Forgejo Service
Table of Contents
Defined in /modules/services/forgejo.nix.
This NixOS module is a service that sets up a Forgejo instance.
Compared to the stock module from nixpkgs, this one sets up, in a fully declarative manner, LDAP and SSO integration as well as one local runner.
Features
Declarative creation of users, admin or not.
Declarative local runner Configuration.
Backup through the backup block. Manual.
Integration with the dashboard contract for displaying user facing application in a dashboard. Manual
Usage
Initial Configuration
The following snippet enables Forgejo and makes it available under the forgejo.example.com endpoint.
shb.forgejo = {
enable = true;
subdomain = "forgejo";
domain = "example.com";
users = {
"theadmin" = {
isAdmin = true;
email = "theadmin@example.com";
password.result = config.shb.sops.secret.forgejoAdminPassword.result;
};
"theuser" = {
email = "theuser@example.com";
password.result = config.shb.sops.secret.forgejoUserPassword.result;
};
};
};
shb.sops.secret."forgejo/admin/password" = {
request = config.shb.forgejo.users."theadmin".password.request;
};
shb.sops.secret."forgejo/user/password" = {
request = config.shb.forgejo.users."theuser".password.request;
};
Two users are created, theadmin and theuser,
respectively with the passwords forgejo/admin/password
and forgejo/user/password from a SOPS file.
This assumes secrets are setup with SOPS
as mentioned in the secrets setup section of the manual.
Secrets can be randomly generated with nix run nixpkgs#openssl -- rand -hex 64.
Forgejo through HTTPS
Note
We will build upon the Initial Configuration section, so please follow that first.
If the shb.ssl block is used (see manual on how to set it up),
the instance will be reachable at https://forgejo.example.com.
Here is an example with Let’s Encrypt certificates, validated using the HTTP method:
shb.certs.certs.letsencrypt."example.com" = {
domain = "example.com";
group = "nginx";
reloadServices = [ "nginx.service" ];
adminEmail = "myemail@mydomain.com";
};
Then you can tell Forgejo to use those certificates.
shb.certs.certs.letsencrypt."example.com".extraDomains = [ "forgejo.example.com" ];
shb.forgejo = {
ssl = config.shb.certs.certs.letsencrypt."example.com";
};
With LDAP Support
Note
We will build upon the HTTPS section, so please follow that first.
We will use the LLDAP block provided by Self Host Blocks. Assuming it has been set already, add the following configuration:
shb.forgejo.ldap = {
enable = true;
host = "127.0.0.1";
port = config.shb.lldap.ldapPort;
dcdomain = config.shb.lldap.dcdomain;
adminPassword.result = config.shb.sops.secret."forgejo/ldap/adminPassword".result
};
shb.sops.secret."forgejo/ldap/adminPassword" = {
request = config.shb.forgejo.ldap.adminPassword.request;
settings.key = "ldap/userPassword";
};
The shb.forgejo.ldap.adminPasswordFile must be the same
as the shb.lldap.ldapUserPasswordFile which is achieved
with the key option.
The other secrets can be randomly generated with
nix run nixpkgs#openssl -- rand -hex 64.
And that’s it.
Now, go to the LDAP server at http://ldap.example.com,
create the forgejo_user and forgejo_admin groups,
create a user and add it to one or both groups.
When that’s done, go back to the Forgejo server at
http://forgejo.example.com and login with that user.
With SSO Support
Note
We will build upon the LDAP section, so please follow that first.
We will use the SSO block provided by Self Host Blocks. Assuming it has been set already, add the following configuration:
shb.forgejo.sso = {
enable = true;
endpoint = "https://${config.shb.authelia.subdomain}.${config.shb.authelia.domain}";
secretFile = <path/to/oidcForgejoSharedSecret>;
secretFileForAuthelia = <path/to/oidcForgejoSharedSecret>;
};
Passing the ssl option will auto-configure nginx to force SSL connections with the given
certificate.
The shb.forgejo.sso.secretFile and shb.forgejo.sso.secretFileForAuthelia options
must have the same content. The former is a file that must be owned by the forgejo user while
the latter must be owned by the authelia user. I want to avoid needing to define the same secret
twice with a future secrets SHB block.
SMTP
To send e-mails, notifications, define the SMTP settings like so:
{
services.forgejo = {
smtp = {
host = "smtp.mailgun.org";
port = 587;
username = "postmaster@mg.${domain}";
from_address = "authelia@${domain}";
password.result = config.shb.sops.secret."forgejo/smtpPassword".result;
};
};
shb.sops.secret."forgejo/smtpPassword" = {
request = config.shb.forgejo.smtp.password.request;
};
}
Backup
Every hour, Forgejo takes a backup using the built-in dump command.
This backup is ephemeral and should be moved in a permanent location.
This can be accomplished using the following config.
Backing up Forgejo using the Restic block is done like so:
shb.restic.instances."forgejo" = {
request = config.shb.forgejo.backup;
settings = {
enable = true;
};
};
The name "forgejo" in the instances can be anything.
The config.shb.forgejo.backup option provides what directories to backup.
You can define any number of Restic instances to backup Forgejo multiple times.
Application Dashboard
Integration with the dashboard contract is provided by the dashboard option.
For example using the Homepage service:
{
shb.homepage.servicesGroups.Admin.services.Forgejo = {
sortOrder = 1;
dashboard.request = config.shb.forgejo.dashboard.request;
};
}
Extra Settings
Other Forgejo settings can be accessed through the nixpkgs stock service.
Debug
In case of an issue, check the logs for systemd service forgejo.service.
Enable verbose logging by setting the shb.forgejo.debug boolean to true.
Access the database with sudo -u forgejo psql.
Options Reference
-
shb.forgejo.enable -
Whether to enable selfhostblocks.forgejo.
Type: boolean
Default:
falseExample:
trueDeclared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.backup -
Backup configuration.
Type: submodule
Default:
{ }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.backup.request -
Request part of the backup contract.
Options set by the requester module enforcing how to backup files.
Type: submodule
Default:
""Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.backup.request.excludePatterns -
File patterns to exclude.
Type: list of string
Default:
[ ]Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.backup.request.hooks -
Hooks to run around the backup.
Type: submodule
Default:
{ }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.backup.request.hooks.afterBackup -
Hooks to run after backup.
Type: list of string
Default:
[ ]Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.backup.request.hooks.beforeBackup -
Hooks to run before backup.
Type: list of string
Default:
[ ]Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.backup.request.sourceDirectories -
Directories to backup.
Type: non-empty (list of string)
Default:
[ "/var/lib/forgejo/dump" ]Example:
"/var/lib/vaultwarden"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.backup.request.user -
Unix user doing the backups.
Type: string
Default:
"forgejo"Example:
"vaultwarden"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.backup.result -
Result part of the backup contract.
Options set by the provider module that indicates the name of the backup and restore scripts.
Type: submodule
Default:
""Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.backup.result.backupService -
Name of service backing up the database.
This script can be ran manually to backup the database:
$ systemctl start backup.serviceType: string
Default:
"backup.service"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.backup.result.restoreScript -
Name of script that can restore the database. One can then list snapshots with:
$ restore snapshots <snapshot 1> <metadata> <snapshot 2> <metadata>And restore the database with:
$ restore restore <snapshot 1>Type: string
Default:
"restore"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.dashboard -
Dashboard contract consumer
Type: submodule
Default:
{ }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.dashboard.request -
Request part of the dashboard contract.
Type: submodule
Default:
{ }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.dashboard.request.externalUrl -
URL at which the service can be accessed.
This URL should go through the reverse proxy.
Type: string
Default:
"https://\${config.shb.forgejo.subdomain}.\${config.shb.forgejo.domain}"Example:
"https://jellyfin.example.com"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.dashboard.request.internalUrl -
URL at which the service can be accessed directly.
This URL should bypass the reverse proxy. It can be used for example to ping the service and making sure it is up and running correctly.
Type: null or string
Default:
"https://\${config.shb.forgejo.subdomain}.\${config.shb.forgejo.domain}"Example:
"http://127.0.0.1:8081"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.dashboard.result -
Result part of the dashboard contract.
No option is provided here.
Type: submodule
Default:
{ }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.databasePassword -
File containing the Forgejo database password.
Type: submodule
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.databasePassword.request -
Request part of the secret contract.
Options set by the requester module enforcing some properties the secret should have.
Type: submodule
Default:
""Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.databasePassword.request.group -
Linux group owning the secret file.
Type: string
Default:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.databasePassword.request.mode -
Mode of the secret file.
Type: string
Default:
"0440"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.databasePassword.request.owner -
Linux user owning the secret file.
Type: string
Default:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.databasePassword.request.restartUnits -
Systemd units to restart after the secret is updated.
Type: list of string
Default:
[ "forgejo.service" ]Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.databasePassword.result -
Result part of the secret contract.
Options set by the provider module that indicates where the secret can be found.
Type: submodule
Default:
{ path = "/run/secrets/secret"; }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.databasePassword.result.path -
Path to the file containing the secret generated out of band.
This path will exist after deploying to a target host, it is not available through the nix store.
Type: absolute path
Default:
"/run/secrets/secret"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.debug -
Enable debug logging.
Type: boolean
Default:
falseDeclared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.domain -
Domain under which Forgejo is served.
<subdomain>.<domain>[:<port>]Type: string
Example:
"domain.com"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.hostPackages -
List of packages, that are available to actions, when the runner is configured with a host execution label.
Type: list of package
Default:
with pkgs; [ bash coreutils curl gawk gitMinimal gnused nodejs wget ]Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap -
LDAP Integration.
Type: null or (submodule)
Default:
{ }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.enable -
Whether to enable LDAP integration…
Type: boolean
Default:
falseExample:
trueDeclared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.adminGroup -
Group users must belong to be admins.
Type: string
Default:
"forgejo_admin"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.adminName -
Admin user of the LDAP server. Cannot be reserved word ‘admin’.
Type: string
Default:
"admin"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.adminPassword -
LDAP admin password.
Type: submodule
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.adminPassword.request -
Request part of the secret contract.
Options set by the requester module enforcing some properties the secret should have.
Type: submodule
Default:
""Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.adminPassword.request.group -
Linux group owning the secret file.
Type: string
Default:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.adminPassword.request.mode -
Mode of the secret file.
Type: string
Default:
"0440"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.adminPassword.request.owner -
Linux user owning the secret file.
Type: string
Default:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.adminPassword.request.restartUnits -
Systemd units to restart after the secret is updated.
Type: list of string
Default:
[ "forgejo.service" ]Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.adminPassword.result -
Result part of the secret contract.
Options set by the provider module that indicates where the secret can be found.
Type: submodule
Default:
{ path = "/run/secrets/secret"; }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.adminPassword.result.path -
Path to the file containing the secret generated out of band.
This path will exist after deploying to a target host, it is not available through the nix store.
Type: absolute path
Default:
"/run/secrets/secret"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.dcdomain -
dc domain for ldap.
Type: string
Example:
"dc=mydomain,dc=com"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.host -
Host serving the LDAP server.
Type: string
Default:
"127.0.0.1"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.port -
Port of the service serving the LDAP server.
Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)
Default:
389Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.provider -
LDAP provider name, used for display.
Type: value “LLDAP” (singular enum)
Default:
"LLDAP"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.userGroup -
Group users must belong to be able to login.
Type: string
Default:
"forgejo_user"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ldap.waitForSystemdServices -
List of systemd services to wait on before starting. This is needed because forgejo will try a lookup on the LDAP instance and will abort setting up LDAP if it can’t reach it.
Type: list of string
Default:
[ ]Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.localActionRunner -
Enable local action runner that runs for all labels.
Type: boolean
Default:
trueDeclared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.mount -
Mount configuration. This is an output option.
Use it to initialize a block implementing the “mount” contract. For example, with a zfs dataset:
shb.zfs.datasets."forgejo" = { poolName = "root"; } // config.shb.forgejo.mount;Type: open submodule of anything (read only)
Default:
{ path = "/var/lib/forgejo"; }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.mount.path -
Path to be mounted.
Type: string
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.repositoryRoot -
Path where to store the repositories. If null, uses the default under the Forgejo StateDir.
Type: null or string
Default:
nullExample:
"/srv/forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp -
Send notifications by smtp.
Type: null or (submodule)
Default:
nullDeclared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.from_address -
SMTP address from which the emails originate.
Type: string
Example:
"authelia@mydomain.com"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.host -
SMTP host to send the emails to.
Type: string
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.password -
File containing the password to connect to the SMTP host.
Type: submodule
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.password.request -
Request part of the secret contract.
Options set by the requester module enforcing some properties the secret should have.
Type: submodule
Default:
""Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.password.request.group -
Linux group owning the secret file.
Type: string
Default:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.password.request.mode -
Mode of the secret file.
Type: string
Default:
"0440"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.password.request.owner -
Linux user owning the secret file.
Type: string
Default:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.password.request.restartUnits -
Systemd units to restart after the secret is updated.
Type: list of string
Default:
[ "forgejo.service" ]Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.password.result -
Result part of the secret contract.
Options set by the provider module that indicates where the secret can be found.
Type: submodule
Default:
{ path = "/run/secrets/secret"; }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.password.result.path -
Path to the file containing the secret generated out of band.
This path will exist after deploying to a target host, it is not available through the nix store.
Type: absolute path
Default:
"/run/secrets/secret"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.port -
SMTP port to send the emails to.
Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)
Default:
25Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.smtp.username -
Username to connect to the SMTP host.
Type: string
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ssl -
Path to SSL files
Type: null or (open submodule of anything)
Default:
nullDeclared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ssl.paths -
Paths where the files for the certificate will be located.
This option is the contract output of the
shb.certs.certsSSL block.Type: open submodule of anything
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ssl.paths.cert -
Path to the cert file.
Type: absolute path
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ssl.paths.key -
Path to the key file.
Type: absolute path
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.ssl.systemdService -
Systemd oneshot service used to generate the certificate. Ends with the
.servicesuffix.Use this if downstream services must wait for the certificates to be generated before starting.
Type: string
Example:
"cert-generator.service"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso -
Setup SSO integration.
Type: submodule
Default:
{ }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.enable -
Whether to enable SSO integration…
Type: boolean
Default:
falseExample:
trueDeclared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.authorization_policy -
Require one factor (password) or two factor (device) authentication.
Type: one of “one_factor”, “two_factor”
Default:
"one_factor"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.clientID -
Client ID for the OIDC endpoint.
Type: string
Default:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.endpoint -
OIDC endpoint for SSO.
Type: string
Example:
"https://authelia.example.com"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.provider -
OIDC provider name, used for display.
Type: value “Authelia” (singular enum)
Default:
"Authelia"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecret -
OIDC shared secret for Forgejo.
Type: submodule
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecret.request -
Request part of the secret contract.
Options set by the requester module enforcing some properties the secret should have.
Type: submodule
Default:
""Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecret.request.group -
Linux group owning the secret file.
Type: string
Default:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecret.request.mode -
Mode of the secret file.
Type: string
Default:
"0440"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecret.request.owner -
Linux user owning the secret file.
Type: string
Default:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecret.request.restartUnits -
Systemd units to restart after the secret is updated.
Type: list of string
Default:
[ "forgejo.service" ]Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecret.result -
Result part of the secret contract.
Options set by the provider module that indicates where the secret can be found.
Type: submodule
Default:
{ path = "/run/secrets/secret"; }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecret.result.path -
Path to the file containing the secret generated out of band.
This path will exist after deploying to a target host, it is not available through the nix store.
Type: absolute path
Default:
"/run/secrets/secret"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecretForAuthelia -
OIDC shared secret for Authelia.
Type: submodule
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecretForAuthelia.request -
Request part of the secret contract.
Options set by the requester module enforcing some properties the secret should have.
Type: submodule
Default:
""Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecretForAuthelia.request.group -
Linux group owning the secret file.
Type: string
Default:
"root"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecretForAuthelia.request.mode -
Mode of the secret file.
Type: string
Default:
"0400"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecretForAuthelia.request.owner -
Linux user owning the secret file.
Type: string
Default:
"authelia"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecretForAuthelia.request.restartUnits -
Systemd units to restart after the secret is updated.
Type: list of string
Default:
[ ]Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecretForAuthelia.result -
Result part of the secret contract.
Options set by the provider module that indicates where the secret can be found.
Type: submodule
Default:
{ path = "/run/secrets/secret"; }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.sso.sharedSecretForAuthelia.result.path -
Path to the file containing the secret generated out of band.
This path will exist after deploying to a target host, it is not available through the nix store.
Type: absolute path
Default:
"/run/secrets/secret"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.subdomain -
Subdomain under which Forgejo will be served.
<subdomain>.<domain>[:<port>]Type: string
Example:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.users -
Users managed declaratively.
Type: attribute set of (submodule)
Default:
{ }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.users.<name>.email -
Email of user.
This is only set when the user is created, changing this later on will have no effect.
Type: string
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.users.<name>.isAdmin -
Set user as admin or not.
Type: boolean
Default:
falseDeclared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.users.<name>.password -
Forgejo admin user password.
Type: submodule
Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.users.<name>.password.request -
Request part of the secret contract.
Options set by the requester module enforcing some properties the secret should have.
Type: submodule
Default:
""Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.users.<name>.password.request.group -
Linux group owning the secret file.
Type: string
Default:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.users.<name>.password.request.mode -
Mode of the secret file.
Type: string
Default:
"0440"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.users.<name>.password.request.owner -
Linux user owning the secret file.
Type: string
Default:
"forgejo"Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.users.<name>.password.request.restartUnits -
Systemd units to restart after the secret is updated.
Type: list of string
Default:
[ "forgejo.service" ]Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.users.<name>.password.result -
Result part of the secret contract.
Options set by the provider module that indicates where the secret can be found.
Type: submodule
Default:
{ path = "/run/secrets/secret"; }Declared by:
<selfhostblocks/modules/services/forgejo.nix> -
shb.forgejo.users.<name>.password.result.path -
Path to the file containing the secret generated out of band.
This path will exist after deploying to a target host, it is not available through the nix store.
Type: absolute path
Default:
"/run/secrets/secret"Declared by:
<selfhostblocks/modules/services/forgejo.nix>