add gitea flake

homelab-services/gitea/flake.nix

@@ -0,0 +1,124 @@
+{
+  description = "Flake configured to render and deploy a k3s folder for homelab gitea";
+
+  input = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
+  };
+
+  outputs =
+    { ... }:
+    {
+      nixosModules.gitea =
+        {
+          config,
+          lib,
+          pkgs,
+          ...
+        }:
+        let
+          k3sDir = ./k3s;
+          opts = config.services.gitea;
+        in
+        {
+          options.services.gitea = {
+            enable = lib.mkEnableOption "Run Gitea in k3s";
+
+            default-nginx = {
+              enable = lib.mkEnableOption "Enable nginx reverse proxy.";
+              hostname = lib.mkOption {
+                type = lib.types.str;
+                default = "localhost";
+                description = "Hostname for reverse proxy";
+              };
+            };
+
+            database-hostname = lib.mkOption {
+              type = lib.types.str;
+              description = ''
+                hostname of external db (192.168.x.x:5432). 
+                On my machine will be semi-secret ip addr + whatever port.
+              '';
+            };
+
+            credentialsFile = lib.mkOption {
+              type = lib.types.path;
+              description = ''
+                File containing needed credentials.
+              '';
+            };
+          };
+
+          config = lib.mkIf opts.enable {
+            systemd.services.gitea = {
+              description = "oneshot apply service to k3s";
+              after = [ "k3s.service" ];
+              wantedBy = [ "multi-user.target" ];
+
+              serviceConfig = {
+                Type = "oneshot";
+                ExecStart = pkgs.writeShellScript "start-gitea" ''
+                  echo "Creating temp dir"
+                  kubernetes_config=$(mktemp -d)
+
+                  echo "Generating templated files"
+                  gomplate=${pkgs.gomplate}/bin/gomplate
+                  echo "${opts.database-hostname}" | $gomplate \
+                    --input-dir=${k3sDir} \
+                    --output-dir=$kubernetes_config \
+                    --datasource credentials=file://${opts.credentialsFile}?type=application/x-env
+                    --datasource dbhostname=stdin:
+
+                  echo "Applying k3s config"
+                  kubectl=${pkgs.kubectl}/bin/kubectl
+                  $kubectl \
+                    --kubeconfig=/etc/rancher/k3s/k3s.yaml \
+                    apply -k $kubernetes_config
+                '';
+
+                # Only user/group that has access to kubectl apply
+                User = "root";
+                Group = "root";
+              };
+            };
+
+            services.nginx = lib.mkIf opts.default-nginx.enable {
+              enable = true;
+
+              virtualHosts.${opts.default-nginx.hostname} = {
+                forceSSL = true;
+
+                # Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period)
+                useACMEHost =
+                  let
+                    b = builtins;
+                    s = lib.strings;
+                    fl = s.splitString "." "${opts.default-nginx.hostname}";
+                  in
+                  b.concatStringsSep "." [
+                    (b.elemAt fl (b.length fl - 2))
+                    (b.elemAt fl (b.length fl - 1))
+                  ];
+
+                locations."/" = {
+                  proxyPass = "http://127.0.0.1:30080";
+
+                  extraConfig = ''
+                    proxy_set_header Host $host;
+                    proxy_set_header X-Forwarded-Host $host;
+                    proxy_set_header X-Real-IP $remote_addr;
+                    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+                    proxy_set_header X-Forwarded-Proto $scheme;
+                  '';
+                };
+              };
+            };
+            networking.firewall.allowedTCPPorts = lib.mkIf opts.default-nginx.enable [
+              80
+              443
+              2222
+            ];
+          };
+        };
+    };
+
+}

homelab-services/postgresql-db/flake.nix

@@ -133,21 +133,6 @@
 
                     echo "Bootstrapping PostgreSQL for database: $db"
 
-                    # Create databases if not exists
-                    if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then
-                      echo "$db already exists, skipping creation."
-                    else
-                      echo "Creating database $db"
-                      $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db";"
-                    fi
-
-                    if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then
-                      echo ""$db"_dev already exists, skipping creation."
-                    else
-                      echo "Creating database "$db"_dev"
-                      $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev;"
-                    fi
-
                     # Create users if not exists
                     if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$user_val"; then
                       echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
@@ -163,11 +148,22 @@
                       $psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';"
                     fi
 
-                    # Give users privileges on databases (always)
+                    # Create databases if not exists
-                    $psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db" TO "$user_val";"
+                    if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then
-                    $psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db"_dev TO "$dev_user_val";"
+                      echo "$db already exists, skipping creation."
+                    else
+                      echo "Creating database $db"
+                      $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db" WITH OWNER "$user_val";"
+                    fi
 
-                    # Grant ownership
+                    if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then
+                      echo ""$db"_dev already exists, skipping creation."
+                    else
+                      echo "Creating database "$db"_dev"
+                      $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev WITH OWNER "$dev_user_val";"
+                    fi
+
+                    # Grant ownership (idempotency for weird states)
                     $psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";"
                     $psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";"