1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

{ jolheiser, lib, ... }:
let
  enable = true;
  pubPort = 8449;
  privPort = 8447;
  host = "git.${jolheiser.domain}";
  opts =
    let
      homeDir = "/var/lib/ugit";
    in
    {
      inherit homeDir;
      enable = true;
      authorizedKeys = [
        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJXoiWcPkL5kUAqJfMxnPM/ND4qJ4kKShDhXdqnYv2ZB"
      ];
      repoDir = "${homeDir}/repos";
      hostKeyFile = "${homeDir}/ugit_ed25519";
      user = "ugit";
      group = "ugit";
      ssh.cloneUrl = "ugit@${host}";
      http = {
        port = pubPort;
        cloneUrl = "https://${host}";
      };
      log.json = true;
      profile = {
        username = jolheiser.username;
        email = "ugit@${jolheiser.domain}";
        links = [
          {
            name = "GitHub";
            url = "https://github.com/jolheiser";
          }
          {
            name = "Gitea";
            url = "https://gitea.com/jolheiser";
          }
          {
            name = "Tangled";
            url = "https://tangled.org/jolheiser.com";
          }
        ];
      };
    };
in
lib.mkIf enable {
  services = {
    ugit = {
      public = opts;
      private = lib.recursiveUpdate opts {
        ssh.port = 8446;
        http.port = privPort;
        showPrivate = true;
      };
    };
    tailproxy.ugit = {
      enable = true;
      hostname = "git";
      port = privPort;
      authKey = "tskey-auth-kyuvaLt8pb11CNTRL-admMYrs6UWb5XaCcdWJAWbriZ6JMo7ksK"; # One-time key
    };
    caddy.virtualHosts."${host}".extraConfig = ''
      reverse_proxy localhost:${builtins.toString pubPort}
    '';
  };
}