nixos/hosts/myself/container-git.nix

{ config, pkgs, lib, ... }: let
	registryPort = 5000;
	vpnIp = "100.78.226.76";
	containerIp = "192.168.200.2";
in {
	age.secretsMountPoint = "/run/derp";
	age.secrets = let
		cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
	in {
		gitlab-secret = cfg "secret";
		gitlab-otp = cfg "otp";
		gitlab-db = cfg "db";
		gitlab-jws = cfg "jws";
		gitlab-key = cfg "key";
		gitlab-cert = cfg "cert";

		minio_access_key_id = {
			file = ../../secrets/minio_access_key_id.age;
			owner = "gitlab";
			group = "gitlab";
			mode = "0444";
		};
		minio_secret_access_key = {
			file = ../../secrets/minio_secret_access_key.age;
			owner = "gitlab";
			group = "gitlab";
			mode = "0444";
		};
	};

	networking.firewall.allowedTCPPorts = [ 80 registryPort ];

	greg.proxies = let
		t = {
			target = "http://unix:/run/gitlab/gitlab-workhorse.socket";
			extraConfig = ''
			proxy_set_header X-Forwarded-Proto https;
			proxy_set_header X-Forwarded-Ssl on;
			'';
		};
	in {
		"${containerIp}" = t;
		"${vpnIp}" = t;
		"git.thehellings.lan" = t;
	};

	virtualisation.docker.enable = true;

	programs.ssh.extraConfig = lib.strings.concatStringsSep "\n" [
		"Host nas"
		"    User backup"
		"    IdentityFile /etc/ssh/duplicity_ed25519"
		"    StrictHostKeyChecking no"
		"    UserKnownHostsFile /dev/null"
	];

	greg.backup.jobs.nas-backup = {
		src = "/var/gitlab/state/backup/";
		dest = "gitlab";
		id = "yha^-s45h";
	};

	services = {
		gitlab = {
			enable = true;
			backup = {
				keepTime = 288;
				startAt = [ "03:00" ];
			};
			host = "src.thehellings.com";
			https = true;
			port = 443;
			extraConfig = {
				gitlab = {
					trustedProxies = [ "100.109.86.8/32" ];
				};
			};
			initialRootEmail = "greg@thehellings.com";
			initialRootPasswordFile = pkgs.writeText "initialRootPassword" "root_password";
			pages = {
				enable = true;
				settings.pages-domain = "pages.thehellings.com";
			};
			puma = {
				threadsMax = 6;
				threadsMin = 2;
				workers = 6;
			};
			redisUrl = "unix:${config.services.redis.servers.gitlab.unixSocket}";
			registry = {
				enable = true;
				certFile = config.age.secrets.gitlab-cert.path;
				keyFile = config.age.secrets.gitlab-key.path;
				externalAddress = "registry.thehellings.com";
				externalPort = 443;
			};
			secrets = {
				secretFile = config.age.secrets.gitlab-secret.path;
				otpFile    = config.age.secrets.gitlab-otp.path;
				dbFile     = config.age.secrets.gitlab-db.path;
				jwsFile    = config.age.secrets.gitlab-jws.path;
			};

			extraConfig = {
				object_store = {
					enabled = true;
					proxy_download = false;  # Tell them to reach out to object storage themselves!
					connection = {
						provider = "AWS";
						endpoint = "http://minio-01.thehellings.lan:9000";
						region = "us-east-1";
						aws_access_key_id = { _secret = config.age.secrets.minio_access_key_id.path; };
						aws_secret_access_key = { _secret = config.age.secrets.minio_secret_access_key.path; };
						path_style = true;  # True for MinIO
						aws_signature_version = 2;
					};
					#storage_options = ...;
					objects = builtins.listToAttrs ( builtins.map (x: lib.attrsets.nameValuePair x { bucket = "gitlab-${builtins.replaceStrings [ "_" ] [ "-" ] x}"; }) [
						"artifacts"
						"ci_secure_files"
						"dependency_proxy"
						"external_diffs"
						"lfs"
						"packages"
						"pages"
						"terraform_state"
						"uploads"
					]);
				};
			};
		};

		nginx.virtualHosts."gitlab.shire-zebra.ts.net" = {
			listen = [ {
				addr = vpnIp;
				port = registryPort;
				ssl = true;
			} ];
			locations."/" = {
				proxyPass = "http://127.0.0.1:5000/";
				recommendedProxySettings = true;
			};
			extraConfig = builtins.concatStringsSep "\n" [
				"ssl_certificate /etc/certs/gitlab.shire-zebra.ts.net.crt ;"
				"ssl_certificate_key /etc/certs/gitlab.shire-zebra.ts.net.key ;"
				"client_max_body_size 250m;"
			];
		};

		# Fetch the SSL certificates for nginx to use
		cron = {
			enable = true;
			systemCronJobs = [ "0 0 1 */2 * cd /etc/certs && tailscale cert gitlab.shire-zebra.ts.net && chown nginx * && systemctl reload nginx" ];
		};

		postgresql = {
			enable = true;
			checkConfig = true;
			ensureDatabases = [ "gitlab" ];
			ensureUsers = [ {
				name = "gitlab";
				ensureDBOwnership = true;
			} ];
			settings = {
				log_connections = true;
				log_statement = "all";
				logging_collector = true;
				log_filename = "postgresql.log";
			};
		};

		redis.servers.gitlab = {
			enable = true;
		};
		resolved.enable = true;
		openssh.enable = true;
	};

	# Do not start nginx until we have tailscaled up and running, so it can bind
	# to the 100.* addresses
	systemd.services = {
		nginx = rec {
			after = [
				"network-online.target"
			];
			wants = after;
			serviceConfig = {
				RestartMaxDelaySec = "30s";
				RestartSteps = "5";
			};
		};
		tailscaled.partOf = [ "network-online.target" ];
	};
	system.stateVersion = lib.mkForce "24.05";
}