98 lines
2.4 KiB
Nix
98 lines
2.4 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
let
|
|
hostname = config.instance.hostname;
|
|
domain-name = config.instance.local-domain;
|
|
|
|
secrets = config.fudo.secrets.host-secrets.${hostname};
|
|
|
|
cfg = config.fudo.france.git;
|
|
|
|
sshOpts = { ... }: {
|
|
options = with types; {
|
|
listen-ip = mkOption {
|
|
type = str;
|
|
description = "IP address on which to listen for SSH connections.";
|
|
};
|
|
listen-port = mkOption {
|
|
type = port;
|
|
description = "Port on which to listen for SSH connections.";
|
|
default = 22;
|
|
};
|
|
};
|
|
};
|
|
|
|
|
|
in {
|
|
options.fudo.france.git = with types; {
|
|
repository-directory = mkOption {
|
|
type = str;
|
|
description = "Path to store git repositories.";
|
|
};
|
|
state-directory = mkOption {
|
|
type = str;
|
|
description = "Path to store git server state.";
|
|
};
|
|
database-host = mkOption {
|
|
type = str;
|
|
description = "PostGreSQL database host.";
|
|
};
|
|
ssh = mkOption {
|
|
type = submodule sshOpts;
|
|
description = "Git SSH listen options.";
|
|
};
|
|
};
|
|
|
|
config.fudo = {
|
|
secrets.host-secrets.${hostname}.git-database-password = {
|
|
source-file = pkgs.lib.fudo.passwd.stablerandom-passwd-file
|
|
"gitea-database-passwd"
|
|
"${hostname}-gitea-database-passwd-${config.instance.build-seed}";
|
|
target-file = "/var/gitea/database.passwd";
|
|
user = config.services.gitea.user;
|
|
};
|
|
|
|
postgresql = {
|
|
databases.fudo_git.users =
|
|
config.instance.local-admins;
|
|
|
|
users.fudo_git = {
|
|
password-file =
|
|
secrets.git-database-password.target-file;
|
|
databases = {
|
|
fudo_git = {
|
|
access = "CONNECT";
|
|
entity-access = {
|
|
"ALL TABLES IN SCHEMA public" =
|
|
"SELECT,INSERT,UPDATE,DELETE";
|
|
"ALL SEQUENCES IN SCHEMA public" =
|
|
"SELECT, UPDATE";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
git = {
|
|
enable = true;
|
|
hostname = "git.${domain-name}";
|
|
site-name = "Fudo Git";
|
|
user = "git-fudo";
|
|
repository-dir = cfg.repository-directory;
|
|
state-dir = cfg.state-directory;
|
|
database = {
|
|
user = "fudo_git";
|
|
password-file =
|
|
secrets.git-database-password.target-file;
|
|
hostname = cfg.database-host;
|
|
name = "fudo_git";
|
|
};
|
|
ssh = {
|
|
listen-ip = cfg.ssh.listen-ip;
|
|
listen-port = cfg.ssh.listen-port;
|
|
};
|
|
};
|
|
};
|
|
}
|