WIP: gitea: Use a hardened systemd unit instead of a container

configuration/default.nix

@@ -5,7 +5,6 @@
   ...
 }: {
   imports = [
-    ./services/gitea.nix
     ./services/nextcloud.nix
     ./services/webserver.nix
     ./services/starbound.nix
@@ -81,11 +80,6 @@
       domain = config.services.nginx.domain;
     in {
       "${domain}" = proxyPassToPort 3002 {serverAliases = ["www.${domain}"];};
-      "gitea.${domain}" = proxyPassToPort 3000 {};
-      "nextcloud.${domain}" = {
-        forceSSL = true;
-        enableACME = true;
-      };
     };
   };
 

configuration/services/gitea.nix

@@ -1,48 +1,30 @@
-{config, ...}: {
+{config, ...}: let
-  users = {
+  domain = "gitea.${config.services.nginx.domain}";
-    extraUsers.gitea = {
+in {
-      uid = config.ids.uids.git;
+  services.gitea = {
-      isSystemUser = true;
+    inherit domain;
-      description = "Gitea Service";
+    enable = true;
-      group = config.users.extraGroups.gitea.name;
+
-    };
+    httpAddress = "127.0.0.1";
-    extraGroups.gitea = {gid = config.ids.gids.git;};
+    database.type = "postgres";
+
+    ssh.clonePort = 2222;
+    rootUrl = "https://gitea.tlater.net/";
+    cookieSecure = true;
+
+    appName = "Gitea: Git with a cup of tea";
   };
 
-  virtualisation.pods.gitea = {
+  # Set up SSL
-    hostname = "gitea.tlater.net";
+  services.nginx.virtualHosts."${domain}" = let
-    publish = ["3000:3000" "2221:2221"];
+    inherit (config.services.gitea) httpAddress httpPort;
-    network = "slirp4netns";
+  in {
+    forceSSL = true;
+    enableACME = true;
+    extraConfig = ''
+      add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
+    '';
 
-    containers = {
+    locations."/".proxyPass = "http://${httpAddress}:httpPort";
-      gitea = {
-        image = "gitea/gitea:latest";
-        volumes = ["gitea:/data:Z" "/etc/localtime:/etc/localtime:ro"];
-        dependsOn = ["postgres"];
-
-        environment = {
-          DB_TYPE = "postgres";
-          DB_HOST = "localhost:5432";
-          DB_NAME = "gitea";
-          DB_USER = "gitea";
-
-          USER_UID = toString config.users.extraUsers.gitea.uid;
-          USER_GID = toString config.users.extraGroups.gitea.gid;
-
-          RUN_MODE = "prod";
-          DOMAIN = "gitea.tlater.net";
-          SSH_PORT = "2221";
-        };
-      };
-
-      postgres = {
-        image = "postgres:alpine";
-        environment = {
-          POSTGRES_DB = "gitea";
-          POSTGRES_USER = "gitea";
-        };
-        volumes = ["gitea-postgres-14:/var/lib/postgresql/data"];
-      };
-    };
   };
 }

configuration/services/nextcloud.nix

@@ -5,11 +5,13 @@
 }: let
   inherit (pkgs) fetchNextcloudApp;
   nextcloud = pkgs.nextcloud23;
+  hostName = "nextcloud.${config.services.nginx.domain}"
 in {
   services.nextcloud = {
+    inherit hostName;
+
     package = nextcloud;
     enable = true;
-    hostName = "nextcloud.${config.services.nginx.domain}";
     maxUploadSize = "2G";
     https = true;
 
@@ -32,4 +34,10 @@ in {
 
   # Ensure that this service doesn't start before postgres is ready
   systemd.services.nextcloud-setup.after = ["postgresql.service"];
+
+  # Set up SSL
+  services.nginx.virtualHosts."${hostName}" = {
+    forceSSL = true;
+    enableACME = true;
+  };
 }