Move web-service-modules into a separate directory

modules/system/webServices/forgejo/default.nix

@@ -0,0 +1,142 @@
+{
+  config,
+  pkgs,
+  pkgs-unstable,
+  lib,
+  ...
+}:
+let
+  cfg = config.custom.services.forgejo;
+
+  pinnedVersion = "12.0.4";
+in
+{
+  options.custom.services.forgejo = {
+    enable = lib.mkEnableOption "";
+    domain = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      default = "";
+    };
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 3003;
+    };
+    doBackups = lib.mkEnableOption "";
+  };
+
+  config = lib.mkIf cfg.enable {
+    warnings = lib.optional (
+      (lib.versionAtLeast pkgs.forgejo.version pinnedVersion) && (pkgs.forgejo.version != pinnedVersion)
+    ) "TODO: Use forgejo package from stable nixpkgs";
+
+    meta = {
+      domains.list = [ cfg.domain ];
+      ports.tcp.list = [ cfg.port ];
+    };
+
+    sops.secrets."forgejo/admin-password" = {
+      owner = config.users.users.git.name;
+      restartUnits = [ "forgejo.service" ];
+    };
+
+    users = {
+      users.git = {
+        isSystemUser = true;
+        useDefaultShell = true;
+        group = config.users.groups.git.name;
+        home = config.services.forgejo.stateDir;
+      };
+      groups.git = { };
+    };
+
+    services.forgejo = {
+      enable = true;
+      package = pkgs-unstable.forgejo.overrideAttrs {
+        version = pinnedVersion;
+        src = pkgs.fetchFromGitea {
+          domain = "codeberg.org";
+          owner = "forgejo";
+          repo = "forgejo";
+          rev = "refs/tags/v${pinnedVersion}";
+          hash = "sha256-g6PNJYiGR7tUpurVL1gvGzJzDoMCLmkGiLLsSZfkbYQ=";
+        };
+      };
+
+      user = "git";
+      group = "git";
+
+      lfs.enable = true;
+      settings = {
+        server = {
+          DOMAIN = cfg.domain;
+          ROOT_URL = "https://${cfg.domain}/";
+          HTTP_PORT = cfg.port;
+          LANDING_PAGE = "/SebastianStork";
+        };
+        service.DISABLE_REGISTRATION = true;
+        session.PROVIDER = "db";
+        mirror.DEFAULT_INTERVAL = "1h";
+        other = {
+          SHOW_FOOTER_VERSION = false;
+          SHOW_FOOTER_TEMPLATE_LOAD_TIME = false;
+          SHOW_FOOTER_POWERED_BY = false;
+        };
+
+        cron.ENABLED = true;
+        "cron.git_gc_repos".ENABLED = true;
+
+        repository.ENABLE_PUSH_CREATE_USER = true;
+
+        # https://forgejo.org/docs/latest/admin/recommendations
+        database.SQLITE_JOURNAL_MODE = "WAL";
+        cache = {
+          ADAPTER = "twoqueue";
+          HOST = lib.strings.toJSON {
+            size = 100;
+            recent_ratio = 0.25;
+            ghost_ratio = 0.5;
+          };
+        };
+        "repository.signing".DEFAULT_TRUST_MODEL = "committer";
+        security.LOGIN_REMEMBER_DAYS = 365;
+      };
+    };
+
+    systemd.services.forgejo.preStart =
+      let
+        userCmd = "${lib.getExe config.services.forgejo.package} admin user";
+      in
+      ''
+        username="SebastianStork"
+        password="$(cat ${config.sops.secrets."forgejo/admin-password".path})"
+
+        create_user() {
+          ${userCmd} create \
+            --username "$username" \
+            --password "$password" \
+            --email "sebastian.stork@pm.me" \
+            --admin
+        }
+
+        reset_password() {
+          ${userCmd} change-password \
+            --username "$username" \
+            --password "$password" \
+            --must-change-password=false
+        }
+
+        if ! create_user; then
+          reset_password
+        fi
+      '';
+
+    custom = {
+      services.resticBackups.forgejo = lib.mkIf cfg.doBackups {
+        conflictingService = "forgejo.service";
+        paths = [ config.services.forgejo.stateDir ];
+      };
+
+      persist.directories = [ config.services.forgejo.stateDir ];
+    };
+  };
+}

modules/system/webServices/forgejo/ssh.nix

@@ -0,0 +1,31 @@
+{ config, lib, ... }:
+let
+  cfg = config.custom.services.forgejo.ssh;
+in
+{
+  options.custom.services.forgejo.ssh = {
+    enable = lib.mkEnableOption "";
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 22;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    meta.ports.tcp.list = [ cfg.port ];
+
+    services.forgejo.settings.server.SSH_PORT = cfg.port;
+
+    services.openssh = {
+      enable = true;
+      ports = lib.mkForce [ cfg.port ];
+      authorizedKeysFiles = lib.mkForce [ "${config.services.forgejo.stateDir}/.ssh/authorized_keys" ];
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "no";
+        AllowUsers = [ config.services.forgejo.user ];
+      };
+    };
+  };
+}