1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

{ jolheiser, lib, ... }:
let
  enable = true;
  pubPort = 8449;
  privPort = 8447;
  host = "git.${jolheiser.domain}";
  opts =
    let
      homeDir = "/var/lib/ugit";
    in
    {
      inherit homeDir;
      enable = true;
      authorizedKeys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXoiWcPkL5kUAqJfMxnPM/ND4qJ4kKShDhXdqnYv2ZB"
      ];
      repoDir = "${homeDir}/repos";
      hostKeyFile = "${homeDir}/ugit_ed25519";
      user = "ugit";
      group = "ugit";
      config = {
        ssh.clone-url = "ugit@${host}";
        http = {
          port = pubPort;
          clone-url = "https://${host}";
        };
        log.json = true;
        profile = {
          username = jolheiser.username;
          email = "ugit@${jolheiser.domain}";
          links = [
            "Github,https://github.com/jolheiser"
            "Gitea,https://gitea.com/jolheiser"
            "Tangled,https://tangled.sh/@jolheiser.com"
          ];
        };
      };
    };
in
lib.mkIf enable {
  services = {
    ugit = {
      public = opts;
      private = lib.recursiveUpdate opts {
        config = {
          ssh.port = 8446;
          http.port = privPort;
          show-private = true;
        };
      };
    };
    tailproxy.ugit = {
      enable = true;
      hostname = "git";
      port = privPort;
      authKey = "tskey-auth-kyuvaLt8pb11CNTRL-admMYrs6UWb5XaCcdWJAWbriZ6JMo7ksK"; # One-time key
    };
    caddy.virtualHosts."${host}".extraConfig = ''
      reverse_proxy localhost:${builtins.toString pubPort}
    '';
  };
}