75 lines
2.3 KiB
Nix
75 lines
2.3 KiB
Nix
{ config, lib, ... }:
|
|
with lib;
|
|
let
|
|
cfg = config.void.server.services.forgejo.woodpecker;
|
|
domain = "ci.sako.lol";
|
|
in {
|
|
options.void.server.services.forgejo.woodpecker = {
|
|
enable = mkEnableOption false;
|
|
};
|
|
config = mkIf cfg.enable {
|
|
|
|
security.acme.certs."ci.sako.lol" = {
|
|
credentialsFile = "/srv/secrets/porkbun";
|
|
dnsProvider = "porkbun";
|
|
webroot = null;
|
|
};
|
|
|
|
# LOL get it, a man is in a pod LMAO XDDDDD ROFL
|
|
# virtualisation.podman = {
|
|
# enable = true;
|
|
# defaultNetwork.settings = {
|
|
# # dns_enabled = true;
|
|
# dns = "127.0.0.1";
|
|
# };
|
|
# };
|
|
virtualisation.docker.enable = true;
|
|
|
|
# # This is needed for podman to be able to talk over dns
|
|
# networking.firewall.interfaces."podman0" = {
|
|
# allowedUDPPorts = [ 53 ];
|
|
# allowedTCPPorts = [ 53 ];
|
|
# };
|
|
|
|
services = {
|
|
woodpecker-server = {
|
|
enable = true;
|
|
environment = {
|
|
WOODPECKER_HOST = "https://${domain}";
|
|
WOODPECKER_SERVER_ADDR = ":3007";
|
|
WOODPECKER_FORGEJO = "TRUE";
|
|
WOODPECKER_FORGEJO_URL = "https://git.sako.lol";
|
|
WOODPECKER_OPEN = "TRUE";
|
|
WOODPECKER_ADMIN = "sako";
|
|
};
|
|
# /srv/secrets/woodpecker-server.env
|
|
# WOODPECKER_AGENT_SECRET=XXXXXXXXXXXXXXXXXXXXXX
|
|
# WOODPECKER_FORGEJO_CLIENT=YOUR_FORGEJO_CLIENT
|
|
# WOODPECKER_FORGEJO_SECRET=YOUR_FORGEJO_CLIENT_SECRET
|
|
environmentFile = "/srv/secrets/woodpecker-server.env";
|
|
};
|
|
woodpecker-agents.agents."sakoserver-agent" = {
|
|
enable = true;
|
|
# We need this to talk to the podman socket
|
|
extraGroups = [ "podman" ];
|
|
environment = {
|
|
WOODPECKER_SERVER = "localhost:9000";
|
|
WOODPECKER_MAX_WORKFLOWS = "1";
|
|
# DOCKER_HOST = "unix:///run/podman/podman.sock";
|
|
WOODPECKER_BACKEND = "docker";
|
|
WOODPECKER_HEALTHCHECK_ADDR = ":3001";
|
|
};
|
|
# Same as with woodpecker-server
|
|
# WOODPECKER_AGENT_SECRET goes here too idiot
|
|
environmentFile = [ "/srv/secrets/woodpecker.env" ];
|
|
};
|
|
nginx.virtualHosts."${domain}" = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/" = { proxyPass = "http://localhost:3007"; };
|
|
};
|
|
};
|
|
|
|
};
|
|
}
|