add gitea k3s declarations

nixos/configuration.nix

@@ -48,6 +48,14 @@
         owner = "postgres";
         group = "postgres";
       };
+
+      "gitea-credentials" = {
+        sopsFile = ./secrets/gitea.yaml;
+        key = "credentials";
+        format = "yaml";
+        owner = "root";
+        group = "root";
+      };
     };
   };
 
@@ -99,12 +107,32 @@
     enable = true;
     disable = [ "traefik" ];
     role = "server";
+
+    extraFlags = [
+      "--data-dir=/var/lib/rancher/k3s"
+    ];
   };
 
   # ================================ #
   #          END K3S SERVICE         #
   # ================================ #
+  # ================================ #
+  #           GITEA SERVICE          #
+  # ================================ #
 
+  services.gitea = {
+    enable = false;
+    credentialsFile = config.sops.secrets."minio-credentials".path;
+    database-hostname = "127.0.0.1:5432"; # whatever port I host psql on below
+
+    default-nginx = {
+      enable = true;
+      hostname = "roypository.com";
+    };
+  };
+  # ================================ #
+  #           GITEA SERVICE          #
+  # ================================ #
   # ================================ #
   #           BLOG SERVICE           #
   # ================================ #

nixos/flake.nix

@@ -30,6 +30,7 @@
     # minio-service.url = "path:../homelab-services/minio-service";
     mc-service.url = "path:../homelab-services/mc-service";
     postgresql-db.url = "path:../homelab-services/postgresql-db";
+    gitea.url = "path:../homelab-services/gitea";
   };
 
   outputs =
@@ -46,6 +47,7 @@
       nimh-static,
       mc-service,
       postgresql-db,
+      gitea,
     }@inputs:
     let
       nodes = [
@@ -79,6 +81,7 @@
               nimh-static.nixosModules.nimh-static
               mc-service.nixosModules.mc-service
               postgresql-db.nixosModules.postgresql-db
+              gitea.nixosModules.gitea
               home-manager.nixosModules.home-manager
               {
                 home-manager.useGlobalPkgs = true;

nixos/secrets/gitea.yaml

@@ -0,0 +1,43 @@
+credentials: ENC[AES256_GCM,data:oSxjy68PyelfcKJG2JF9jDa0N2UumCTnhUvNULkJJ5YesQGsH4gyIdxXrq7ZKyqjhkB/J5wH01VhmvsgvNnq7A2DmgonDw==,iv:454zX4ZYqrE5b5bYyKLfWu/gKL8OqK4v9BFyU+VV3Bg=,tag:Jl1fN3kLg9Q8PXZQglcR2g==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoOFhEOHBWWmI5YVBBYW1a
+            NzZ5QkxXMVR1TkVmYWRJYStOeElSSWRUWHdzClpDM25wK3d4WmEwbW54L29saGVQ
+            ZXMwMHVaMmtWLzVmVUVNekJ6ZzNacWsKLS0tIHo5cHJhcnJ2WnhUUTFyVlVRVFpI
+            SmNLOHBUZ3AyZVJhM2E1alZNMXJBSjgKXIBghssU7gEbsuNyh1x8iO1xZSKEKpTD
+            JQTLP5PFeLBJcQTRYP9ZapgXJA6ED5gAaD1D1JXvDM6WWeReG0fqNg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4eEtlRmFNVG1zcGo4T3ZJ
+            YkR2Q0p3VnNGRzJ1VEVLTkRON2d2YUdVTEdzCjh1NFdJSVhCUklFU2JCN2ZnRHVV
+            MTJONnYzZG8wRFROcWdaTGNJUmN2Q1kKLS0tIHI5QnJOcWU3ZjhkdFQxV3JtUTFi
+            SkxwMmJNUHRaOGx2VUlOT0trUHA2eW8KCYVHpV6vqSAaECqbJQDvJfA5fvUX9wWn
+            8V0wy+WRWcjcWVkoHiJSp43CAORAicG4exTGRAhAdoTE1ejB1+cneQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3bmJ0endUbnlOMHd4dmlw
+            WE10TXk3VVZHSng2dEI3bWp1alZuK2NMTW5rCmNLTCtzTjJkNVFCWm04eHMxcGtw
+            Zm9ONHdaeERTL05IWXFmMVJyQnBoWjAKLS0tIHNrQUI0Tm1mNXRyRjlXN2xFbUx4
+            dWxZUXVVYVlRc2t4VjdCVEVodzAzc2sKZcyrKOkXbcWDgWL8CLJFL8ESeixrIp6b
+            u91Gy5BfQNOuvNEijr7JhjJi34zTpdfBjHAtCh9RZ0uGjIE4IE/tZQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzd0xHY0EyOGFZNldtUlpV
+            YXAwNmh4d1dnRENPS2Q5Y0ZNZU9VSVN6ZW5ZCmMzZVJ5eEx4UEZMcXJCaE01dzVX
+            UkdYcDFMYXRyL0w2cVo3WUdnakYwaGsKLS0tIHlXVEpXdXlTcXNrc09FWEk1eDFi
+            UTBpc2ZPcmFTeVdIVkcweHdMYmpaaGcKdQpQzuS3h3926/4e4rvp/nGA7dO0kDr1
+            o+m9XdwX6u7OaazWx7J9tWOS+O1sJoNGMpAj/K5N6OjoNGT4Lu8t+w==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
+    lastmodified: "2026-08-24T20:37:01Z"
+    mac: ENC[AES256_GCM,data:6xnOUECA2Ge72v5e1IkY1uLTQRxvWJv5ca82aNq1JDnwIevvWOb+ofiHV6G9oC8ZdozbSrfGAXUWuF/QLC/zchQaPAw164BRdGW/ay3k9pnreBez7YJTnIL2nXOl32INIh3GMgGamoGsiIAX5m9TIj57lEWH6BW1lSpzC3OWG34=,iv:mGmHW9aWkInZ1dkKPlX96ml0TQ9t8sxGhWUlpZz+L6A=,tag:v0IbYxwKLw//Fe8B1StKHw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.13.3

nixos/secrets/seaweed.yaml

@@ -1,43 +0,0 @@
-seaweedCredentials: ENC[AES256_GCM,data:/piXMLqpb9GkvSxnKFkHMQVWsPk2uYNKu8sjPodbwRPlbGcKzZYcJ4wUwg==,iv:mLJBVCGv/VM6Mh7gktplTcd94obWRnCjgKqNH4jGCQM=,tag:tVC+v+k2ZAv7ap/yscXDNA==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvRmswMVMxVkRsa0N6V0NM
-            Qy9VUmtyZC9BbGw2SXZUSDBURUtkYVU5aWtzClJJZy8xTEg4b0hjSTFSM3hBOC9U
-            cW9Kd24yeUNmRS9LNWl4SkJ1aVZSOTgKLS0tIGc3ck9ZbkZaMWtsdVcwY05JVWxJ
-            ZXphenAyUVc2eXZDd1cxZVptTjMvOHMKGHJchsnOU0YIThRzzjFpaiYh3rLaZMM2
-            Cr1ChgypHvrYQFcbM9gm1N5tfB24jdwtfnqHIhT5upwf0v7QfLgGNA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZWJXa3BEb3BRU01ueWxH
-            a2F6MjR6YnU5bmJYYkM5eDNDUzBoRUR3dDM0CmZ6endhRy9tWHVBbDRQdzdTRVdC
-            RkEySnRKa0pmVGlKdmhIOHE4SWhvRlkKLS0tIHpVeE1DUEh6UWtxdzQ5VU1oKzFG
-            a1NSWVk4NHhGZFNNRCtoazl5NDU0cncKY1bzev4i6eYaES6KvjQV0hcCn0i438Q/
-            tUhstFuDD1CwYAU7JoLxjTk+/XClY2DU7EEmWFOTNBhmoSmix1oapw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0emRuVDR3TXJPRU1wYVNH
-            eThCWjVucWdUYTJDVjE2RVl1ZXVKMkJOYWkwCnFLcy9aQ0Nnbk84TVhZdVlsM0JO
-            Z1pyQ1FBY0NIT2M2WWR0S2lLd0RjUHMKLS0tIG9VRUxpU2FKc0g1c2hWZ3dXWk5E
-            cGdqZnQ3NlNHQVlUOU9Bc2Y1MU8yUjQKK8fAyg9lcaGLOvofCfgx8k8d3ACK3chB
-            Ly5ANzayidycn0FBvTHIqbvQ7y/sL266G378XUzzlV+k0wU8m27VNQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDR0pObEZaRUpWNndDOWND
-            T1Z0YllKbUJucjNHcUdTMXQ2UE5ZOUVpcFZ3CmR2ZlA2eXVKb214RnhmdnBZcFd5
-            TFNyT3BLbFJBQVlMMUl2RENaT29tYjgKLS0tIGJ5TklXY3ZCYittd1FWd3JJdTh5
-            ZUdyK1pHSm96bFlwQXR6NkZsZnZTdlkKGy/Tj+yldqPM5Q86V8oKQoOe3C18VBZ3
-            YD4ad9KB3IJ0PG9GFCq5iN90bZBkY/1XeNPZzsOvkZKhAyIj9QLNMw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-08-19T02:32:09Z"
-    mac: ENC[AES256_GCM,data:3iCi9UB5INgZsIHtVhF+YjjIe/QrB86xR/pidWxt0Qj/m4vyR7fIP4uDFF/RjKQ2PtZ0tab0h3ALsWAMaRdnl/AvSJ0jROw2ZQtfAbL6pin6kZYsuBiDlXCDCBkBXVLdzH0vt0Tv31x+nDc3zTGOKB3JSPg6d5cFfidt3c38Tdw=,iv:t+67QNsIvQAGHkpMYiu6v/NRU2Xwt8Wvrk8/GLXZ7hI=,tag:y0vIrJYaOsYYHELWsiU18A==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.3