prescientmoon/satellite
1
Fork 0
Code Activity

Set up forgejo ssh

Browse source
This commit is contained in:
prescientmoon 2024-09-11 16:30:19 +02:00
parent 861f2e81e2
commit a94ba0499d
Signed by: prescientmoon
SSH key fingerprint: SHA256:WFp/cO76nbarETAoQcQXuV+0h7XJsEsOCI0UsyPIy6U
4 changed files with 75 additions and 43 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
home/features/cli/ssh.nix
View file

@ -1,5 +1,9 @@
{ config, ... }:
{ pkgs, lib, ... }:
{
programs.ssh.enable = true;
satellite.persistence.at.state.apps.ssh.directories = [ ".ssh" ];
# This allows me to push/pull to my forgejo server via SSH.
# See the docs for more details: https://developers.cloudflare.com/cloudflare-one/tutorials/gitlab/#configuring-ssh
programs.ssh.matchBlocks."ssh.git.moonythm.dev".proxyCommand = "${lib.getExe pkgs.cloudflared} access ssh --hostname %h";
}

1
hosts/nixos/common/global/ports.nix
View file

@ -24,5 +24,6 @@
jupyterhub = 8420;
guacamole = 8421;
syncthing = 8422;
forgejo-ssh = 8423;
};
}

10
hosts/nixos/lapetus/services/forgejo.nix
View file

@ -7,6 +7,10 @@
};
satellite.cloudflared.at.git.port = config.satellite.ports.forgejo;
satellite.cloudflared.at."ssh.git" = {
protocol = "ssh";
port = config.satellite.ports.forgejo-ssh;
};
services.forgejo = {
enable = true;
@ -29,6 +33,8 @@
HTTP_PORT = config.satellite.cloudflared.at.git.port;
ROOT_URL = config.satellite.cloudflared.at.git.url;
LANDING_PAGE = "prescientmoon"; # Make my profile the landing page
SSH_DOMAIN = config.satellite.cloudflared.at."ssh.git".host;
SSH_PORT = config.satellite.ports.forgejo-ssh;
};
cron.ENABLED = true;
@ -45,9 +51,7 @@
repository = {
DISABLE_STARS = true;
DISABLED_REPO_UNITS = "";
DEFAULT_REPO_UNITS = lib.strings.concatStringsSep "," [
"repo.code"
];
DEFAULT_REPO_UNITS = lib.strings.concatStringsSep "," [ "repo.code" ];
};
};
};

101
modules/nixos/cloudflared.nix
View file

@ -1,5 +1,6 @@
{ config, lib, ... }:
let cfg = config.satellite.cloudflared;
let
cfg = config.satellite.cloudflared;
in
{
options.satellite.cloudflared = {
@ -17,52 +18,74 @@ in
at = lib.mkOption {
description = "List of hosts to set up ingress rules for";
default = { };
type = lib.types.attrsOf (lib.types.submodule ({ name, config, ... }: {
options = {
subdomain = lib.mkOption {
description = ''
Subdomain to use for host generation.
Only required if `host` is not set manually.
'';
type = lib.types.str;
default = name;
};
type = lib.types.attrsOf (
lib.types.submodule (
{ name, config, ... }:
{
options = {
subdomain = lib.mkOption {
description = ''
Subdomain to use for host generation.
Only required if `host` is not set manually.
'';
type = lib.types.str;
default = name;
};
port = lib.mkOption {
description = "Localhost port to point the tunnel at";
type = lib.types.port;
};
port = lib.mkOption {
description = "Localhost port to point the tunnel at";
type = lib.types.port;
};
host = lib.mkOption {
description = "Host to direct traffic from";
type = lib.types.str;
default = "${config.subdomain}.${cfg.domain}";
};
host = lib.mkOption {
description = "Host to direct traffic from";
type = lib.types.str;
default = "${config.subdomain}.${cfg.domain}";
};
url = lib.mkOption {
description = "External https url used to access this host";
type = lib.types.str;
};
};
protocol = lib.mkOption {
description = "The protocol to redirect traffic through";
type = lib.types.str;
default = "http";
};
config.url = "https://${config.host}";
}));
url = lib.mkOption {
description = "External https url used to access this host";
type = lib.types.str;
};
};
config.url = "https://${config.host}";
}
)
);
};
};
config.services.cloudflared.tunnels.${cfg.tunnel}.ingress = lib.attrsets.mapAttrs'
(_: { port, host, ... }: {
config.services.cloudflared.tunnels.${cfg.tunnel}.ingress = lib.attrsets.mapAttrs' (
_:
{
port,
host,
protocol,
...
}:
{
name = host;
value = "http://localhost:${toString port}";
})
cfg.at;
value = "${protocol}://localhost:${toString port}";
}
) cfg.at;
config.satellite.dns.records =
let mkDnsRecord = { subdomain, ... }: {
type = "CNAME";
at = subdomain;
zone = cfg.domain;
value = "${cfg.tunnel}.cfargotunnel.com.";
};
in lib.attrsets.mapAttrsToList (_: mkDnsRecord) cfg.at;
let
mkDnsRecord =
{ subdomain, ... }:
{
type = "CNAME";
at = subdomain;
zone = cfg.domain;
value = "${cfg.tunnel}.cfargotunnel.com.";
};
in
lib.attrsets.mapAttrsToList (_: mkDnsRecord) cfg.at;
}