From 12da950b2515aa9242681cff60794fdb9d2f296a Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Sun, 21 Apr 2024 15:04:16 -0500
Subject: [PATCH] Tell Gitlab to use Minio

---
 hosts/myself/container-git.nix | 44 ++++++++++++++++++++++++++++++++++
 hosts/myself/git.nix           |  9 +++----
 2 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix
index 9635979..3309365 100644
--- a/hosts/myself/container-git.nix
+++ b/hosts/myself/container-git.nix
@@ -13,6 +13,19 @@ in {
 		gitlab-jws = cfg "jws";
 		gitlab-key = cfg "key";
 		gitlab-cert = cfg "cert";
+
+		minio_access_key_id = {
+			file = ../../secrets/minio_access_key_id.age;
+			owner = "gitlab";
+			group = "gitlab";
+			mode = "0444";
+		};
+		minio_secret_access_key = {
+			file = ../../secrets/minio_secret_access_key.age;
+			owner = "gitlab";
+			group = "gitlab";
+			mode = "0444";
+		};
 	};
 
 	networking.firewall.allowedTCPPorts = [ 80 registryPort ];
@@ -86,6 +99,34 @@ in {
 				dbFile     = config.age.secrets.gitlab-db.path;
 				jwsFile    = config.age.secrets.gitlab-jws.path;
 			};
+
+			extraConfig = {
+				object_store = {
+					enabled = true;
+					proxy_download = false;  # Tell them to reach out to object storage themselves!
+					connection = {
+						provider = "AWS";
+						endpoint = "http://s3.thehellings.lan:9000";
+						region = "us-east-1";
+						aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
+						aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
+						path_style = true;  # True for MinIO
+						aws_signature_version = 2;
+					};
+					#storage_options = ...;
+					objects = builtins.listToAttrs ( builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
+						"artifacts"
+						"ci_secure_files"
+						"dependency_proxy"
+						"external_diffs"
+						"lfs"
+						"packages"
+						"pages"
+						"terraform_state"
+						"uploads"
+					]);
+				};
+			};
 		};
 
 		nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
@@ -147,6 +188,9 @@ in {
 			"network.target"
 			"network-online.target"
 		];
+		preStart = ''
+			sleep 5  # tailscaled is up before it's ACTUALLY up... try waiting?
+		'';
 	};
 	system.stateVersion = lib.mkForce "24.05";
 }
diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix
index 2e8c634..a9c7d63 100644
--- a/hosts/myself/git.nix
+++ b/hosts/myself/git.nix
@@ -65,6 +65,7 @@ in  {
 		config = ((import ./container-runner.nix) {
 			inherit inputs overlays;
 			name = "shell";
+			extra.virtualisation.podman.enable = true;
 		});
 	};
 
@@ -96,13 +97,13 @@ in  {
 					"koalaman/shellcheck:*"
 
 					"registry.gitlab.com/gitlab-org/*"
-					"registry.thehellings.com/*"
-					"gitlab.shire-zebra.ts.net:5000/*:*"
+					"registry.thehellings.com/*/*/*:*"
+					"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
 				];
 				dockerAllowedServices = [
 					"docker:*"
-					"registry.thehellings.com/*"
-					"gitlab.shire-zebra.ts.net:5000/*:*"
+					"registry.thehellings.com/*/*/*:*"
+					"gitlab.shire-zebra.ts.net:5000/*/*/*:*"
 				];
 				dockerPrivileged = true;
 				dockerVolumes = [