Drift/pvv-nixos-config
17
5
Fork 2
Code Issues Pull Requests 9 Actions Wiki Activity

kommode/gitea: make secrets declarative
Some checks failed
Eval nix flake / evals (push) Failing after 0s
Details

Browse Source
This commit is contained in:
Oystein Kristoffer Tveit
2025-08-03 03:39:18 +02:00
parent 0a7f559869
commit 234a7030f0
2 changed files with 25 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
hosts/kommode/services/gitea/default.nix
View File

@@ -11,15 +11,17 @@ in {
./web-secret-provider
];
sops.secrets = {
"gitea/database" = {
owner = "gitea";
group = "gitea";
};
"gitea/email-password" = {
sops.secrets = let
defaultConfig = {
owner = "gitea";
group = "gitea";
};
in {
"gitea/database" = defaultConfig;
"gitea/email-password" = defaultConfig;
"gitea/lfs-jwt-secret" = defaultConfig;
"gitea/oauth2-jwt-secret" = defaultConfig;
"gitea/secret-key" = defaultConfig;
};
services.gitea = {
@@ -45,9 +47,15 @@ in {
ROOT_URL = "https://${domain}/";
PROTOCOL = "http+unix";
SSH_PORT = sshPort;
LANDING_PAGE = "explore";
START_SSH_SERVER = true;
START_LFS_SERVER = true;
LANDING_PAGE = "explore";
LFS_JWT_SECRET = lib.mkForce "";
LFS_JWT_SECRET_URI = config.sops.secrets."gitea/lfs-jwt-secret".path;
};
oauth2 = {
JWT_SECRET = lib.mkForce "";
JWT_SECRET_URI = config.sops.secrets."gitea/oauth2-jwt-secret".path;
};
"git.timeout" = {
MIGRATE = 3600;
@@ -75,6 +83,10 @@ in {
};
admin.DEFAULT_EMAIL_NOTIFICATIONS = "onmention";
session.COOKIE_SECURE = true;
security = {
SECRET_KEY = lib.mkForce "";
SECRET_KEY_PATH = config.sops.secrets."gitea/secret-key".path;
};
database.LOG_SQL = false;
repository = {
PREFERRED_LICENSES = lib.concatStringsSep "," [