{ config, ... }:

# Gitea — self-hosted git. stateDir/repositories were migrated from the old
# ZimaOS docker instance straight into stateDir's default layout, so no
# import step is needed — just chown it to the gitea user after first deploy
# (currently darman:users from the CIFS copy):
#   chown -R gitea:gitea /mnt/data/AppData/gitea
#
# HTTP is reverse-proxied through Caddy (hosts/jupiter/configuration.nix).
# SSH uses gitea's own built-in server on :2222 (not the host's :22, and not
# :222 — the unpriv gitea user can't bind <1024).
{
  services.gitea = {
    enable = true;
    stateDir = "/mnt/data/AppData/gitea";
    lfs.enable = true;

    settings = {
      repository = {
        DEFAULT_BRANCH = "master";
      };
      server = {
        DOMAIN = "git.mgaction.town";
        SSH_DOMAIN = "git.mgaction.town";
        # https, not http: neptun's Caddy terminates TLS for this name. Gitea
        # builds its absolute URLs (clone buttons, redirects, webhooks) from
        # ROOT_URL, so an http:// value hands out downgraded links.
        ROOT_URL = "https://git.mgaction.town/";
        HTTP_PORT = 3000;
        START_SSH_SERVER = true;
        SSH_PORT = 2222;
        SSH_LISTEN_PORT = 2222;
      };
      service = {
        DISABLE_REGISTRATION = true;
      };
      actions = {
        ENABLED = true;
      };
    };
  };

  networking.firewall.allowedTCPPorts = [ 2222 ];

  users.users.gitea.extraGroups = [ "users" ];

  # Runner instance registered against this same gitea. Jobs run in containers
  # (podman, via services/containers.nix — already enabled on jupiter), one
  # image per requested `runs-on` label using the catthehacker act-compatible
  # images (same ones upstream `act`/Forgejo docs recommend).
  #
  # tokenFile points at an env file rendered by sops (TOKEN=<registration
  # token>, see hosts/jupiter/secrets.nix) rather than a plain `token`, so the
  # secret never lands in the Nix store. The registration token itself is NOT
  # generated by this module — it comes from gitea once Actions is enabled:
  #   su gitea -s /bin/sh -c \
  #     'GITEA_WORK_DIR=/mnt/data/AppData/gitea gitea actions generate-runner-token'
  # then written into secrets/jupiter.yaml as gitea_runner_token.
  services.gitea-actions-runner.instances.jupiter = {
    enable = true;
    name = "jupiter";
    url = "https://git.mgaction.town/";
    tokenFile = config.sops.templates."gitea-runner.env".path;
    labels = [
      "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
      "ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
    ];
  };
}