109 lines
2.5 KiB
Nix
109 lines
2.5 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
let
|
|
srcDomain = "src.thehellings.com";
|
|
ciDomain = "ci.thehellings.com";
|
|
ciPort = "17080";
|
|
droneDir = "/var/lib/drone";
|
|
in {
|
|
|
|
##########################################################################################
|
|
###########
|
|
# GIT SERVICES
|
|
##########
|
|
##########################################################################################
|
|
services.gitea = rec {
|
|
enable = true;
|
|
appName = "Greg's Sources";
|
|
cookieSecure = true;
|
|
database = {
|
|
type = "postgres";
|
|
user = "gitea";
|
|
};
|
|
disableRegistration = true;
|
|
domain = srcDomain;
|
|
dump = {
|
|
enable = true;
|
|
type = "tar.xz";
|
|
};
|
|
rootUrl = "https://${domain}/";
|
|
};
|
|
|
|
greg.proxies."${srcDomain}" = {
|
|
target = "http://localhost:${toString config.services.gitea.httpPort}";
|
|
ssl = true;
|
|
genAliases = false;
|
|
};
|
|
|
|
greg.backup.jobs.gitea = {
|
|
src = config.services.gitea.dump.backupDir;
|
|
dest = "gitea";
|
|
user = "gitea";
|
|
};
|
|
|
|
services.logrotate = {
|
|
enable = true;
|
|
settings = {
|
|
gitea = {
|
|
enable = true;
|
|
files = "${config.services.gitea.dump.backupDir}/*";
|
|
};
|
|
};
|
|
};
|
|
|
|
##########################################################################################
|
|
###########
|
|
# CI SERVICES
|
|
##########
|
|
##########################################################################################
|
|
|
|
# Service user
|
|
users.users.drone = {
|
|
isSystemUser = true;
|
|
group = "drone";
|
|
home = droneDir;
|
|
};
|
|
users.groups.drone = {};
|
|
|
|
# Environment secrets
|
|
age.secrets.drone = {
|
|
file = ../../secrets/drone.age;
|
|
owner = "root";
|
|
};
|
|
|
|
virtualisation.oci-containers = {
|
|
backend = "podman";
|
|
containers = {
|
|
"drone" = {
|
|
environment = {
|
|
DRONE_GITEA_SERVER = "https://${srcDomain}";
|
|
DRONE_SERVER_HOST = ciDomain;
|
|
DRONE_SERVER_PROTO = "https";
|
|
DRONE_SERVER_PROXY_HOST = ciDomain;
|
|
DRONE_SERVER_PROXY_PROTO = "https";
|
|
DRONE_TLS_AUTOCERT = "false"; # Suppress it generating SSL certificates, as our proxy handles that
|
|
};
|
|
environmentFiles = [
|
|
"/run/agenix/drone"
|
|
];
|
|
extraOptions = [ "--pull=newer" ];
|
|
image = "drone/drone:2.13";
|
|
ports = [ "${ciPort}:80" ];
|
|
volumes = [ "${droneDir}:/data" ];
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.services."podman-drone".serviceConfig = {
|
|
StateDirectory = "drone";
|
|
StateDirectoryMode = pkgs.lib.mkForce "0777";
|
|
WorkingDirectory = droneDir;
|
|
};
|
|
|
|
greg.proxies."${ciDomain}" = {
|
|
target = "http://localhost:${ciPort}";
|
|
ssl = true;
|
|
genAliases = false;
|
|
};
|
|
}
|