update gitea to be private

homelab-services/gitea/k3s/deployment.yaml

@@ -52,6 +52,9 @@ spec:
             - name: GITEA__server__SSH_PORT
               value: "30222"
 
+            - name: GITEA__repository__MAX_CREATION_LIMIT
+              value: "0"
+
           volumeMounts:
             - name: gitea-data
               mountPath: /var/lib/gitea

nixos/configuration.nix

@@ -110,9 +110,11 @@
     disable = [ "traefik" ];
     role = "server";
 
+    # only enable the service on k3s when roughly finalized
+    # Until then use a vm, as k3s is persisted
     extraFlags = [
       "--data-dir=/var/lib/rancher/k3s"
-      "--cluster-cidr 10.42.0.0/20" # allow this subnet to connect to psql
+      "--cluster-cidr 10.42.0.0/20"
     ];
   };
 
@@ -141,34 +143,14 @@
   #           BLOG SERVICE           #
   # ================================ #
 
-  # Fullstack sourcecode
+  # fullstack code. Dev hosted via VMs (incus)
 
-  /*
+  # ================================ #
-    MINIO DEPRECATED
+  #         END BLOG SERVICE         #
-    services.minio-service = {
+  # ================================ #
-      enable = true;
+  # ================================ #
-
+  #           PSQL SERVICE           #
-      # Persist (or don't) the data inside of database
+  # ================================ #
-      dataDir = "/var/data/minio";
-      credentialsFile = config.sops.secrets."minio-credentials".path;
-
-      dataPort = 9000; # S3 API access
-      consolePort = 9001; # Admin console access
-
-      bootstrap-minio = {
-        enable = true;
-        environments = [
-          "dev"
-          "prod"
-        ];
-      };
-
-      default-nginx = {
-        enable = true;
-        hostname = "imgs.roypository.com";
-      };
-    };
-  */
 
   # Postgresql/postgrest for row storage (not on k3s)
   services.postgresql-db = {
@@ -177,16 +159,15 @@
     port = 5432;
     credentialsFile = config.sops.secrets."postgresql-credentials".path;
     databases = [
-      "rdblog"
       "gitea"
     ];
     ipMasks = [
-      "10.42.0.0/20" # k3s cluster mask
+      "10.42.0.0/20" # k3s pod mask
     ];
   };
 
   # ================================ #
-  #         END BLOG SERVICE         #
+  #         END PSQL SERVICE         #
   # ================================ #
 
   # ================================ #
@@ -238,6 +219,10 @@
     };
   };
 
+  # Setup Incus daemon on boot
+  # Init with `incus admin init --minimal`
+  virtualisation.incus.enable = true;
+
   networking = {
     hostName = meta.hostname;
     hostId = meta.hostId;
@@ -246,6 +231,7 @@
       "1.1.1.1"
       "1.0.0.1"
     ];
+    nftables.enable = true;
 
     firewall = {
       enable = true;
@@ -255,6 +241,9 @@
         443
         6443 # k3s
       ];
+
+      # Trust all incusVMs (on this network interface)
+      trustedInterfaces = [ "incusbr0" ];
     };
 
     interfaces.eth0.ipv4.addresses = [
@@ -268,40 +257,16 @@
   # Set your time zone.
   time.timeZone = "America/Chicago";
 
-  # Configure network proxy if necessary
-  # networking.proxy.default = "http://user:password@proxy:port/";
-  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
-
-  # Select internationalisation properties.
-  # i18n.defaultLocale = "en_US.UTF-8";
-  # console = {
-  #   font = "Lat2-Terminus16";
-  #   keyMap = "us";
-  #   useXkbConfig = true; # use xkb.options in tty.
-  # };
-
-  # Enable the X11 windowing system.
-  # services.xserver.enable = true;
-
-  # Configure keymap in X11
-  # services.xserver.xkb.layout = "us";
-  # services.xserver.xkb.options = "eurosign:e,caps:escape";
-
   # Enable CUPS to print documents.
   services.printing.enable = true;
 
-  # Enable sound.
-  # hardware.pulseaudio.enable = true;
-  # OR
-  # services.pipewire = {
-  #   enable = true;
-  #   pulse.enable = true;
-  # };
-
   # Define a user account. Don't forget to set a password with ‘passwd’.
   users.users.roy = {
     isNormalUser = true;
-    extraGroups = [ "wheel" ];
+    extraGroups = [
+      "wheel"
+      "incus-admin"
+    ];
     hashedPassword = "$y$j9T$qHYfvijvytC69cjEWTHYA/$YF6ig1hNvkTQi0UffZP1dpilS.8O28qEY4bfdvRTXYA";
     # laptop and desktop
     openssh.authorizedKeys.keys = [
@@ -328,8 +293,7 @@
     ];
   };
 
-  # List packages installed in system profile. To search, run:
+  # List packages installed in system profile
-  # $ nix search wget
   environment.systemPackages = with pkgs; [
     curl
     kitty
@@ -358,14 +322,6 @@
     EDITOR = "nvim";
   };
 
-  # Some programs need SUID wrappers, can be configured further or are
-  # started in user sessions.
-  # programs.mtr.enable = true;
-  # programs.gnupg.agent = {
-  #   enable = true;
-  #   enableSSHSupport = true;
-  # };
-
   # List services that you want to enable:
   services.openssh = {
     enable = true;

nixos/secrets/gitea.yaml

@@ -1,4 +1,4 @@
-credentials: ENC[AES256_GCM,data:CG7CVSOP/rS1eMuaMx6DnSSKrauugLldcrlklpe3TQ8zlsXA1TeFiNywDwPWZ7Oa0i99ZFS1EaWhca/E/X93yzNO0TQ=,iv:/qd/vCo2tMuzno+Gwa/KAnfiSTfFyjs5iggRwE931Ns=,tag:7Ae3+9pCqIxKFaJQxFP7Xw==,type:str]
+credentials: ENC[AES256_GCM,data:eNpZuaKurue1WN+RtYPr2GDY/Iyg13zrI2Mdi32XbJXzTdtdpXyvIheRAUE6Wi6hLFEEhDL7kgLyLns+6jhAqgmFYgZ/kqY8PlOS+T+ooyZ+wm0aM/hYhZ46OKqYgETOa+kFeDWxS7AZiLB48/a4gT8jzAb1cSp8t2Fpkw==,iv:CpDTo24HYIsWoy/yFglSmk2WBD8c6RtxOSmlDsqKF8Q=,tag:I8LdMKhTZccyCv3g12HoIg==,type:str]
 sops:
     age:
         - enc: |
@@ -37,7 +37,7 @@ sops:
             o+m9XdwX6u7OaazWx7J9tWOS+O1sJoNGMpAj/K5N6OjoNGT4Lu8t+w==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-09-12T21:07:44Z"
+    lastmodified: "2026-09-12T21:33:27Z"
-    mac: ENC[AES256_GCM,data:pUxZDthG6eK2LyiQhc3dp6TONKf+URP1JDUn6T9hjetToY9/uWXXBnpjJL1LKdsml/F/4DS9zw7Vw92vlrcYmlO8stCbC0Bbhb/4oevA1BxqXGJw/nPKwNaapy3Q7sQ8+xKXlJbOEqDC97yPiEUY6RsKErvfFo+x22wUw1j0ges=,iv:Amqkx9cRgZUCHeFk12Qf0SE07uqpR1cRy7t4mIFWRUI=,tag:Le+7hsr28EgZR+rFvVCVVg==,type:str]
+    mac: ENC[AES256_GCM,data:rEk6x8vbIRry7cJ8Ci15kg1bR/F2oUm7rc2kavjlUM+1b2idgn4zgD6Msa/8I04TyJiDjAmDsHqKi/fLTBIk0lvfbFpPXGvId6ICKKmi1qMYvavJYkAY4Q/mJuY9rnwZVhnu3HHuvLTrkF50oNKkoxE99RQZ6fS9ItNGixZwnNA=,iv:tHh2Q7bh02xL7yCcTDWdbafWKQIfA11UQNCDnyT/arg=,tag:RpagdZ2oOYl5j86z5JfguQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3

nixos/secrets/psql.yaml

@@ -1,4 +1,4 @@
-credentials: ENC[AES256_GCM,data:No2VCubcIimFbkhwnD4sGuaR5OehpxvOj5Ln7bXydTrn6RcgrgkmHYBHAMajcL13XHom4IY30fBpiNQ=,iv:0UMfuCJyuXkO1vBrH2d7UtV5qZJatdef8C8RskrlQ74=,tag:G7zcM1J1G53nH5O9X2PMoA==,type:str]
+credentials: ENC[AES256_GCM,data:nTeaDgmVMhbN3gsOaVcS7nYckcEv4RRWtLC7+LSqDL/m5/nJ3ALstrKZnXfL7gGO2GMU2SD5tDoAjOXQpPXR3V+smASHYmwgxs1v+QwEj+qh1OAotA==,iv:nWuXavCNi/MQFoWvsu48M2/7VQHE8CgTLfqdW66ecO0=,tag:LkaUhCvYlHdSmevTGUGSZw==,type:str]
 sops:
     age:
         - enc: |
@@ -37,7 +37,7 @@ sops:
             1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-09-12T19:58:55Z"
+    lastmodified: "2026-09-12T21:33:12Z"
-    mac: ENC[AES256_GCM,data:zplquNejJ1M8dBYF7h2yPmHzO2gFDPr3VFCLEszJE/0LxBQmon0/IaOUrvbShIgkOh7eq06vrNSpp42/r37sv1Uoy4j/E0OLCtB8NYEsP5aW5joSKJZlzdQJUEbB38Zf7vM7FFNKBYeAtJflhbI/A3qyq7Xs4qTKWj8IJY4nx78=,iv:fQJfqsQcUVPB/Q6HxdG8gM1IDTvjQniIqDs+dFvGt7o=,tag:eTllYOsgCtCsQCBxr3pbpw==,type:str]
+    mac: ENC[AES256_GCM,data:56iH/eMqvlkysV6sEET7t3TKgCEO6x1y67PJ6Iv6numeUHDFmj2qja9FW2VOgELGyXVZFb0CbKq6GxPRtP1RBRX0yxM0GIuccVL9aJ/GfoB2wtOqr6GOKMXjmLVpXOgwy6SskNYD8S5IHkRgq7mop3ffHXkxA035cD4RQ4XyhLA=,iv:J+VRkeVNDhpVBQuKEflhwgNzmcE1ndRsflOHsP26ZdM=,tag:8kyC71Og0VWGhwLqa/jPUA==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3