From a68ca2df15b1af075e9ca20117785266cfc37239 Mon Sep 17 00:00:00 2001 From: Roy Dumblauskas Date: Sun, 23 Aug 2026 16:40:35 -0500 Subject: [PATCH] add gitea flake --- homelab-services/gitea/flake.nix | 124 +++++++++++++++++++++++ homelab-services/postgresql-db/flake.nix | 36 +++---- 2 files changed, 140 insertions(+), 20 deletions(-) create mode 100644 homelab-services/gitea/flake.nix diff --git a/homelab-services/gitea/flake.nix b/homelab-services/gitea/flake.nix new file mode 100644 index 0000000..c1ae877 --- /dev/null +++ b/homelab-services/gitea/flake.nix @@ -0,0 +1,124 @@ +{ + description = "Flake configured to render and deploy a k3s folder for homelab gitea"; + + input = { + nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05"; + }; + + outputs = + { ... }: + { + nixosModules.gitea = + { + config, + lib, + pkgs, + ... + }: + let + k3sDir = ./k3s; + opts = config.services.gitea; + in + { + options.services.gitea = { + enable = lib.mkEnableOption "Run Gitea in k3s"; + + default-nginx = { + enable = lib.mkEnableOption "Enable nginx reverse proxy."; + hostname = lib.mkOption { + type = lib.types.str; + default = "localhost"; + description = "Hostname for reverse proxy"; + }; + }; + + database-hostname = lib.mkOption { + type = lib.types.str; + description = '' + hostname of external db (192.168.x.x:5432). + On my machine will be semi-secret ip addr + whatever port. + ''; + }; + + credentialsFile = lib.mkOption { + type = lib.types.path; + description = '' + File containing needed credentials. + ''; + }; + }; + + config = lib.mkIf opts.enable { + systemd.services.gitea = { + description = "oneshot apply service to k3s"; + after = [ "k3s.service" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + Type = "oneshot"; + ExecStart = pkgs.writeShellScript "start-gitea" '' + echo "Creating temp dir" + kubernetes_config=$(mktemp -d) + + echo "Generating templated files" + gomplate=${pkgs.gomplate}/bin/gomplate + echo "${opts.database-hostname}" | $gomplate \ + --input-dir=${k3sDir} \ + --output-dir=$kubernetes_config \ + --datasource credentials=file://${opts.credentialsFile}?type=application/x-env + --datasource dbhostname=stdin: + + echo "Applying k3s config" + kubectl=${pkgs.kubectl}/bin/kubectl + $kubectl \ + --kubeconfig=/etc/rancher/k3s/k3s.yaml \ + apply -k $kubernetes_config + ''; + + # Only user/group that has access to kubectl apply + User = "root"; + Group = "root"; + }; + }; + + services.nginx = lib.mkIf opts.default-nginx.enable { + enable = true; + + virtualHosts.${opts.default-nginx.hostname} = { + forceSSL = true; + + # Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period) + useACMEHost = + let + b = builtins; + s = lib.strings; + fl = s.splitString "." "${opts.default-nginx.hostname}"; + in + b.concatStringsSep "." [ + (b.elemAt fl (b.length fl - 2)) + (b.elemAt fl (b.length fl - 1)) + ]; + + locations."/" = { + proxyPass = "http://127.0.0.1:30080"; + + extraConfig = '' + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + ''; + }; + }; + }; + networking.firewall.allowedTCPPorts = lib.mkIf opts.default-nginx.enable [ + 80 + 443 + 2222 + ]; + }; + }; + }; + +} diff --git a/homelab-services/postgresql-db/flake.nix b/homelab-services/postgresql-db/flake.nix index 8e4dfdc..09d539f 100644 --- a/homelab-services/postgresql-db/flake.nix +++ b/homelab-services/postgresql-db/flake.nix @@ -133,21 +133,6 @@ echo "Bootstrapping PostgreSQL for database: $db" - # Create databases if not exists - if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then - echo "$db already exists, skipping creation." - else - echo "Creating database $db" - $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db";" - fi - - if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then - echo ""$db"_dev already exists, skipping creation." - else - echo "Creating database "$db"_dev" - $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev;" - fi - # Create users if not exists if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$user_val"; then echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity" @@ -163,11 +148,22 @@ $psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';" fi - # Give users privileges on databases (always) - $psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db" TO "$user_val";" - $psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db"_dev TO "$dev_user_val";" - - # Grant ownership + # Create databases if not exists + if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then + echo "$db already exists, skipping creation." + else + echo "Creating database $db" + $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db" WITH OWNER "$user_val";" + fi + + if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then + echo ""$db"_dev already exists, skipping creation." + else + echo "Creating database "$db"_dev" + $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev WITH OWNER "$dev_user_val";" + fi + + # Grant ownership (idempotency for weird states) $psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";" $psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";"