Added forgejo(git server)

caddy.nix

@@ -22,6 +22,23 @@
       }
       reverse_proxy 192.168.100.11:80
     '';
+
+    # Nextcloud — served by local nginx
+    # (Authelia forward-auth disabled for now; re-enable by uncommenting the
+    #  forward_auth block below.)
+    virtualHosts."nextcloud.srazka.com".extraConfig = ''
+      # forward_auth 127.0.0.1:9091 {
+      #   uri /api/authz/forward-auth
+      #   copy_headers Remote-User Remote-Groups Remote-Email Remote-Name
+      # }
+      reverse_proxy 127.0.0.1:8081
+    '';
+
+    # Forgejo — no Authelia forward-auth, since it would break git over HTTPS
+    # and the API. Forgejo handles its own logins.
+    virtualHosts."git.srazka.com".extraConfig = ''
+      reverse_proxy 127.0.0.1:14921
+    '';
   };
 
 }

configuration.nix

@@ -29,12 +29,11 @@
     homeMode = "0755";
     extraGroups = [ "wheel" "podman" ]; #sudo
     openssh.authorizedKeys.keys = [
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6TOSFZ+P0oWTa9U3fX/L9c3btv/lCgzPrwKu621aLDjSbWbaddGhAXQtJvl7GJvs7QN52z+icftK94gdeyTbZyzQtY6JNUVmUs5EHlZlYTkAYSFN/rkn6N7/n9aYRN+vd8r0B4IrP5gTPtGglLD16dfukpOgwtQj/eK6tqZpVlZ7LnKK7UaA6a4OXMYgJZAwdzAOfFGfbO++5q+igBdfNJmh5LtYMI6te8AlJGBSVierzeStEzTVbIys1EsyNrEMzAljHBxxco2L7enNmz4xciRNCQ/za5xPmhf8nOoZTIalBziM52DGH6rFzUEBVsqez1U2U4ajVzdSIudOlku4w63YnClHeGNu9AdHJjR7PbIHwui17aGKM/l/Qv/LOWWo+nfO1hbCl0fGZwVkl8p4yR3WM73OWEHn1f+Uc4cWAUDZ/ZDPE0qyA/HAnSA6dfzY66y2evjRBeekA4zcxgmc7Q/2XfKHDYMEKTNkgdO6UAFoUqW4BiyF36FcS1ccjUok= root@DESKTOP-40EVMS3"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost"
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC6TOSFZ+P0oWTa9U3fX/L9c3btv/lCgzPrwKu621aLDjSbWbaddGhAXQtJvl7GJvs7QN52z+icftK94gdeyTbZyzQtY6JNUVmUs5EHlZlYTkAYSFN/rkn6N7/n9aYRN+vd8r0B4IrP5gTPtGglLD16dfukpOgwtQj/eK6tqZpVlZ7LnKK7UaA6a4OXMYgJZAwdzAOfFGfbO++5q+igBdfNJmh5LtYMI6te8AlJGBSVierzeStEzTVbIys1EsyNrEMzAljHBxxco2L7enNmz4xciRNCQ/za5xPmhf8nOoZTIalBziM52DGH6rFzUEBVsqez1U2U4ajVzdSIudOlku4w63YnClHeGNu9AdHJjR7PbIHwui17aGKM/l/Qv/LOWWo+nfO1hbCl0fGZwVkl8p4yR3WM73OWEHn1f+Uc4cWAUDZ/ZDPE0qyA/HAnSA6dfzY66y2evjRBeekA4zcxgmc7Q/2XfKHDYMEKTNkgdO6UAFoUqW4BiyF36FcS1ccjUok= root@DESKTOP-40EVMS3" # desktop
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhbz4AlnRrRNvUwlYd5siMTuvgvSwlJ21Tq54OA20ID reudy@DESKTOP-40EVMS3"
-      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQD0mitcnuzNWof+RbTIoxDaXonU6yk+i6kpA4lIdI5fE6fzLCOGia5q4t1qen7Lhj1RMuJRqg5R8GeYmAW3tx2Uo3mqnQLJY227xs2FJU5ygn8JW1Uivp6sCJO5yzCHv8JYy9ala+eHlmppmjBo+NnU2mNlPfM5pNKef/srz5jmkeD+73rUim/1KSCZ3yOzSzc1jf7vNkxXAgDREzbmX/sqIrhG2DxjGAaX6SJjh0lh9OF6m1lAkEGq39h3WS7UKAsP3Z2OOSfEKwAefYvijIoWpL5+XGas3p7mhBG9ZDATJVcUHD/tg7XC4QOU8rYTjuP2/ECFS37q4+OCCJlyBRY46AS4ohKDs9iF8z9IjI3G2P6nTOeIySL84kKGI3ufcvBtUpITKWF4rwLE2R4WVG3SOMSCizFJZtpijVOJJulJUYwIyx0khSGpg3cL2LePyJn23FMlaG6w03H0ngdckGxLuvd+H0D12YVa0990hYaquzXPfMsSUy5T9ZievsVu6jU= reudy@Reudy"
       "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICKwpcTESCEAiQ+/c8bM9Y2b53nCCl3qFI5KRuEkR+Ya jacob@DESKTOP-40EVMS3"
-      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY+AJwXxv/kv0LvZLWPfjxbG3jsjfrtCyPzhXYGKttK reudy-book@fedora"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost" # termux-phone
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY+AJwXxv/kv0LvZLWPfjxbG3jsjfrtCyPzhXYGKttK reudy-book@fedora" # surface-fedora
     ];
   };
 

flake.nix

@@ -34,6 +34,8 @@
           ./panel.nix
           ./caddy.nix
           ./authelia.nix
+          ./nextcloud.nix
+          ./forgejo.nix
           ./containers/hello.nix
           agenix.nixosModules.default
 

forgejo.nix

@@ -0,0 +1,42 @@
+{ config, ... }:
+let
+  domain = "git.srazka.com";
+  sshPort = 14922;
+in
+{
+  services.forgejo = {
+    enable = true;
+
+    # SQLite is plenty for a single-user VPS, same as Nextcloud/Authelia.
+    database.type = "sqlite3";
+
+    # Git LFS support for large files.
+    lfs.enable = true;
+
+    settings = {
+      server = {
+        DOMAIN = domain;
+        ROOT_URL = "https://${domain}/";
+
+        # Caddy terminates TLS and proxies to this; not reachable from outside.
+        HTTP_ADDR = "127.0.0.1";
+        HTTP_PORT = 14921;
+
+        # Forgejo's built-in SSH server, separate from the system sshd (which
+        # only allows 'reudy' on 14902). Clone URLs look like:
+        #   ssh://git@git.srazka.com:14922/<user>/<repo>.git
+        START_SSH_SERVER = true;
+        SSH_PORT = sshPort;
+        SSH_LISTEN_PORT = sshPort;
+        BUILTIN_SSH_SERVER_USER = "git";
+      };
+
+      # Private instance — create accounts with the admin CLI instead.
+      service.DISABLE_REGISTRATION = true;
+
+      session.COOKIE_SECURE = true;
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ sshPort ];
+}

nextcloud.nix

@@ -0,0 +1,53 @@
+{ config, pkgs, ... }:
+
+{
+  # Admin password is managed by agenix.
+  # Create secrets/nextcloud-admin-pass.age and add it to secrets.nix,
+  # then run: agenix -e secrets/nextcloud-admin-pass.age
+  age.secrets."nextcloud-admin-pass" = {
+    file = ./secrets/nextcloud-admin-pass.age;
+    owner = "nextcloud";
+    group = "nextcloud";
+    mode = "0400";
+  };
+
+  services.nextcloud = {
+    enable = true;
+    package = pkgs.nextcloud33;
+
+    hostName = "nextcloud.srazka.com";
+    https = true;
+
+    config = {
+      adminuser = "admin-reudy";
+      adminpassFile = config.age.secrets."nextcloud-admin-pass".path;
+      dbtype = "sqlite";
+    };
+
+    # Tell Nextcloud it's behind a trusted reverse proxy.
+    settings = {
+      trusted_proxies = [ "127.0.0.1" ];
+      overwriteprotocol = "https";
+      overwritehost = "nextcloud.srazka.com";
+      default_phone_region = "NL";
+    };
+  };
+
+  # Let Caddy handle TLS termination; nginx only listens on localhost.
+  # The nextcloud module creates the virtualhost at hostName; we override
+  # its listen address here.
+  services.nginx.virtualHosts.${config.services.nextcloud.hostName}.listen = [
+    {
+      addr = "127.0.0.1";
+      port = 8081;
+    }
+  ];
+
+  # The cron timer can fire before nextcloud-setup.service has finished on
+  # first boot, causing a "Not installed" failure. Make the cron service wait
+  # for setup to complete before it's allowed to run.
+  systemd.services.nextcloud-cron = {
+    after = [ "nextcloud-setup.service" ];
+    requires = [ "nextcloud-setup.service" ];
+  };
+}

secrets.nix

@@ -2,7 +2,8 @@ let
   wsl-desktop = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPhbz4AlnRrRNvUwlYd5siMTuvgvSwlJ21Tq54OA20ID reudy@DESKTOP-40EVMS3";
   termux-phone = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJahgKnADam4PGc9TiANkWGx09uNuS42tllj70UuyzPf u0_a279@localhost";
   bash-nixos = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAP6gemgKZVguFi6Diif+dBbMAZQupimeV9OQuUotlw vps-manual";
-  users = [ wsl-desktop termux-phone bash-nixos ];
+  reudy-book = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDY+AJwXxv/kv0LvZLWPfjxbG3jsjfrtCyPzhXYGKttK reudy-book@fedora";
+  users = [ wsl-desktop termux-phone bash-nixos reudy-book ];
 
   nixos-vps = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINjPVQpFlKGbDNqOVvKAFRExKHAAkKSAqKabDSMtJsth";
   systems = [ nixos-vps ];
@@ -16,4 +17,7 @@ in
   "secrets/authelia-session-secret.age".publicKeys = users ++ systems;
   # The hashed users database (contains bcrypt-hashed passwords)
   "secrets/authelia-users.age".publicKeys         = users ++ systems;
+
+  # Nextcloud admin password (plaintext, read by the nextcloud service)
+  "secrets/nextcloud-admin-pass.age".publicKeys   = users ++ systems;
 }

secrets/authelia-jwt-secret.age

@@ -1,11 +1,14 @@
 age-encryption.org/v1
--> ssh-ed25519 Ol8kbg zksXMifeU7LyTKz1oQ1Qj+/U8FJUrvuRKqpQIK82TGo
-GCsLKn6A2exjSLRLsUmF6+Loa7IGvTLnPG9Jr/A0yM8
--> ssh-ed25519 QGvsHg MzWMzGsdlyvdAKkXHPesGT+H5C2sCXokpQyIvr4xrHc
-LhGNtbBQNVWyz4WAIEYIw8J812me7qBE0xjlWk8N58k
--> ssh-ed25519 yjVKVA 5rTOZYgaA/MMuoFmiLJo2dbuw2ZdRkrJ2fYXHjd0xQI
-M0NEgt9CwRQDWQgXSU7Ef4UP2wLoe/RAu1uJxQGH1ws
--> ssh-ed25519 4XPa+g hLGxBVCTB/je9yQrjPNZaJYRqlJrabsFQT8BQzw8d3Q
-qpyMa38v48SzATy1vUVzccKPhPcqV6BgnkyiwBDOiEI
---- 6Ft39sS5aV9B5pyMX7yr6FH19M2uW8j3AcN86LsVztg
-Ïe„ÖÂÍÑ?CkgÛ—BÜu¼ið"úò§‹;.뜰.:§GÓJB/¡aŽàY©aïêb=…]°U(=|S×ððY¥Ä×ìfV7GùB¤zÁ 7ñ®÷FšJÔGK«ƒÎg_î_Ë
C­´¿{•Ën²
U¨}n·
+-> ssh-ed25519 Ol8kbg 2wJUE7haViW3E1CSSv8dsZjsSXszmDFmn+JU6b2zqQ0
+/mdmCA0JTPrN13ES9J6d1e/NP7o3uzdAVDHuLRLbUEw
+-> ssh-ed25519 QGvsHg WbbdMC6coHNQswT+iftkGHI8ztioyOWFVFWrnC4BK3I
+ECBNNcEt5qhaS2l7YJLzt8nahdMn5JYvzB7giEXLog8
+-> ssh-ed25519 yjVKVA sRVRnJy/jj2xMNTtuJJJpvl45EirQZdPNSmm0tQLBjI
+McDk7P8kUSkvb/cfzPvpCsNElvK4px4TY3jT+0005Zo
+-> ssh-ed25519 5jHFSg 8D/T/d4CBLGMy/BOKTrgoRqlYzImChosh6Y5fArwDns
+IPIUX25vNg7iZ7fzP3cv/3uj6iW/KR613KoLglTzHYQ
+-> ssh-ed25519 4XPa+g Qgekfq0nBDZjdx4pe9VlWXrFCcssvwMC+tCnEP142kE
+zZEBinsKM0+b7YpEy7CTsj3MKmuKcS9UmoKJWsE44rs
+--- j9Tg3Skfil0D+wdP/Sg12ES5hiiBeAVHBHy3boWThCc
+ðÙžlé1é¹ÿ0§¸4Äظ¹<>ÐGð¹Û¦~Zr<5A>§¹EÓ.´Î’°<E28099>~ãë—£ôpó@
XOh
]P–UPž¿óŽáö-§¸Cö±ñü£(y€[Ì8ª³Río1¿•vÛ.7téÔ–ínD‰y…@
µÎüÝ–9}s
+š

secrets/authelia-session-secret.age

@@ -1,11 +1,15 @@
 age-encryption.org/v1
--> ssh-ed25519 Ol8kbg PME/VhYsgR6BmtBkayWFiQenodqfOjMGzuLk8UK1RFQ
-zprwLWBvcXwc6mvSiOYDYz0UvCi6V7u7Wfmh6eQ2AlY
--> ssh-ed25519 QGvsHg HR7vnqTjsb46efZd00s7cDlhWz4xe+bpvBEOrAY0o0I
-2T4h8K93osNlOR+4pqSa42LqjTvnNSiJC532Lh2oZI0
--> ssh-ed25519 yjVKVA tcXgP7+G6bfLj85Zx8wpGHD5UqtH9LcV56fHdLA2Ak8
-BZTIikJmI0Qu6MYxM8EiGXFu+MSGC2ZGfhqNf4j0jVc
--> ssh-ed25519 4XPa+g PdwyAoUViWkBiQ4l8mUWH7Elw/KdI2Torjgm72pvWzk
-XanrDZ2NNiU7bBvz3OQdHRh66WAwT0U81QmEXjX9QT8
---- OTl/rm+mZy0LF+O7ff8AeseeacGhRGX+NitEMX7nYDA
-{±v™i»’«¥Óáèž¾et¬Jx¯b€B03jW_K¢|EB7’^ò§ÿ_½Ÿà,Âöû"s”r	GÀ56Q½¤§Úv_¨!$ö®ŸE<C5B8>:ö?ŸC+h¥Öø…šµyÕ¥º“…oÙ›&ýGšH—ÀÆuãX‡å
+-> ssh-ed25519 Ol8kbg xZ+5r1uS7FJi7Oi2yg0QJgsKaXT8rk7coxSH0Ky++Fo
+0MQFruRiO/Pq5HcxdKI8/QF/oy/3Z5hyak/Y/m1od1I
+-> ssh-ed25519 QGvsHg 2tNU/yrDrRBV2R2FWbd1zQqXZaigEat8ChrtGo2fHmU
+oS9aEWiaMg3jDZ6d6iUjblaEEbKLVkqxxqw4gA/8YO0
+-> ssh-ed25519 yjVKVA Dx4Tf4Dhs/kUDC7jhdgZYNxr0pIObGJw/KKJR8luWBc
+07ASNQzRlKzRI1Y4v5qdhxOH8g+Xzi2k51KMmApcTuY
+-> ssh-ed25519 5jHFSg lWVSFCU0xBspN9VYEOcjHvss9HLobGmC6UUh+0Fp7H8
+UH7YQy/pHVYi5N7xiGos6g8cnP5TEhu+QMWju2l63uQ
+-> ssh-ed25519 4XPa+g yaxH6rX1mhaQ00dvLCyjkbJYWjgsHuciP5AvfZab4U4
+Z2eWdeze/Wv+rEbZys5/dL8OeWhO5OkGsofyae82YwU
+--- V+ieHOEeY8PVexEjHETuKFvq4/FSXj4pN0yD7dik7S4
+ê§ÌÏÉ<EFBFBD>ºg2 Qcíá&<26>õw&?\É5%(üa)§´ƒ¬%Ý<>—Ü%—
+ÆÔGvûa
+‚_²©ÊiØלïó}Ö5èÄMÝ‘Òí2’Š“©,³âó'-Ã,¡/hR{²ŸTèD$S¾G-iÙW2,ð’¸ï›‰

secrets/lilsecret.age

@@ -1,11 +1,13 @@
 age-encryption.org/v1
--> ssh-ed25519 Ol8kbg fWu9AFQRAbjt0HMIdT/I5mk8D03yg9awUBT4I40Pel0
-k68FQ2Hdlle23Fr8trCFYV9Si0VKJWm80CkNBLYa4rI
--> ssh-ed25519 QGvsHg qDDe9753l0rVmMcWXwMqtG49zv29lMVVbnttdFP1l30
-bvbtwFqvkrBZl0usEdvq1n0Y1k1UrGdi6paBCJygNAg
--> ssh-ed25519 yjVKVA FRbiN2Ki8UH4nQC8zLyFXszvw7K6r7BI4dhrgqNbAGI
-zXRBQ1e06qFGvDPPqchbIlKs+Rm8+Mz7BmQsx/jobMU
--> ssh-ed25519 4XPa+g Wl+5kuVZDfybb3TA6Rn5bfPS4nS1oLz6m1Oo51UC1Fo
-aDR6bXclTpBa6IWa+yDfCWei/hBq+5NpBINSqKgkx24
---- /vQcwx2JMqdVIM0EVDUfuNWOPiFfXg91WAKvjHrq1xA
-z9Ú¶7ë"D‡|]ÂÐÊޢdžZw­€TE`ùIàOïv­–,DàÍ­RN”¯<15>ÛJ;-AN
+-> ssh-ed25519 Ol8kbg PUbRX+aA8Sp6ZY6NeQmnYDrzoGhLPsJ9Zy9G7t4TPE0
+FS6YUAGwKNdVXnG8K9t3mlRVnM9gFeX+S1TER3NduPY
+-> ssh-ed25519 QGvsHg KXB/Y5/J6Q5TcHjT7yUHHVhNuajbzF/Alk17WZuPcho
+TqwPN/yO/UTEYPELWl8i3XfhI1o5OwRCQF8whnw0ewI
+-> ssh-ed25519 yjVKVA y5yDQ5x+399MpZQL6bzExvs5PI2jvhVXgp14zaVOwSQ
+XuxM98i+jH8ux6UhB9G8qZqpuLnt9dgwf03QOf4p1lQ
+-> ssh-ed25519 5jHFSg MIk2APZ9fGRa/+S6ppT/5MpXgOA8ncqz7Nk9xJvwiDg
+fJrvR79qZTpEhpsj5q2wqRMHUy4xT4CdoAF6fHNGD2A
+-> ssh-ed25519 4XPa+g 0BKeQIajOJ1CCGLjS48PDTxEkAGNWeH6Lwp02Q8scwo
+bGvrxqmMstH8EahbAUwvbuSViZDinjtW5I+3+/4jw8w
+--- rNfyE9cTfN/UbpEkJc7ACmhg/ME/ocVeZll8S+R7Oos
+ó*j<§ùëÅmó¬É]Ž+C\>.ä:—Í_£¶Ž%À¬FèLšÛj¤qt“×Pëig‘nÉ