0d05af87c8
Forgejo currently lives on pinix; a full pinix outage (8h on 2026-07-31)
takes git.0ff.space down with it. This wires up the blunix side of the
move (docs/roadmap.md, docs/intent/forgejo-umzug-blunix.md): revives the
long-stalled blunix forgejo.nix draft with the full pinix feature set
(branding, DISABLE_ORGANIZATION_CREATION, webhook allowlist), points
Traefik at it locally instead of over the Tailnet, drops the now-unneeded
SSH TCP passthrough (Forgejo binds tailnetIPs.blunix:2222 directly), and
enables the already-prepared AdGuard rewrite for git.${domain}.
Actual data cutover (stop pinix's forgejo, rsync /var/lib/forgejo, fix
webhook target URLs and git remotes) happens next as a separate step
with a short maintenance window.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WhZjZY1sbjyRaMKAL3ekt1
42 lines
1.1 KiB
Nix
42 lines
1.1 KiB
Nix
{config, ...}:
|
|
{
|
|
services.traefik.dynamicConfigOptions = {
|
|
http = {
|
|
middlewares = {
|
|
large-bodies = {
|
|
buffering = {
|
|
maxRequestBodyBytes = 536870912;
|
|
};
|
|
};
|
|
};
|
|
|
|
routers = {
|
|
forgejo = {
|
|
rule = "Host(`git.${config.domain}`)";
|
|
tls = {
|
|
certResolver = "cloudflare";
|
|
};
|
|
service = "forgejo";
|
|
middlewares = [ "large-bodies" ];
|
|
# Public (websecure) and Tailnet-local (web-internal, once the
|
|
# AdGuard rewrite for git.${config.domain} is enabled) -- Forgejo
|
|
# stays reachable at the same domain for external contributors
|
|
# while Tailnet clients get routed to it without leaving blunix.
|
|
entryPoints = [ "websecure" "web-internal" ];
|
|
};
|
|
};
|
|
|
|
services = {
|
|
forgejo = {
|
|
loadBalancer = {
|
|
servers = [
|
|
# Forgejo now runs locally on blunix, co-located with Traefik.
|
|
{ url = "http://127.0.0.1:3000/"; }
|
|
];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|
|
|