feat(self_host/git): moving from gitea to forgejo

services/self_host/git.nix

@@ -1,20 +1,20 @@
 { config, pkgs, lib, ... }:
 
 let
-  giteaDomain = "git.enium.eu";
+  gitDomain = "git.enium.eu";
 in
 {
-  services.gitea = {
+  services = {
+    forgejo = {
       enable = true;
-    appName = "Enium Git";
-    user = "gitea";
-    group = "gitea";
-    database.type = "sqlite3";
+      database.type = "postgres";
 
       settings = {
         server = {
-        DOMAIN = giteaDomain;
-        ROOT_URL = "https://${giteaDomain}/";
+          "DEFAULT.APP_NAME" = "Enium Git";
+          "DEFAULT.APP_SLOGAN" = "Born2Code";
+          DOMAIN = gitDomain;
+          ROOT_URL = "https://${gitDomain}/";
           SSH_PORT = 42131;
           HTTP_ADDR = "127.0.0.1";
           HTTP_PORT = 3042;
@@ -24,26 +24,34 @@ in
           DISABLE_REGULAR_LOGIN = true;
         };
 
-      service = {
-        DISABLE_REGISTRATION = true;
-        ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
-      };
-
-      web = {
-        DISABLE_LOCAL_LOGIN = true;
-      };
-
-      oauth2_client = {
+        oauth2 = {
+          ENABLED = true;
+          NAME = "Enium";
+          CLIENT_ID = "forgejo";
+          CLIENT_SECRET = "${config.age.secrets.forgejo-oidc-secret.path}";
+          SCOPES = "openid email profile groups";
+          LOGIN_ATTRIBUTE_PATH = "preferred_username";
+          AUTH_URL = "https://git.enium.eu/ui/oauth2";
+          TOKEN_URL = "https://git.enium.eu/oauth2/token";
+          API_URL = "https://git.enium.eu/oauth2/openid/forgejo/userinfo";
+          CODE_CHALLENGE_METHOD = "S256";
           ENABLE_AUTO_REGISTRATION = true;
+          UPDATE_AVATAR = true;
+        };
+
+        security = {
+          LOGIN_REMEMBER_DAYS = 14;
         };
       };
     };
 
-  services.nginx.virtualHosts."${giteaDomain}" = {
+    nginx.virtualHosts."${gitDomain}" = {
       enableACME = true;
       forceSSL = true;
       locations."/" = {
         proxyPass = "http://127.0.0.1:3042";
+        proxyWebsockets = true;
+      };
     };
   };
 }