forked from lukas/nixos-config
609c27ce15
Source now lives in lukas/calendar-web instead of this flake, matching the website/dashboard pattern: pinix checks it out at /var/www/calendar-web, nginx serves the dist/ output directly, and a new gitpull-calendar-web webhook hook does `git pull && npm ci && npm run build` (esbuild) on push. Frontend/style-only changes no longer need a nixos-rebuild. - webhook.nix: new hook + build script - packages.nix: add nodejs (npm needed for the build script) - forgejo.nix: enable ENABLE_PUSH_CREATE_USER, needed to create the new repo by pushing to it rather than via the web UI - web.nix: nginx root points at /var/www/calendar-web/dist - README.md: document the new deploy path Still needs a Forgejo-side webhook added manually in the calendar-web repo settings (no API token available to script it): target http://127.0.0.1:9000/hooks/gitpull-calendar-web, push events on dev.
68 lines
3 KiB
Nix
68 lines
3 KiB
Nix
{ config, ...}:
|
|
{
|
|
# Forgejo's embedded SSH server, reached over loopback by the auto-pull
|
|
# checkouts under /var/www/ (website, dashboard). Declared so a fresh
|
|
# `drone` home doesn't need an imperative accept-on-first-use step.
|
|
programs.ssh.knownHosts.forgejo-loopback = {
|
|
hostNames = [ "[127.0.0.1]:2222" ];
|
|
publicKey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCtkarE/dXAdrXkPhYIl+takKG1YPtAOYwLlD1YIB/Dep7LSvpyWv8pyC5bXajuIzjEjXl5e8/XtJhROH9X5OwqBZygwiDjOaZR7IWu2qAHQBeQSIP2hLCm5LndCsnYgfCaIZe0ZhFqC7byiZlPH3hLYm7aYNeQiJy9eBh9PLdyfcW2oxhq9Fc8PXfpfTbPUgkCDWn0MYEfiRT2+839xYSHdIeAFSmLohaV6ptXjCLAes32HFZE13CadmhfEXY4DMi3V7RUTQeUTuOohjZFFE1RvKGEpaxIRU/Kf1tDK5rRrbCFdQCjMzDwndKewpujSIBVe0emjHv/hiIacHduYz3GrqQia95biFilDJuvKbUlr9nVQor6GD4+yK0Uy2BraFLUA6akp8M7Ma9Zi4gK+UjLIpDKxwfncpLCk4KcGbwsz5acxL8bpTqGw4yZU87tKRxN9NOThHROGqZfMHLfyFH0uXalwHNAqx6dcv706+LAkCR17F8lZ69NRW8Jj7WbPoCRgIl1Ea8D4ce/Hf6enEm8d3CGK3HE+EcN8OUnhLuh4XcrSqmMtBIiW9iu7okD7a6wsOautZzioRuXt/ZS92fPe6CpaQZCWtxr2gr9HtGGn9zrY6spNM5nIf597jaYMyET1EPyPdNyJuVEnJHkILend4xVnWTIyS2mx1QKOuAdCQ==";
|
|
};
|
|
|
|
services.forgejo= {
|
|
enable = true;
|
|
lfs.enable = true;
|
|
dump.enable = true;
|
|
settings = {
|
|
service = {
|
|
ENABLE_INTERNAL_SIGNIN = true;
|
|
DISABLE_REGISTRATION = false;
|
|
ALLOW_ONLY_INTERNAL_REGISTRATION = false;
|
|
ENABLE_REGISTRATION = true;
|
|
ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
|
|
#ENABLE_AUTO_REGISTRATION=true;
|
|
};
|
|
log.level = "Debug";
|
|
repository = {
|
|
ENABLE_PUSH_CREATE_USER = true;
|
|
};
|
|
pwa = {
|
|
ENABLE_STANDALONE = true;
|
|
};
|
|
server = {
|
|
START_SSH_SERVER = true;
|
|
SSH_PORT = 2222;
|
|
HTTP_ADDR = "0.0.0.0";
|
|
HTTP_PORT = 3000;
|
|
DOMAIN = "git.${config.domain}";
|
|
ROOT_URL = "https://git.${config.domain}/"; # can i have two ROOT_URL ?
|
|
# PROTOCOL = "http";
|
|
TRUSTED_PROXIES = config.tailnetIPs.blunix;
|
|
LANDING_PAGE = "login";
|
|
};
|
|
session = {
|
|
PROVIDER = "file";
|
|
COOKIE_SECURE = true;
|
|
};
|
|
security = {
|
|
LOGIN_REMEMBER_DAYS = 10;
|
|
REVERSE_PROXY_TRUSTED_PROXIES = config.tailnetIPs.blunix;
|
|
};
|
|
webhook.ALLOWED_HOST_LIST = "external,127.0.0.1";
|
|
oauth2_client = {
|
|
# Never use auto account linking with this, otherwise users cannot change
|
|
# their new user name and they could potentially overtake other users accounts
|
|
# by setting their email address to an existing account.
|
|
# With "login" linking the user must choose a non-existing username first or login
|
|
# with the existing account to link.
|
|
ACCOUNT_LINKING = "login";
|
|
USERNAME = "nickname";
|
|
# This does not mean that you cannot register via oauth, but just that there should
|
|
# be a confirmation dialog shown to the user before the account is actually created.
|
|
# This dialog allows changing user name and email address before creating the account.
|
|
ENABLE_AUTO_REGISTRATION = false;
|
|
REGISTER_EMAIL_CONFIRM = false;
|
|
UPDATE_AVATAR = true;
|
|
};
|
|
};
|
|
};
|
|
}
|