steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

feat(webserver/forgejo): set up SSH

Browse source
This commit is contained in:
steveej 2024-06-12 22:22:46 +02:00
parent cd0835f6dc
commit ef016ac70a
2 changed files with 17 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nix/os/containers/webserver.nix
View file

@ -2,8 +2,9 @@
specialArgs,
hostAddress,
localAddress,
httpPort ? 80,
httpsPort ? 443,
httpPort,
httpsPort,
forgejoSshPort,
autoStart ? false,
}: let
domain = "www.stefanjunker.de";
@ -36,6 +37,7 @@ in {
networking.firewall.allowedTCPPorts = [
httpPort
httpsPort
forgejoSshPort
];
sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
@ -247,9 +249,13 @@ in {
settings = {
service.DISABLE_REGISTRATION = true;
server.HTTP_ADDR = "127.0.0.1";
server.DISABLE_SSH = true;
server.START_SSH_SERVER = true;
server.SSH_PORT = forgejoSshPort;
server.ROOT_URL = "https://forgejo.${domain}";
server.HTTP_PORT = 3001;
# TODO: how do i get a 3072 length SSH key with the yubikey?
"ssh.minimum_key_sizes".RSA = 2048;
};
secrets = {
oauth2.JWT_SECRET = lib.mkForce config.sops.secrets.FORGEJO_JWT_SECRET.path;
@ -318,6 +324,13 @@ in {
hostPort = httpsPort;
protocol = "tcp";
}
{
# forgejo ssh
containerPort = forgejoSshPort;
hostPort = forgejoSshPort;
protocol = "tcp";
}
];
inherit hostAddress localAddress;