Get gitlab up and running

hosts/myself/git.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, inputs, ... }:
 
 let
 	extraPackages = with pkgs; [
@@ -14,58 +14,76 @@ let
 		xorriso
 	];
 
-	secretsList = [
+	gitlabStateDir = "/var/lib/gitlab";
-		"secret"
-		"otp"
-		"db"
-		"jws"
-	];
-
-	secretsPaths = {
-		secret = "/var/lib/secret";
-		otp    = "/var/lib/otp";
-		db     = "/var/lib/db";
-		jws    = "/var/lib/jws";
-		key    = "/var/lib/registry-key";
-		cert   = "/var/lib/registry-cert";
-	};
 
 	registryPort = 8001;
 in  {
-	age.secrets = {
+	networking = {
-		gitlab-secret.file = ../../secrets/gitlab/secret.age;
+		firewall = {
-		gitlab-otp.file = ../../secrets/gitlab/otp.age;
+			enable = true;
-		gitlab-db.file = ../../secrets/gitlab/db.age;
+			allowedTCPPorts = [ 80 registryPort ];
-		gitlab-jws.file = ../../secrets/gitlab/jws.age;
-		gitlab-key.file = ../../secrets/gitlab/key.age;
-		gitlab-cert.file = ../../secrets/gitlab/cert.age;
 		};
+		nat = {
+			enable = true;
+			internalInterfaces = [ "ve-+" ];
+			externalInterface  = "enp38s0";
+		};
+	};
+
+	greg.proxies."isaiah.thehellings.lan".target = "http://192.168.200.2";
+	
+	system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
 
 	containers.gitlab = {
 		autoStart = true;
 		bindMounts = {
 			"/var/gitlab/state" = {
-				hostPath = "/var/lib/gitlab";
+				hostPath = gitlabStateDir;
+				isReadOnly = false;
 			};
-			"${secretsPaths.secret}".hostPath = config.age.secrets.gitlab-secret.path;
+			"/etc/ssh".hostPath = "/etc/ssh";
-			"${secretsPaths.otp}".hostPath    = config.age.secrets.gitlab-otp.path;
-			"${secretsPaths.db}".hostPath     = config.age.secrets.gitlab-db.path;
-			"${secretsPaths.jws}".hostPath    = config.age.secrets.gitlab-jws.path;
-			"${secretsPaths.key}".hostPath    = config.age.secrets.gitlab-key.path;
-			"${secretsPaths.cert}".hostPath   = config.age.secrets.gitlab-cert.path;
 		};
 		privateNetwork = true;
 		hostAddress = "192.168.200.1";
-		localAddress = "192.168.20..2";
+		localAddress = "192.168.200.2";
 		config = { config, pkgs, ... }: {
+			imports = [
+				inputs.agenix.nixosModules.default
+				../../modules-linux/proxy.nix
+			];
+
+			age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+			age.secretsMountPoint = "/run/derp";
+			age.secrets = let
+				cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
+			in {
+				gitlab-secret = cfg "secret";
+				gitlab-otp = cfg "otp";
+				gitlab-db = cfg "db";
+				gitlab-jws = cfg "jws";
+				gitlab-key = cfg "key";
+				gitlab-cert = cfg "cert";
+			};
+
+			networking = {
+				firewall = {
+					enable = true;
+					allowedTCPPorts = [ 80 registryPort ];
+				};
+				useHostResolvConf = lib.mkForce false;
+			};
+
+			greg.proxies."192.168.200.2".target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
+
 			services = {
+				resolved.enable = true;
 				gitlab = {
 					enable = true;
 					backup = {
 						keepTime = 288;
 						startAt = [ "03:00" ];
 					};
-					host = "10.42.1.6";  # Just for now...
+					host = "isaiah.thehellings.lan";  # Just for now...
 					https = false;
 					initialRootEmail = "greg@thehellings.com";
 					initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
@@ -81,15 +99,15 @@ in  {
 					redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
 					registry = {
 						enable = true;
-						certFile = secretsPaths.cert;
+						certFile = config.age.secrets.gitlab-cert.path;
-						keyFile = secretsPaths.key;
+						keyFile = config.age.secrets.gitlab-key.path;
 						externalPort = registryPort;
 					};
 					secrets = {
-						secretFile = secretsPaths.secret;
+						secretFile = config.age.secrets.gitlab-secret.path;
-						otpFile    = secretsPaths.otp;
+						otpFile    = config.age.secrets.gitlab-otp.path;
-						dbFile     = secretsPaths.db;
+						dbFile     = config.age.secrets.gitlab-db.path;
-						jwsFile    = secretsPaths.jws;
+						jwsFile    = config.age.secrets.gitlab-jws.path;
 					};
 				};
 
@@ -111,7 +129,6 @@ in  {
 
 				redis.servers.gitlab = {
 					enable = true;
-					logfile = "/var/log/redis-gitlab.log";
 				};
 			};
 			system.stateVersion = "24.05";