feat: add forgejo

.github/copilot-instructions.md

@@ -68,6 +68,7 @@ just secret-edit <path>    # Edit an encrypted secret
 ### Safety Boundaries
 
 **CRITICAL**: As an AI agent, you are **FORBIDDEN** from executing commands that permanently modify the system state or perform remote deployments.
+
 - **DO NOT** run `just switch` or `just boot`.
 - **DO NOT** run `just switch <hostname> <target>`.
 - Use `just test` or `just build-system` if you need to verify that a configuration builds successfully.
@@ -85,7 +86,7 @@ Secrets use agenix + agenix-rekey with YubiKey master identity:
 ## Adding New Features
 
 1. **New program**: Create `modules/programs/<name>.nix`, guard with `lib.mkIf config.fireproof.desktop.enable` or similar
-2. **New homelab service**: Create `modules/homelab/<name>.nix`, add to `modules/homelab/default.nix` imports
+2. **New homelab service**: Create `modules/homelab/<name>.nix`, add to `modules/homelab/default.nix` imports, and **add a link to the dashboard in `modules/homelab/glance.nix`**
 3. **New host**: Run `just new-host <hostname> <username>`, then add to `hosts/default.nix`
 
 ## Common Patterns

modules/homelab/default.nix

@@ -7,6 +7,7 @@
     ./arr.nix
     ./audiobookshelf.nix
     ./freshrss.nix
+    ./forgejo.nix
     ./glance.nix
     ./home-assistant
     ./jellyfin.nix

modules/homelab/forgejo.nix

@@ -0,0 +1,75 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+lib.mkIf config.fireproof.homelab.enable (let
+  domain = "forgejo.nickolaj.com";
+in {
+  age.secrets.forgejo-runner-token = {
+    rekeyFile = ../../secrets/hosts/homelab/forgejo-runner-token.age;
+    mode = "0600";
+  };
+
+  services.forgejo = {
+    enable = true;
+    database.type = "postgres";
+    dump = {
+      enable = true;
+      interval = "daily";
+    };
+    settings = {
+      server = {
+        DOMAIN = domain;
+        ROOT_URL = "https://${domain}/";
+        HTTP_PORT = 3000;
+        HTTP_ADDR = "127.0.0.1";
+      };
+      service = {
+        DISABLE_REGISTRATION = true;
+        ENABLE_INTERNAL_SIGNIN = false;
+      };
+      actions = {
+        ENABLED = true;
+      };
+    };
+  };
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.homelab = {
+      enable = true;
+      name = "homelab";
+      url = "https://${domain}";
+      tokenFile = config.age.secrets.forgejo-runner-token.path;
+      labels = [
+        "ubuntu-latest:docker://node:20-bookworm"
+      ];
+    };
+  };
+  systemd.services.gitea-runner-default.serviceConfig.DynamicUser = lib.mkForce false;
+
+  services.postgresql = {
+    ensureDatabases = ["forgejo"];
+    ensureUsers = [
+      {
+        name = "forgejo";
+        ensureDBOwnership = true;
+      }
+    ];
+  };
+
+  services.restic.backups.homelab.paths = [
+    config.services.forgejo.stateDir
+    config.services.forgejo.dump.backupDir
+  ];
+
+  services.nginx.virtualHosts."${domain}" = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:3000";
+    };
+  };
+})

modules/homelab/glance.nix

@@ -216,6 +216,12 @@ in {
                       icon = "sh:freshrss";
                       same-tab = true;
                     }
+                    {
+                      title = "Forgejo";
+                      url = "https://forgejo.nickolaj.com";
+                      icon = "sh:forgejo";
+                      same-tab = true;
+                    }
                     {
                       title = "Sonarr";
                       url = "https://sonarr.nickolaj.com";

modules/system/ssh.nix

@@ -17,6 +17,11 @@ in {
     mode = "0600";
     owner = username;
   };
+  age.secrets.forgejo-ssh-key = {
+    rekeyFile = ../../secrets/forgejo-ssh-key.age;
+    mode = "0600";
+    owner = username;
+  };
   age.secrets.ssh-key-ao = lib.mkIf workEnabled {
     rekeyFile = ../../secrets/ssh-key-ao.age;
     mode = "0600";
@@ -40,6 +45,11 @@ in {
             hostname = "x.nickolaj.com";
             user = "nickolaj";
           };
+          "forgejo.nickolaj.com" = {
+            hostname = "forgejo.nickolaj.com";
+            user = "git";
+            identityFile = "${config.age.secrets.forgejo-ssh-key.path}";
+          };
         }
         // lib.optionalAttrs workEnabled {
           # Work hostnames definded in ./networking.nix

secrets/hosts/desktop-wsl/.rekey/9a411f84fe7d4308015913d2d7b32915-forgejo-ssh-key.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 KDYMLA 3XX1km6w6wqWFXVoPVo9+pHr9POhVlQ2ITm0b9Rc2Xo
+syQAnCjVkK8FuVj/rv05mC3uo3FyNJW8TG6LhqnokEI
+-> 8Ae$E-grease M1
+PcS1jY8MbdwwWwPCRvBBYVkRmvD9UUQyjCgJtmKdBUw+Ziv7
+--- Gjix1IgomW7LXSfoOXRm4/zMXHfS5WFeD4C5nYwxH30
+wqQ	{Ñ4_ØßãVN?C3<43>þ? VŠÛ›,ù‡äbÉ_,¦\r¿YáÊÖÍ4Þ«¤9ÈzKbö=(Ð
&3x·5Fîš\÷ët`-J~”)M¤òb¬á`#Ô-L®ŸKj¿p
´Rìx+’	ÊHô½&Ý•KèU û+Ý–ñ<>eƒâ%½±c
/Ç=XÚ¬ŸGñõŒCݺ2Û
¹>Â-ýè(Y‡xѶ73góóíäÙ‰¥çæ	Éók,-¢áX$u6þ|ó“ºÐVâÂͱ‚ål¸NĘï4¡ŒâàÔo°„*¦²ÏŽÂ´<7F>N¥•LÞõƒÁæ3°kæø­¯“Y÷B-’Åj¬)ßvßR
37R~˜âO!÷Ñ'{‰TË
+&÷sú-zšrÖwÃÈ<C383>hfØ»©ƒ<<3C>ƒƒI>¡ÊŽ€ÿˆk¬TÍ9`e G8´Qj¶Æ*6Œ<36>Ù³&£Vž+«j¦š$¶6,ášKLw0ØÜΰ<06>+ÞÖ7?.iøéHÒêL(ó"j¼Ò´Ü§í#yqªXmN‡OåQ{<7B>1ê-˜gOGÊ,¹ ÃÎys

secrets/hosts/homelab/forgejo-runner-token.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 /7xd7wW72ibsmB1cpyfT14TM+y2Qo0G/vTEURUZprmg
+KPKazzWC9mxDGAcZLrTkjhmXq/RsJAp4mdZysjvQI6E
+-> piv-p256 q3LNVw Axl/D2SGpYP/eHdoTrOrTgzZZdcNSNPcOhfkwnCsBzSH
+L6TMeLKBtUGtlSLUcHh+XHNvfLi6iwgkznNldu+mmXQ
+-> gdcz[!v-grease x `{t0
+mWsv
+--- RGBGe47nVpK4mlxh8cUFzg8R52AAtY3iNUb7bYO6e1E
+²i1aþekG<>§Â}ÅÈÏr
³ÆŒî'¬ùÄÖ¢$UL†g<E280A0>|À/ÚJãß×ö@7i+ØéÒaÖÂAXT«wWÞCž“3y)a]l