1extends "../../config/Service.pkl"
2
3import "../../config/Service.pkl" as service
4import "../../config/site.pkl" as site
5import "../postgres/service.pkl" as postgres
6
7class OAuthClient extends service.Requirement {
8 alias: String = "oauth"
9 fixed provider = "evil-forgejo"
10 fixed kind = "oauth-client"
11 name: String(isNotEmpty)
12 redirectUris: Listing<String>
13}
14
15local gitHost = if (site.domain.endsWith(".test")) "git.evil.\(site.domain)" else "git.evil.inc"
16
17meta { name = "evil.inc Git" }
18healthyDeadline = "20m"
19healthRestartGrace = "2m"
20setup = "setup.py"
21provide = "provide.py"
22
23requirements { new postgres.Database { name = "evil_forgejo" } }
24
25secrets {
26 ["lfs_jwt"] {}
27 ["oauth_jwt"] {}
28 ["security_key"] {}
29 ["internal_token"] {}
30 ["anubis_key"] {}
31 ["automation_password"] {}
32}
33
34requiredSecrets = if (site.domain.endsWith(".test")) new Listing {} else new Listing {
35 "mailer_address"
36 "mailer_username"
37 "mailer_password"
38}
39
40containers {
41 ["forgejo"] {
42 image = "code.forgejo.org/forgejo/forgejo@sha256:3d0ba60633e5ce50a4ac8afce06797eda5728411db047373e7d7d68cecb5bfe8"
43 entrypoint = "/bin/sh"
44 args { "/studio/start.sh" }
45 hostNetwork = true
46 imageUser = true
47 cpu = 300
48 memory = 1024
49
50 http {
51 containerPort = 3000
52 checkPath = "/api/healthz"
53 }
54
55 volumes {
56 ["/data"] {}
57 ["/studio/start.sh"] { config = "start.sh" }
58 ["/studio/app.ini"] { config = "app.ini" }
59 ["/custom/public"] { config = "public" }
60 }
61
62 env {
63 ["FORGEJO_CUSTOM"] = "/custom"
64 ["USER_UID"] = "\(module.uid)"
65 ["USER_GID"] = "\(module.uid)"
66 ["GIT_HOST"] = gitHost
67 ["DB_NAME"] = "${secret.database.name}"
68 ["DB_USER"] = "${secret.database.username}"
69 ["DB_PASSWORD"] = "${secret.database.password}"
70 ["FORGEJO_SERVER_LFS_JWT_SECRET"] = "${secret.own.lfs_jwt}"
71 ["FORGEJO_OAUTH2_JWT_SECRET"] = "${secret.own.oauth_jwt}"
72 ["FORGEJO_SECURITY_SECRET_KEY"] = "${secret.own.security_key}"
73 ["FORGEJO_SECURITY_INTERNAL_TOKEN"] = "${secret.own.internal_token}"
74 ["MAILER_ENABLED"] = if (site.domain.endsWith(".test")) "false" else "true"
75 ["MAILER_ADDRESS"] = if (site.domain.endsWith(".test")) "127.0.0.1" else "${secret.own.mailer_address}"
76 ["MAILER_USERNAME"] = if (site.domain.endsWith(".test")) "" else "${secret.own.mailer_username}"
77 ["MAILER_PASSWORD"] = if (site.domain.endsWith(".test")) "" else "${secret.own.mailer_password}"
78 }
79
80 envTemplate = """
81 FORGEJO_HTTP_PORT={{ env "NOMAD_PORT_forgejo_http" }}
82 {{ range nomadService 1 (env "NOMAD_ALLOC_ID") "postgres" }}DB_HOST=\(module.nomadHostPort){{ end }}
83 """
84 }
85
86 ["anubis"] {
87 image = "ghcr.io/techarohq/anubis@sha256:2babd956e4eb6daa06a41a9b3cbde394a0b2dae1872395f02a380436637c1bfa"
88 hostNetwork = true
89 imageUser = true
90 cpu = 100
91 memory = 256
92
93 http {
94 containerPort = 80
95 hostname = gitHost
96 checkPath = "/api/healthz"
97 checkHeaders { ["X-Real-Ip"] = "127.0.0.1" }
98 forwardRealIp = true
99 }
100
101 env {
102 ["COOKIE_DOMAIN"] = gitHost
103 ["REDIRECT_DOMAINS"] = gitHost
104 ["ED25519_PRIVATE_KEY_HEX"] = "${secret.own.anubis_key}"
105 ["COOKIE_PREFIX"] = "anubis_v1"
106 ["DIFFICULTY"] = "5"
107 }
108
109 envTemplate = """
110 BIND=:{{ env "NOMAD_PORT_anubis_http" }}
111 TARGET=http://127.0.0.1:{{ env "NOMAD_PORT_forgejo_http" }}
112 """
113 }
114}