setup forgejo

hosts/rackserv/default.nix

@@ -13,6 +13,7 @@
       ./profiles/wireguard-server.nix
       ./profiles/backups.nix
       ./profiles/caddy.nix
+      ./profiles/forgejo.nix
     ]
     ++ (with systemProfiles; [
       core.security

hosts/rackserv/profiles/caddy.nix

@@ -33,6 +33,13 @@ in {
           reverse_proxy ${hopper}
         '';
       };
+      forgejo = {
+        hostName = "git.${domain}";
+        useACMEHost = domain;
+        extraConfig = ''
+          reverse_proxy localhost:${toString config.services.forgejo.settings.server.HTTP_PORT}
+        '';
+      };
       other = {
         extraConfig = ''
           respond 404

hosts/rackserv/profiles/forgejo.nix

@@ -0,0 +1,18 @@
+{vars, ...}: {
+  services.forgejo = {
+    enable = true;
+    database.type = "postgres";
+    lfs.enable = true;
+    settings = {
+      session.COOKIE_SECURE = true;
+      server = {
+        DOMAIN = "git.${vars.domain}";
+        ROOT_URL = "https://git.${vars.domain}";
+        HTTP_PORT = 3000;
+        HTTP_ADDR = "127.0.0.1";
+      };
+      service.DISABLE_REGISTRATION = true;
+    };
+  };
+  services.restic.backups.rackserv.paths = ["/var/lib/forgejo/dump"];
+}