Forgejo Service
Prev  Services  Next

Forgejo Service

Defined in /modules/services/forgejo.nix.

This NixOS module is a service that sets up a Forgejo instance.

Compared to the stock module from nixpkgs, this one sets up, in a fully declarative manner, LDAP and SSO integration as well as one local runner.

Features

Usage

Initial Configuration

The following snippet enables Forgejo and makes it available under the forgejo.example.com endpoint.

shb.forgejo = {
  enable = true;
  subdomain = "forgejo";
  domain = "example.com";
  localActionRunner = false; # Enable after registering a runner as described below.

  users = {
    "theadmin" = {
      isAdmin = true;
      email = "theadmin@example.com";
      password.result = config.shb.sops.secret.forgejoAdminPassword.result;
    };
    "theuser" = {
      email = "theuser@example.com";
      password.result = config.shb.sops.secret.forgejoUserPassword.result;
    };
  };
};

shb.sops.secret."forgejo/admin/password" = {
  request = config.shb.forgejo.users."theadmin".password.request;
};

shb.sops.secret."forgejo/user/password" = {
  request = config.shb.forgejo.users."theuser".password.request;
};

Two users are created, theadmin and theuser, respectively with the passwords forgejo/admin/password and forgejo/user/password from a SOPS file.

This assumes secrets are setup with SOPS as mentioned in the secrets setup section of the manual. Secrets can be randomly generated with nix run nixpkgs#openssl -- rand -hex 64.

Local Actions runner

Forgejo runners must be registered once to obtain a UUID and an authentication token. Follow the steps below for a new runner, or the migration instructions for an existing one. Set shb.forgejo.localActionRunner explicitly: true to enable the runner with its UUID and token, or false to run Forgejo without a local runner. Omitting this choice or the credentials required for an enabled runner fails evaluation.

The runner uses services.forgejo-runner.instances.local and executes jobs with the native label on the host. Add tools through shb.forgejo.hostPackages. Only allow trusted workflows: host jobs share a service account and are not isolated from one another by containers or virtual machines.

Registering a new runner

  1. Start Forgejo without the runner. Add these settings to your NixOS configuration, alongside the initial Forgejo configuration:

    shb.forgejo.localActionRunner = false;
environment.systemPackages = [ config.services.forgejo.package ];

    Activate with sudo nixos-rebuild switch, including your usual configuration selection arguments such as --flake.

  2. Generate the token and register the runner. Run the following on the Forgejo server. These commands assume the default forgejo user and /var/lib/forgejo state directory; adjust them if you customized those settings.

    runner_token=$(forgejo forgejo-cli actions generate-secret)
printf "%s" "$runner_token" | sudo --user=forgejo env \
  FORGEJO_WORK_DIR=/var/lib/forgejo \
  FORGEJO_CUSTOM=/var/lib/forgejo/custom \
  forgejo forgejo-cli actions register --name local --secret-stdin=true

    The last command prints the UUID for this token. Save that UUID for step 4; do not generate a separate random UUID. If registration fails, retry the register command with the same $runner_token instead of generating another token.

  3. Save the token in SOPS. Print it in the same shell on the server:

    echo "$runner_token"

    Add runner-token under forgejo in your existing SOPS file:

    forgejo:
  runner-token: "<paste the token here>"

    Save the encrypted file before closing the shell, then run unset runner_token. Keep the token out of Nix expressions and the Nix store. See the SOPS setup instructions if needed.

  4. Configure and enable the runner. Replace the example UUID below with the UUID printed in step 2, and change localActionRunner from false to true:

    {
  shb.forgejo = {
    localActionRunner = true;
    runner.uuid = "c9e50be9-a7c3-4aee-ba35-624c4ff8c519";
    runner.token.result = config.shb.sops.secret."forgejo/runner-token".result;
  };
  shb.sops.secret."forgejo/runner-token".request = config.shb.forgejo.runner.token.request;
}

    Activate again with sudo nixos-rebuild switch and your usual arguments. Confirm that local is online in Forgejo’s Site Administration → Actions → Runners page.

See Forgejo’s offline registration guide and CLI reference.

Migrating from the Gitea runner

Reuse the UUID and operational token from /var/lib/gitea-runner/local/.runner to preserve the existing runner’s identity, following the nixpkgs migration instructions. Print the UUID followed by the token:

sudo jq --raw-output '.uuid, .token' /var/lib/gitea-runner/local/.runner

Set runner.uuid to the displayed UUID and save the token in SOPS as forgejo/runner-token, using the configuration shown above. Move overrides under services.gitea-actions-runner.instances.local to services.forgejo-runner.instances.local; labels now belong under settings.runner.labels.

For example, replace this override:

services.gitea-actions-runner.instances.local.labels = [ "native:host" "nix:host" ];

with:

services.forgejo-runner.instances.local.settings.runner.labels = [ "native:host" "nix:host" ];

Let running jobs finish, then stop the old runner and activate the configuration:

sudo systemctl stop gitea-runner-local.service
sudo nixos-rebuild switch

Use your usual configuration selection arguments, such as --flake. If activation fails, restart the old runner with sudo systemctl start gitea-runner-local.service while resolving the error. Keep the original .runner file and workspace for rollback with sudo nixos-rebuild switch --rollback. The native runner uses /var/lib/forgejo-runner/local, so its job caches start empty.

Optional cleanup: once the new runner has completed a workflow, its credentials are backed up, and you no longer need to roll back to the old runner, remove the old local runner’s identity file, workspace, and caches:

sudo rm -r /var/lib/gitea-runner/local

Remove only local; the parent directory may contain other runners. Keep the runner’s registration in Forgejo’s UI, because the new service reuses it.

Credentials and backups

Keep the UUID in your configuration backup and the token in your SOPS backup. Forgejo’s database backup preserves the corresponding server registration; the external token file is not included in Forgejo’s dump. Restore matching credentials and database registration when recovering. The runner workspace and caches can remain ephemeral because the runner consumes the supplied credentials on every start.

Forgejo through HTTPS

Note

We will build upon the Initial Configuration section, so please follow that first.

If the shb.ssl block is used (see manual on how to set it up), the instance will be reachable at https://forgejo.example.com.

Here is an example with Let’s Encrypt certificates, validated using the HTTP method:

shb.certs.certs.letsencrypt."example.com" = {
  domain = "example.com";
  group = "nginx";
  reloadServices = [ "nginx.service" ];
  adminEmail = "myemail@mydomain.com";
};

Then you can tell Forgejo to use those certificates.

shb.certs.certs.letsencrypt."example.com".extraDomains = [ "forgejo.example.com" ];

shb.forgejo = {
  ssl = config.shb.certs.certs.letsencrypt."example.com";
};

With LDAP Support

Note

We will build upon the HTTPS section, so please follow that first.

We will use the LLDAP block provided by Self Host Blocks. Assuming it has been set already, add the following configuration:

shb.forgejo.ldap = {
  enable = true;
  host = "127.0.0.1";
  port = config.shb.lldap.ldapPort;
  dcdomain = config.shb.lldap.dcdomain;
  adminPassword.result = config.shb.sops.secret."forgejo/ldap/adminPassword".result
};

shb.sops.secret."forgejo/ldap/adminPassword" = {
  request = config.shb.forgejo.ldap.adminPassword.request;
  settings.key = "ldap/userPassword";
};

The shb.forgejo.ldap.adminPasswordFile must be the same as the shb.lldap.ldapUserPasswordFile which is achieved with the key option. The other secrets can be randomly generated with nix run nixpkgs#openssl -- rand -hex 64.

And that’s it. Now, go to the LDAP server at http://ldap.example.com, create the forgejo_user and forgejo_admin groups, create a user and add it to one or both groups. When that’s done, go back to the Forgejo server at http://forgejo.example.com and login with that user.

With SSO Support

Note

We will build upon the LDAP section, so please follow that first.

We will use the SSO block provided by Self Host Blocks. Assuming it has been set already, add the following configuration:

shb.forgejo.sso = {
  enable = true;
  endpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";

  secretFile = <path/to/oidcForgejoSharedSecret>;
  secretFileForAuthelia = <path/to/oidcForgejoSharedSecret>;
};

Passing the ssl option will auto-configure nginx to force SSL connections with the given certificate.

The shb.forgejo.sso.secretFile and shb.forgejo.sso.secretFileForAuthelia options must have the same content. The former is a file that must be owned by the forgejo user while the latter must be owned by the authelia user. I want to avoid needing to define the same secret twice with a future secrets SHB block.

SMTP

To send e-mails, notifications, define the SMTP settings like so:

{
  services.forgejo = {
    smtp = {
      host = "smtp.mailgun.org";
      port = 587;
      username = "postmaster@mg.${domain}";
      from_address = "authelia@${domain}";
      password.result = config.shb.sops.secret."forgejo/smtpPassword".result;
    };
  };

  shb.sops.secret."forgejo/smtpPassword" = {
    request = config.shb.forgejo.smtp.password.request;
  };
}

Backup

Every hour, Forgejo takes a backup using the built-in dump command. This backup is ephemeral and should be moved in a permanent location. This can be accomplished using the following config.

Backing up Forgejo using the Restic block is done like so:

shb.restic.instances."forgejo" = {
  request = config.shb.forgejo.backup;
  settings = {
    enable = true;
  };
};

The name "forgejo" in the instances can be anything. The config.shb.forgejo.backup option provides what directories to backup. You can define any number of Restic instances to backup Forgejo multiple times.

Application Dashboard

Integration with the dashboard contract is provided by the dashboard option.

For example using the Homepage service:

{
  shb.homepage.servicesGroups.Admin.services.Forgejo = {
    sortOrder = 1;
    dashboard.request = config.shb.forgejo.dashboard.request;
  };
}

Extra Settings

Other Forgejo settings can be accessed through the nixpkgs stock service.

Debug

In case of an issue, check the logs for systemd service forgejo.service.

Enable verbose logging by setting the shb.forgejo.debug boolean to true.

Access the database with sudo -u forgejo psql.

Options Reference

shb.forgejo.enable

Whether to enable selfhostblocks.forgejo.

Type: boolean

Default:

false

Example:

true

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup

Backup configuration.

Type: submodule

Default:

{ }

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup.request

Request part of the backup contract.

Options set by the requester module enforcing how to backup files.

Type: submodule

Default:

""

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup.request.afterBackup

Hooks to run after a backup.

Type: list of string

Default:

[ ]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup.request.afterRestore

Hooks to run after a restore.

Type: list of string

Default:

[ ]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup.request.beforeBackup

Hooks to run before a backup.

Type: list of string

Default:

[ ]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup.request.beforeRestore

Hooks to run before a restore.

Type: list of string

Default:

[ ]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup.request.excludePatterns

File patterns to exclude.

Type: list of string

Default:

[ ]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup.request.sourceDirectories

Directories to backup.

Type: non-empty (list of string)

Default:

[
  "/var/lib/forgejo/dump"
]

Example:

"/var/lib/vaultwarden"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup.request.user

Unix user doing the backups.

Type: string

Default:

"forgejo"

Example:

"vaultwarden"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup.result

Result part of the backup contract.

Options set by the provider module that indicates the name of the backup and restore scripts.

Type: submodule

Default:

""

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup.result.backupService

Name of service backing up the database.

This script can be ran manually to backup the database:

$ systemctl start backup.service

Type: string

Default:

"backup.service"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.backup.result.restoreScript

Name of script that can restore the database. One can then list snapshots with:

$ restore snapshots
<snapshot 1> <metadata>
<snapshot 2> <metadata>

And restore the database with:

$ restore restore <snapshot 1>

Type: string

Default:

"restore"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.dashboard

Dashboard contract consumer

Type: submodule

Default:

{ }

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.dashboard.request

Request part of the dashboard contract.

Type: submodule

Default:

{ }

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.dashboard.request.externalUrl

URL at which the service can be accessed.

This URL should go through the reverse proxy.

Type: string

Default:

"http://\${config.shb.forgejo.subdomain}.\${config.shb.forgejo.domain}"

Example:

"https://jellyfin.example.com"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.dashboard.request.internalUrl

URL at which the service can be accessed directly.

This URL should bypass the reverse proxy. It can be used for example to ping the service and making sure it is up and running correctly.

Type: null or string

Default:

"http://\${config.shb.forgejo.subdomain}.\${config.shb.forgejo.domain}"

Example:

"http://127.0.0.1:8081"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.dashboard.result

Result part of the dashboard contract.

No option is provided here.

Type: submodule

Default:

{ }

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.databasePassword

File containing the Forgejo database password.

Type: submodule

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.databasePassword.request

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.databasePassword.request.group

Linux group owning the secret file.

Type: string

Default:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.databasePassword.request.mode

Mode of the secret file.

Type: string

Default:

"0440"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.databasePassword.request.owner

Linux user owning the secret file.

Type: string

Default:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.databasePassword.request.restartUnits

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "forgejo.service"
]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.databasePassword.result

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.databasePassword.result.path

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.debug

Enable debug logging.

Type: boolean

Default:

false

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.domain

Domain under which Forgejo is served.

<subdomain>.<domain>[:<port>]

Type: string

Example:

"domain.com"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.hostPackages

List of packages, that are available to actions, when the runner is configured with a host execution label.

Type: list of package

Default:

with pkgs; [
  bash
  coreutils
  curl
  gawk
  gitMinimal
  gnused
  nodejs
  wget
]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap

LDAP Integration.

Type: null or (submodule)

Default:

{ }

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.enable

Whether to enable LDAP integration…

Type: boolean

Default:

false

Example:

true

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.adminGroup

Group users must belong to be admins.

Type: string

Default:

"forgejo_admin"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.adminName

Admin user of the LDAP server. Cannot be reserved word ‘admin’.

Type: string

Default:

"admin"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.adminPassword

LDAP admin password.

Type: submodule

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.adminPassword.request

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.adminPassword.request.group

Linux group owning the secret file.

Type: string

Default:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.adminPassword.request.mode

Mode of the secret file.

Type: string

Default:

"0440"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.adminPassword.request.owner

Linux user owning the secret file.

Type: string

Default:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.adminPassword.request.restartUnits

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "forgejo.service"
]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.adminPassword.result

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.adminPassword.result.path

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.dcdomain

dc domain for ldap.

Type: string

Example:

"dc=mydomain,dc=com"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.host

Host serving the LDAP server.

Type: string

Default:

"127.0.0.1"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.port

Port of the service serving the LDAP server.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

389

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.provider

LDAP provider name, used for display.

Type: value “LLDAP” (singular enum)

Default:

"LLDAP"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.userGroup

Group users must belong to be able to login.

Type: string

Default:

"forgejo_user"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ldap.waitForSystemdServices

List of systemd services to wait on before starting. This is needed because forgejo will try a lookup on the LDAP instance and will abort setting up LDAP if it can’t reach it.

Type: list of string

Default:

[ ]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.localActionRunner

Enable the local Actions runner for the native label.

Set this explicitly when Forgejo is enabled. Requires a registered runner’s UUID and token in shb.forgejo.runner.

Type: boolean

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.mount

Mount configuration. This is an output option.

Use it to initialize a block implementing the “mount” contract. For example, with a zfs dataset:

shb.zfs.datasets."forgejo" = {
  poolName = "root";
} // config.shb.forgejo.mount;

Type: open submodule of anything (read only)

Default:

{
  path = "/var/lib/forgejo";
}

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.mount.path

Path to be mounted.

Type: string

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.repositoryRoot

Path where to store the repositories. If null, uses the default under the Forgejo StateDir.

Type: null or string

Default:

null

Example:

"/srv/forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.runner.token

Operational token of the registered local runner, supplied through the secret contract. Required when localActionRunner is enabled. This is the token paired with runner.uuid, not the legacy registration token. The file must contain only the token.

Type: submodule

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.runner.token.request

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.runner.token.request.group

Linux group owning the secret file.

Type: string

Default:

"root"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.runner.token.request.mode

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.runner.token.request.owner

Linux user owning the secret file.

Type: string

Default:

"root"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.runner.token.request.restartUnits

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "forgejo-runner-local.service"
]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.runner.token.result

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.runner.token.result.path

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.runner.uuid

UUID of the registered local runner. Required when localActionRunner is enabled. See the runner setup and migration instructions.

Type: string matching the pattern [0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}

Example:

"c9e50be9-a7c3-4aee-ba35-624c4ff8c519"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp

Send notifications by smtp.

Type: null or (submodule)

Default:

null

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.from_address

SMTP address from which the emails originate.

Type: string

Example:

"authelia@mydomain.com"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.host

SMTP host to send the emails to.

Type: string

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.password

File containing the password to connect to the SMTP host.

Type: submodule

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.password.request

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.password.request.group

Linux group owning the secret file.

Type: string

Default:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.password.request.mode

Mode of the secret file.

Type: string

Default:

"0440"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.password.request.owner

Linux user owning the secret file.

Type: string

Default:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.password.request.restartUnits

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "forgejo.service"
]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.password.result

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.password.result.path

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.port

SMTP port to send the emails to.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

25

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.smtp.username

Username to connect to the SMTP host.

Type: string

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ssl

Path to SSL files

Type: null or (open submodule of anything)

Default:

null

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ssl.paths

Paths where the files for the certificate will be located.

This option is the contract output of the shb.certs.certs SSL block.

Type: open submodule of anything

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ssl.paths.cert

Path to the cert file.

Type: absolute path

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ssl.paths.key

Path to the key file.

Type: absolute path

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.ssl.systemdService

Systemd oneshot service used to generate the certificate. Ends with the .service suffix.

Use this if downstream services must wait for the certificates to be generated before starting.

Type: string

Example:

"cert-generator.service"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso

Setup SSO integration.

Type: submodule

Default:

{ }

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.enable

Whether to enable SSO integration…

Type: boolean

Default:

false

Example:

true

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.authorization_policy

Require one factor (password) or two factor (device) authentication.

Type: one of “one_factor”, “two_factor”

Default:

"one_factor"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.clientID

Client ID for the OIDC endpoint.

Type: string

Default:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.endpoint

OIDC endpoint for SSO.

Type: string

Example:

"https://authelia.example.com"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.provider

OIDC provider name, used for display.

Type: value “Authelia” (singular enum)

Default:

"Authelia"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecret

OIDC shared secret for Forgejo.

Type: submodule

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecret.request

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecret.request.group

Linux group owning the secret file.

Type: string

Default:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecret.request.mode

Mode of the secret file.

Type: string

Default:

"0440"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecret.request.owner

Linux user owning the secret file.

Type: string

Default:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecret.request.restartUnits

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "forgejo.service"
]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecret.result

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecret.result.path

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecretForAuthelia

OIDC shared secret for Authelia.

Type: submodule

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecretForAuthelia.request

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecretForAuthelia.request.group

Linux group owning the secret file.

Type: string

Default:

"root"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecretForAuthelia.request.mode

Mode of the secret file.

Type: string

Default:

"0400"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecretForAuthelia.request.owner

Linux user owning the secret file.

Type: string

Default:

"authelia"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecretForAuthelia.request.restartUnits

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[ ]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecretForAuthelia.result

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.sso.sharedSecretForAuthelia.result.path

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.subdomain

Subdomain under which Forgejo will be served.

<subdomain>.<domain>[:<port>]

Type: string

Example:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.users

Users managed declaratively.

Type: attribute set of (submodule)

Default:

{ }

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.users.<name>.email

Email of user.

This is only set when the user is created, changing this later on will have no effect.

Type: string

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.users.<name>.isAdmin

Set user as admin or not.

Type: boolean

Default:

false

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.users.<name>.password

Forgejo admin user password.

Type: submodule

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.users.<name>.password.request

Request part of the secret contract.

Options set by the requester module enforcing some properties the secret should have.

Type: submodule

Default:

""

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.users.<name>.password.request.group

Linux group owning the secret file.

Type: string

Default:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.users.<name>.password.request.mode

Mode of the secret file.

Type: string

Default:

"0440"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.users.<name>.password.request.owner

Linux user owning the secret file.

Type: string

Default:

"forgejo"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.users.<name>.password.request.restartUnits

Systemd units to restart after the secret is updated.

Type: list of string

Default:

[
  "forgejo.service"
]

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.users.<name>.password.result

Result part of the secret contract.

Options set by the provider module that indicates where the secret can be found.

Type: submodule

Default:

{
  path = "/run/secrets/secret";
}

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
shb.forgejo.users.<name>.password.result.path

Path to the file containing the secret generated out of band.

This path will exist after deploying to a target host, it is not available through the nix store.

Type: absolute path

Default:

"/run/secrets/secret"

Declared by:

<selfhostblocks/modules/services/forgejo.nix>
Prev  Up  Next
Firefly-iii Service  Home  Home-Assistant Service