Dg9RObpv3/DMpzCpFg3qyrfFMot0=,tag:dwIRfA6PoQo09+YEs6o8fg==,type:str]
-restic_password: ENC[AES256_GCM,data:u7QOZXJkxVG4J75K5nphb2uJGdz6jbWuVSsKKu+41fshp7cVoRijtr/Cs02LjVse,iv:bt1W2FeBTG6ypBFYzMPXPIkYTSn0uHURY2ui6MRgYY8=,tag:DObAMws/zQcM+UKUe9EECA==,type:str]
+    pocket_id:
+        client_id: ENC[AES256_GCM,data:0aju1RTsGGpKRWHoBIydKUzijX5iHYWlAW/q5Ykam1WUs+py,iv:pkcZrlE1OZnEUZPnveWWkShA225tinm0eDIpmg1YbWY=,tag:vz168jIJzbJ7+DrZzn4BmA==,type:str]
+        client_secret: ENC[AES256_GCM,data:dXqdSqwc6aDmWOD3sYla0KWdk3CUQxLpKaQ0b5uozRI=,iv:N/LHumamZMqtqOdx3Mmj25zlsvYfriYahdxtd/goCAk=,tag:kYjcXzwrsnTN5pBGfDi1Yw==,type:str]
+restic_password: ENC[AES256_GCM,data:4OOYu5+BabBtRkGjvXwIAxb+L5H3ADkqTWZFwSKIV0eOhRvNfBTlL7HBvvMCFXcP,iv:wBmht7AbnZwcKV3vBygrcuV02KoCStVn3AYt3iLOBpI=,tag:cMcCqwb6wPMm9ZKk59me4A==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLM3NML2ozWExSTlY3ZXJH
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVV2FrSURwdEozZ0l6MjRJ
-            ZEpaN1RIOWVjNXRRQTlLQVZKTUUvZnBxREd3Cmp6b29aRDlUdDFwMVhwS2thODNO
+            VWU4YTVVMmN1OHNEWWJ1RmJrU1ltcFhGVW00CkFTWDRtYWtKSFRBcVRKZXZtUCtQ
-            QzNWSVIrak1uMGRuUlBONkR2aW1nbXMKLS0tIDh2YmFaRXBvZ0Q2blhjTVphL3J3
+            Zi9pa21BcGJaMmJTa3Jab1VRUW5LVUUKLS0tIHlUY2d3OXVVTDY4UDhOamYrSnNW
-            TkROaHdwWWN4YnkyczZLbDJYRTNrQTQKvHSXjP9EZkq9DrPZZHTIlFrPUhez6jZT
+            R1orWGIwUFpPVnpQRUFuNm00OEZ5MWsKwH1QahhZWw4aUbAcST+fL2HefrJdKktD
-            LJvkmQgKluer7+lWr8XuuqtQsvhtef1di82SBG6C6YK0zWIxrMjFkA==
+            G5sLmNPa3aEKx0Y3CSIvgww23iQYw31iXJS9sVcPyMVt99YP21KbvA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1p4gyh5260ewp7t2ctzv5ewj4a06szl389fm4gzy6vltxhjj73ers87u33g
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWThXZGtFSjFZVU1UWG9v
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBReFNXY3c0UnZ3cGZnbnFO
-            Wk9sVEVWemtVWTJ6TGlOd3ZhVUZBYnJ1OFFRClpFNmEwTG1PR0pQUFJuTTVVZGRD
+            K3dZS2w4S0UzeFE4YXg0V3BjbzNISm8xdWdZCkc4NUdBMktMbStSZkFtTFBHcGNQ
-            bnpPdjZGVUJvS0NyWGJQbEV4cUlHZncKLS0tIDFNU1VxNjZYSks1OTMrblJPbDI1
+            eDdlQXRXb3NKaUtLWXlqN0txOGxoMTgKLS0tIEZPV1BCWUFRaldIMDlSRXZzMmtN
-            bHIrUnhsMWNhWVpVc3hCazlKTlV5YncKgR/AbgCE9JU8U8PH3ouYTZJOqL7rRODr
+            aW14MnNtZVM0M0M0ajk2UElCWklhaVUKZewlYVMefFqC+ddzrgmAXVTiuBqhhxEL
-            5D2zT9pcTC3LQGZrhNtgjAi6IucU4yDAU7UhT3D7cZawwFTKVaoplw==
+            Q3cUhxGk5DUhCn30ia/ztQIb79kVBrdhY6zA2bKcBdYH4HSzV+rNAA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3K054SHE0V1RCYlRlTXJT
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhbVRyNmN3WU5SbTNtbzZV
-            bXo4ZnE1cFozY3R2dmg5S1BacC9xb2oweWpBClJJVnkrSytFaG8xR1l4SU5FNGxi
+            cGoybXo0dWtpRDNkR2drZTN0VFhoQ0REQ0ZvCkNSSm9hbmZDNUsxTjBGWm5QL3M2
-            UndnNzYwMUlXSjRYK3c3MzI4NmRVRVEKLS0tIFQ4NFdPeGI4LytWK0JPcUV4VjM2
+            VElMSi8ybFRVM3hpNUlYdVAyME1RTUEKLS0tIGJVRis5WkRDRkxCVVdJVENlZ3Ru
-            b1dtYWdFTTFQcW5PQml2OWs1Z0VZOFUKrDX7y3cU8KPRLKlO/HI/jdynqwO1TAS0
+            aGw3cW51Vno4emFMckxqRTVGcGhoemcK4WBC2EZEx7hVlUQnsD4V5QH9peNjUoWE
-            WY4F0qFKmWwsJJjbnjdpYYP3O1/8RNeXjnUg8fGYY75sf7iAYWSe/w==
+            XjCvw0twhPRi9uXd4HmHqlDpxdGMk0oFQ77O7h7Q3z2uqsJ2v8p/SA==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
-    lastmodified: "2026-04-04T23:18:43Z"
+    lastmodified: "2026-07-10T04:31:57Z"
-    mac: ENC[AES256_GCM,data:qBgeli5lHb4pyA8nAADBuRBAaq8VbAIsFI37OZtgnbnoHW2crxo3YC+EknaIYnZpZ48kwVhQS5lGRjI6JsWWhTH3+LVAhTmS2Qj/pZTD/JDLK6XJGXS4U9nB7m9aGYyW8gFCy9/DfoJWGsS//+ZmUikKPfd5kMZgh1zGoYCIGug=,iv:h+2fA+bO2SMCNrEslP36x3BPRaIy25cU/DNX8CYSC6A=,tag:RvVyUZ4ONRaKaqGiT31eUQ==,type:str]
+    mac: ENC[AES256_GCM,data:uytG0nhJ/Gp0KbOovD1SVXx0G27e12gMPwmpkU0lPW01cAXNe0rv4SjhHGP0FOR6vLimcPAmekVjVqiKxie8Zevo/Jf9ZRTkQ6ixWLvhH2NMHra4T5TWtUjfMdFM8tiilwcvjsXpqAoaJDZ0HHY5NYhXG/khobAwBRc26RtICVw=,iv:6gB28VE17+NoM/tR9lIlJoMPD91Aud+kH95Vo+fWLjs=,tag:QMUQPsCnr1TUsQE66GVBBg==,type:str]
     unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.1