From 941a6731bb656d500bb96b6c2505b437d186f6ab Mon Sep 17 00:00:00 2001 From: Erik Simon Date: Sun, 23 Aug 2026 07:49:05 +0200 Subject: [PATCH] gitea: add a `gitea` admin CLI alias on jupiter MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirrors the `hermes` alias on mars. The admin CLI is effectively undiscoverable without it: the package is not in systemPackages so `gitea` is not on PATH at all, every admin subcommand needs GITEA_WORK_DIR pointed at a stateDir that is not the module default, and it has to run as the gitea user or it drops root-owned files into that directory. Getting any of the three wrong fails in a different and unhelpful way. Both the package path and the stateDir come from the config rather than being written out, so a gitea bump or a stateDir move cannot leave the alias pointing at something stale — which is exactly what a hardcoded /nix/store path would do. Lives in services/dev/gitea.nix, which only jupiter imports, so it does not leak onto hosts with no gitea to administer. Co-Authored-By: Claude Opus 5 Claude-Session: https://claude.ai/code/session_01S94o42aQ8VkBmEWvDem5xa --- services/dev/gitea.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/services/dev/gitea.nix b/services/dev/gitea.nix index 7cdb25e..9b929e2 100644 --- a/services/dev/gitea.nix +++ b/services/dev/gitea.nix @@ -102,6 +102,24 @@ in networking.firewall.allowedTCPPorts = [ 2222 ]; + # `gitea ` == the admin CLI, as the gitea user, against the real + # state dir — mirrors the `hermes` alias on mars. Worth having because none + # of that is discoverable: the package is not in systemPackages (so `gitea` + # is not otherwise on PATH at all), every admin subcommand needs + # GITEA_WORK_DIR pointed at a stateDir that is not the module default, and + # it has to run as the gitea user or it writes root-owned files into that + # directory. Both paths come from the config rather than being spelled out, + # so a package bump or a stateDir move cannot leave this stale. + # + # Handy ones: + # gitea admin user generate-access-token --username luna \ + # --token-name luna-$(date +%Y%m%d) \ + # --scopes write:repository,write:issue,read:user --raw + # gitea admin user list + # gitea actions generate-runner-token + programs.zsh.shellAliases.gitea = + "sudo -u ${config.services.gitea.user} env GITEA_WORK_DIR=${config.services.gitea.stateDir} ${config.services.gitea.package}/bin/gitea"; + users.users.gitea.extraGroups = [ "users" ]; # Runner instance registered against this same gitea. Jobs run in containers