forgejo reactivate

2026-07-10 00:04:34 -05:00
parent b21bfd6bb4
commit 25ecb7ad06
5 changed files with 151 additions and 45 deletions
@@ -11,6 +11,23 @@
          type = lib.types.str;
        };

+        pocketId = {
+          enable = lib.mkEnableOption "Configure Pocket ID as a Forgejo OIDC provider";
+
+          discoveryUrl = lib.mkOption {
+            type = lib.types.nullOr lib.types.str;
+            default = null;
+            example = "https://id.example.com";
+            description = "OpenID Connect discovery URL for Pocket ID.";
+          };
+
+          name = lib.mkOption {
+            type = lib.types.str;
+            default = "pocket-id";
+            description = "Forgejo external auth source name for Pocket ID.";
+          };
+        };
+
        port = lib.mkOption {
          type = lib.types.port;
          default = 3000;
@@ -27,8 +44,20 @@
      };

      config = lib.mkIf cfg.enable {
+        assertions = [
+          {
+            assertion = !cfg.pocketId.enable || cfg.pocketId.discoveryUrl != null;
+            message = "forgejo.pocketId.discoveryUrl must be set when forgejo.pocketId.enable is true.";
+          }
+        ];
+
        networking.firewall.allowedTCPPorts = lib.optionals cfg.openFirewall [ cfg.port ];

+        mtls = lib.mkIf cfg.https {
+          certReaders = lib.mkAfter [ config.services.forgejo.user ];
+          renew.reloadUnits = lib.mkAfter [ "forgejo.service" ];
+        };
+
        systemd.services.forgejo.serviceConfig = lib.mkIf needsPrivilegedPort {
          AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
          CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
@@ -40,6 +69,9 @@
          "forgejo/internal_token".owner = config.services.forgejo.user;
          "forgejo/jwt_secret".owner = config.services.forgejo.user;
          "forgejo/lfs_jwt_secret".owner = config.services.forgejo.user;
+        } // lib.optionalAttrs cfg.pocketId.enable {
+          "forgejo/pocket_id/client_id".owner = config.services.forgejo.user;
+          "forgejo/pocket_id/client_secret".owner = config.services.forgejo.user;
        };

        services = {
@@ -48,9 +80,7 @@
            lfs.enable = true;
            database.type = "postgres";
            settings = {
-              DEFAULT = {
-                RUN_MODE = "dev";
-              };
+              DEFAULT.RUN_MODE = "dev";
              server = lib.mkMerge [
                {
                  HTTP_PORT = cfg.port;
@@ -71,13 +101,9 @@
                ACCOUNT_LINKING = "login";
                REGISTER_EMAIL_CONFIRM = false;
              };
-              repository = {
-                ENABLE_PUSH_CREATE_USER = true;
-              };
+              repository.ENABLE_PUSH_CREATE_USER = true;
              ui.SHOW_USER_EMAIL = false;
-              markup = {
-                ENABLED = true;
-              };
+              markup.ENABLED = true;
            };

            secrets = {
@@ -109,6 +135,59 @@
          --work-path ${config.services.forgejo.dump.backupDir}
        '';

+        systemd.services.forgejo-pocket-id-oidc = lib.mkIf cfg.pocketId.enable {
+          description = "Ensure Pocket ID OIDC auth source exists in Forgejo";
+          after = [ "forgejo.service" ];
+          requires = [ "forgejo.service" ];
+          wantedBy = [ "multi-user.target" ];
+
+          serviceConfig = {
+            Type = "oneshot";
+            User = config.services.forgejo.user;
+            Group = config.services.forgejo.group;
+            WorkingDirectory = config.services.forgejo.stateDir;
+          };
+
+          script = ''
+            set -euo pipefail
+
+            client_id="$(<${config.sops.secrets."forgejo/pocket_id/client_id".path})"
+            client_secret="$(<${config.sops.secrets."forgejo/pocket_id/client_secret".path})"
+            provider_name="${cfg.pocketId.name}"
+            forgejo_bin="${lib.getExe config.services.forgejo.package}"
+            forgejo_config="${config.services.forgejo.customDir}/conf/app.ini"
+            forgejo_work_path="${config.services.forgejo.stateDir}"
+
+            auth_id="$(
+              "$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth list \
+                | ${lib.getExe' pkgs.gawk "awk"} '$2 == "'"$provider_name"'" { print $1; exit }'
+            )"
+
+            if [ -n "$auth_id" ]; then
+              "$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth update-oauth \
+                --id "$auth_id" \
+                --name "$provider_name" \
+                --provider openidConnect \
+                --key "$client_id" \
+                --secret "$client_secret" \
+                --auto-discover-url "${cfg.pocketId.discoveryUrl}" \
+                --scopes openid \
+                --scopes profile \
+                --scopes email
+            else
+              "$forgejo_bin" --config "$forgejo_config" --work-path "$forgejo_work_path" admin auth add-oauth \
+                --name "$provider_name" \
+                --provider openidConnect \
+                --key "$client_id" \
+                --secret "$client_secret" \
+                --auto-discover-url "${cfg.pocketId.discoveryUrl}" \
+                --scopes openid \
+                --scopes profile \
+                --scopes email
+            fi
+          '';
+        };
+
        environment.systemPackages =
          let
            systemctl = lib.getExe' pkgs.systemd "systemctl";
@@ -28,6 +28,11 @@
        type = lib.types.str;
        default = "${config.certDir}/mtls.pem";
      };
+      certGroup = lib.mkOption {
+        description = "Group that should be granted read access to generated certificate material.";
+        type = lib.types.str;
+        default = "mtls";
+      };
      subject = lib.mkOption {
        description = "Subject for the cert";
        type = lib.types.str;
@@ -11,7 +11,11 @@ in
        binName = "mtls-generate";
        package = config.pkgs.step-cli;
        extraPackages = with config.pkgs; [ coreutils step-cli systemd ];
-        preHook = "mkdir -p ${config.certDir}";
+        preHook = ''
+          mkdir -p "${config.certDir}"
+          chgrp "${config.certGroup}" "${config.certDir}"
+          chmod 0750 "${config.certDir}"
+        '';
        args = [
          "ca" "certificate"
          "${config.subject}" "${config.certFile}" "${config.keyFile}"
@@ -25,7 +29,11 @@ in
        ++ lib.optionals config.overwrite [ "-f" ]
        ++ mkSANArgs config.SANs;
        postHook = ''
+          chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}"
+          chmod 0640 "${config.certFile}" "${config.keyFile}"
          (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
+          chgrp "${config.certGroup}" "${config.bundleFile}"
+          chmod 0640 "${config.bundleFile}"
        '';
      };
    });
@@ -45,7 +53,11 @@ in
          "${config.certFile}" "${config.keyFile}"
        ];
        postHook = ''
+          chgrp "${config.certGroup}" "${config.certFile}" "${config.keyFile}"
+          chmod 0640 "${config.certFile}" "${config.keyFile}"
          (umask 077; cat "${config.certFile}" "${config.keyFile}" > "${config.bundleFile}")
+          chgrp "${config.certGroup}" "${config.bundleFile}"
+          chmod 0640 "${config.bundleFile}"
        '';

        systemd = {
@@ -3,9 +3,11 @@
 let
  username = "john";
  hostname = "soteria";
+  forgejoDomain = "forgejo.john-stream.com";
  ipv4 = "192.168.1.233";
  ipv6 = "fded:fb16:653e:25da:be24:11ff:fe54:aa39";
-  names = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
+  sshNames = [ "${hostname}.john-stream.com" ipv4 ipv6 ];
+  mtlsNames = sshNames ++ [ forgejoDomain ];
 in
 {
  flake.nixosConfigurations."${hostname}" = inputs.nixpkgs.lib.nixosSystem {
@@ -42,19 +44,24 @@ in
        mtls = {
          enable = true;
          subject = hostname;
-          san = names;
+          san = mtlsNames;
+          certDir = "/etc/mtls";
          # lifetime = "12h";
          # renew.onCalendar = "*:3/15";
          # renew.reloadUnits = [ "forgejo.service" "restic-rest-server.service" ];
          # certReaders = [ config.services.forgejo.user "restic" ];
        };

-        # forgejo = {
-        #   enable = true;
-        #   root_url = "https://forgejo.john-stream.com";
-        #   https = true;
-        #   port = 443;
-        # };
+        forgejo = {
+          enable = true;
+          root_url = "https://forgejo.john-stream.com";
+          https = true;
+          port = 443;
+          pocketId = {
+            enable = true;
+            discoveryUrl = "https://pocketid.john-stream.com/.well-known/openid-configuration";
+          };
+        };

        # resticServer = {
        #   enable = true;
@@ -79,7 +86,7 @@ in
          provisioner = "admin";
          host = {
            enable = true;
-            extraPrincipals = names;
+            extraPrincipals = sshNames;
            autoRenew = true;
          };
          user.enable = true;
@@ -1,42 +1,45 @@
 forgejo:
-    #ENC[AES256_GCM,data:/wtm0uXbiWFoGNWtlTzVuNxBR7CPm2FMB98t3AxSj5V5rltLvzF9BjgWoJCiX3ltzmU=,iv:xaZXbUIGJHxPrLRQzEQI7hgRgc0y061jIhoE3zlcMaA=,tag:fQGheCIdBKm6wE+vtj7g6A==,type:comment]
-    secret_key: ENC[AES256_GCM,data:/jcyeDcsryLqu9Q3VnNaENb71/Tl5JUr0zDzxt8L5UCtnJ/YHA6MKItrQ9ZHFv1XROtnSfZl9D5kKomeM8EVqA==,iv:HxMKAMVQ08gkq6SWENj0/d8i9PhcgPCp5eqbztj9bSg=,tag:nO2dFWT/vfgGc/9JIDZrGw==,type:str]
-    #ENC[AES256_GCM,data:TADqVsZwXpH/zfrXNclavH8Sv++jX081UjK/Mkys5x52gU5fU0ikk478EmwzeergsHpmxxon,iv:v9HsIsud+eiko7F0u622MBrTVDsIxlpqru0Viifvqow=,tag:FLgNTW0EcGhHT6iI9I6Bsg==,type:comment]
-    internal_token: ENC[AES256_GCM,data:7eZM+misgHZz1p6HH9VzCAPIIFjp2vT0kyc9B1KllE+x2URyrgs5IR9SZ+T5vNdMdnlNzF25pUhKzjbak8tVN554rYWp06SczzqhLyaoHKs8iGBohMqfJkoZxxIVSB7g7GC+/SAsb719,iv:XbBXqXh/PqjEcAj0qsajR7Ij56KGT/9Spdp5T549p9I=,tag:o4ONucOkIE2VJ6VjOlPb6w==,type:str]
-    #ENC[AES256_GCM,data:ZqwgnKjaolJtjcy287fnDOkb/oSLnBpfWfsTeVPwbIE8YLRSoPP4gbCnHJBLq+TJNNI=,iv:zTvw4ZS6C1ifUwOijNLuTfUQ3JM+5gj1X2f/s8MwWXc=,tag:Y1yKlL+jIRHVBulGlSErog==,type:comment]
-    jwt_secret: ENC[AES256_GCM,data:e59MlATOorsTIQjtTUKfX5Yo3CVsbbfuKczp1gh1m2D1kkZK3ORFztYpjg==,iv:JH3PVUmXToiThEKDkDJ8MGVMAPlIEgPSWhru+9WgNjk=,tag:FfDpaCPejpw6kGDkxJwDWw==,type:str]
-    lfs_jwt_secret: ENC[AES256_GCM,data:xi9PEKFUGRyc3YOg3JM3KrrENi9xsbeBjiz4R16SK5WDafoGFLazN6KRJQ==,iv:1IhPyQDwA8tZ22pfZJiU8TRTCLCHC/HAnKdmSGDfvcM=,tag:rLdREVSKBm67rt8ayN16Vw==,type:str]
-restic_password: ENC[AES256_GCM,data:u7QOZXJkxVG4J75K5nphb2uJGdz6jbWuVSsKKu+41fshp7cVoRijtr/Cs02LjVse,iv:bt1W2FeBTG6ypBFYzMPXPIkYTSn0uHURY2ui6MRgYY8=,tag:DObAMws/zQcM+UKUe9EECA==,type:str]
+    #ENC[AES256_GCM,data:H3xdtb9TA/VStpOzLxboPTck0iasvAAS77hVFQOI1hmIwwYNYuRXTWb9N0M9kBEv/ho=,iv:PkLd3iHLzjnsPZtfQq/LJcwHQDm+gyxQJX/jWrpRmUw=,tag:qHtHvotCqr4IGs0vi5AOhw==,type:comment]
+    secret_key: ENC[AES256_GCM,data:h1TOZGnV4yBX/wFVlpyxP/KhtKbjqpvxWL7/bxONfoi3PQMtkQfwWbjd/FTC72XyCAHO/yDsCtHRQjPQcyeXmw==,iv:XgdO/i8FKBCYsRfFc5JAg+9yA3TbreIJw4J8p0xif0s=,tag:TgrJREyZuc7cdUcru1Qk0w==,type:str]
+    #ENC[AES256_GCM,data:43sjaBcdtJol6ySQKUuhZfSM4TvS6HLrjI/CLSlFcBfIYIe8UoPK6ZSsG7u3knVc58u8YreH,iv:aHaCmk5lr05PbXAKASPy22t88f//LOEVgSRzbZ6KKow=,tag:U3wsAmEwbaKUzjwdp6ekcg==,type:comment]
+    internal_token: ENC[AES256_GCM,data:tFzyCj02HXauxCqKFsZD0CB/W4FAxv4t0KSIZPPXV6a2N6PdDuL0W5+Wdd9O17E/Pa8mrourwjpqipON+FUNARp4bLsFp1bgBPeq52BLS1neSXC1YrxsO3W9/12Y5wpXI5mz7WwVJUvt,iv:uyxZlZ8vVnwkQBwNvPLgbeomyhx/lfSgi5xJyB2LLb8=,tag:oXfWY1wGL3NvlpfeGyIWxg==,type:str]
+    #ENC[AES256_GCM,data:8sFQ0j8jmDAmnl5FD6FFtHv6t34rFVu9O658hlGktKKFDpgXnj/IIaelvqSrsSlS6nA=,iv:HWYldmocbK/auGAXB/01zmC/vC58Z/2UYla6CFoaAL8=,tag:3dhcO0ip/w54Cf2pHwXqiQ==,type:comment]
+    jwt_secret: ENC[AES256_GCM,data:uIIHBk3m5DNHXRJ7pyg0Xvz1cxUFqfxUzFtBZGY59E4dPj9qHHe3RC7jEg==,iv:krZHjrU3QziSuHihpVLHaSIzHU5VZ1UUBeLBd3kWW3Y=,tag:3Z0UCV9+9nc+FU9vXFutbQ==,type:str]
+    lfs_jwt_secret: ENC[AES256_GCM,data:LGemlQqpCwy1HlQI3BfW6Qir8cjYgtpoyFkoKhYgGR5x+F3shCaiUNEwFA==,iv:3C3S4gUpk1szU/7Dg9RObpv3/DMpzCpFg3qyrfFMot0=,tag:dwIRfA6PoQo09+YEs6o8fg==,type:str]
+    pocket_id:
+        client_id: ENC[AES256_GCM,data:0aju1RTsGGpKRWHoBIydKUzijX5iHYWlAW/q5Ykam1WUs+py,iv:pkcZrlE1OZnEUZPnveWWkShA225tinm0eDIpmg1YbWY=,tag:vz168jIJzbJ7+DrZzn4BmA==,type:str]
+        client_secret: ENC[AES256_GCM,data:dXqdSqwc6aDmWOD3sYla0KWdk3CUQxLpKaQ0b5uozRI=,iv:N/LHumamZMqtqOdx3Mmj25zlsvYfriYahdxtd/goCAk=,tag:kYjcXzwrsnTN5pBGfDi1Yw==,type:str]
+restic_password: ENC[AES256_GCM,data:4OOYu5+BabBtRkGjvXwIAxb+L5H3ADkqTWZFwSKIV0eOhRvNfBTlL7HBvvMCFXcP,iv:wBmht7AbnZwcKV3vBygrcuV02KoCStVn3AYt3iLOBpI=,tag:cMcCqwb6wPMm9ZKk59me4A==,type:str]
 sops:
    age:
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLM3NML2ozWExSTlY3ZXJH
-            ZEpaN1RIOWVjNXRRQTlLQVZKTUUvZnBxREd3Cmp6b29aRDlUdDFwMVhwS2thODNO
-            QzNWSVIrak1uMGRuUlBONkR2aW1nbXMKLS0tIDh2YmFaRXBvZ0Q2blhjTVphL3J3
-            TkROaHdwWWN4YnkyczZLbDJYRTNrQTQKvHSXjP9EZkq9DrPZZHTIlFrPUhez6jZT
-            LJvkmQgKluer7+lWr8XuuqtQsvhtef1di82SBG6C6YK0zWIxrMjFkA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVV2FrSURwdEozZ0l6MjRJ
+            VWU4YTVVMmN1OHNEWWJ1RmJrU1ltcFhGVW00CkFTWDRtYWtKSFRBcVRKZXZtUCtQ
+            Zi9pa21BcGJaMmJTa3Jab1VRUW5LVUUKLS0tIHlUY2d3OXVVTDY4UDhOamYrSnNW
+            R1orWGIwUFpPVnpQRUFuNm00OEZ5MWsKwH1QahhZWw4aUbAcST+fL2HefrJdKktD
+            G5sLmNPa3aEKx0Y3CSIvgww23iQYw31iXJS9sVcPyMVt99YP21KbvA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1p4gyh5260ewp7t2ctzv5ewj4a06szl389fm4gzy6vltxhjj73ers87u33g
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWThXZGtFSjFZVU1UWG9v
-            Wk9sVEVWemtVWTJ6TGlOd3ZhVUZBYnJ1OFFRClpFNmEwTG1PR0pQUFJuTTVVZGRD
-            bnpPdjZGVUJvS0NyWGJQbEV4cUlHZncKLS0tIDFNU1VxNjZYSks1OTMrblJPbDI1
-            bHIrUnhsMWNhWVpVc3hCazlKTlV5YncKgR/AbgCE9JU8U8PH3ouYTZJOqL7rRODr
-            5D2zT9pcTC3LQGZrhNtgjAi6IucU4yDAU7UhT3D7cZawwFTKVaoplw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBReFNXY3c0UnZ3cGZnbnFO
+            K3dZS2w4S0UzeFE4YXg0V3BjbzNISm8xdWdZCkc4NUdBMktMbStSZkFtTFBHcGNQ
+            eDdlQXRXb3NKaUtLWXlqN0txOGxoMTgKLS0tIEZPV1BCWUFRaldIMDlSRXZzMmtN
+            aW14MnNtZVM0M0M0ajk2UElCWklhaVUKZewlYVMefFqC+ddzrgmAXVTiuBqhhxEL
+            Q3cUhxGk5DUhCn30ia/ztQIb79kVBrdhY6zA2bKcBdYH4HSzV+rNAA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1ykcs39e62pz3xu6cedg8ea685kv5d5qsrhgkndygzm8rx30xd5ys5t3qxt
        - enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3K054SHE0V1RCYlRlTXJT
-            bXo4ZnE1cFozY3R2dmg5S1BacC9xb2oweWpBClJJVnkrSytFaG8xR1l4SU5FNGxi
-            UndnNzYwMUlXSjRYK3c3MzI4NmRVRVEKLS0tIFQ4NFdPeGI4LytWK0JPcUV4VjM2
-            b1dtYWdFTTFQcW5PQml2OWs1Z0VZOFUKrDX7y3cU8KPRLKlO/HI/jdynqwO1TAS0
-            WY4F0qFKmWwsJJjbnjdpYYP3O1/8RNeXjnUg8fGYY75sf7iAYWSe/w==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhbVRyNmN3WU5SbTNtbzZV
+            cGoybXo0dWtpRDNkR2drZTN0VFhoQ0REQ0ZvCkNSSm9hbmZDNUsxTjBGWm5QL3M2
+            VElMSi8ybFRVM3hpNUlYdVAyME1RTUEKLS0tIGJVRis5WkRDRkxCVVdJVENlZ3Ru
+            aGw3cW51Vno4emFMckxqRTVGcGhoemcK4WBC2EZEx7hVlUQnsD4V5QH9peNjUoWE
+            XjCvw0twhPRi9uXd4HmHqlDpxdGMk0oFQ77O7h7Q3z2uqsJ2v8p/SA==
            -----END AGE ENCRYPTED FILE-----
          recipient: age1gvplss0ddmyf6vpjy363wu3n057vhm0j6n7tc94cxd8kadapypws5mtaj0
-    lastmodified: "2026-04-04T23:18:43Z"
-    mac: ENC[AES256_GCM,data:qBgeli5lHb4pyA8nAADBuRBAaq8VbAIsFI37OZtgnbnoHW2crxo3YC+EknaIYnZpZ48kwVhQS5lGRjI6JsWWhTH3+LVAhTmS2Qj/pZTD/JDLK6XJGXS4U9nB7m9aGYyW8gFCy9/DfoJWGsS//+ZmUikKPfd5kMZgh1zGoYCIGug=,iv:h+2fA+bO2SMCNrEslP36x3BPRaIy25cU/DNX8CYSC6A=,tag:RvVyUZ4ONRaKaqGiT31eUQ==,type:str]
+    lastmodified: "2026-07-10T04:31:57Z"
+    mac: ENC[AES256_GCM,data:uytG0nhJ/Gp0KbOovD1SVXx0G27e12gMPwmpkU0lPW01cAXNe0rv4SjhHGP0FOR6vLimcPAmekVjVqiKxie8Zevo/Jf9ZRTkQ6ixWLvhH2NMHra4T5TWtUjfMdFM8tiilwcvjsXpqAoaJDZ0HHY5NYhXG/khobAwBRc26RtICVw=,iv:6gB28VE17+NoM/tR9lIlJoMPD91Aud+kH95Vo+fWLjs=,tag:QMUQPsCnr1TUsQE66GVBBg==,type:str]
    unencrypted_suffix: _unencrypted
-    version: 3.12.2
+    version: 3.13.1