darmanandClaude Opus 4.8
4fedc80bb4
Probing the live Debian VPS turned up three mismatches between what it serves and what this config declares: - git.mgaction.town had no vhost at all. Gitea's web UI and HTTPS clones are public today; only its SSH side (the :2222 socat forward) had been ported, so a deploy would have taken the web side offline. - Audiobookshelf is served as abs.mgaction.town, not the longer audiobookshelf.mgaction.town this config used. The mobile app is configured with the short name. - The apex returns 200 from Caddy. Left unserved deliberately, so it now gets Caddy's default 404; noted in a comment so it doesn't look like an oversight next time. Gitea's ROOT_URL was http:// while Caddy terminates TLS for that name. Gitea builds absolute URLs from it, so clone buttons, redirects and webhooks were handing out downgraded links. Also record that defaultGateway6 is confirmed rather than assumed -- `ip -6 route show default` on the VPS gives "default via fe80::1 dev eth0 metric 1024 onlink". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
44 lines
1.4 KiB
Nix
44 lines
1.4 KiB
Nix
{ ... }:
|
|
|
|
# Gitea — self-hosted git. stateDir/repositories were migrated from the old
|
|
# ZimaOS docker instance straight into stateDir's default layout, so no
|
|
# import step is needed — just chown it to the gitea user after first deploy
|
|
# (currently darman:users from the CIFS copy):
|
|
# chown -R gitea:gitea /mnt/data/AppData/gitea
|
|
#
|
|
# HTTP is reverse-proxied through Caddy (hosts/jupiter/configuration.nix).
|
|
# SSH uses gitea's own built-in server on :2222 (not the host's :22, and not
|
|
# :222 — the unpriv gitea user can't bind <1024).
|
|
{
|
|
services.gitea = {
|
|
enable = true;
|
|
stateDir = "/mnt/data/AppData/gitea";
|
|
lfs.enable = true;
|
|
|
|
settings = {
|
|
repository = {
|
|
DEFAULT_BRANCH = "master";
|
|
};
|
|
server = {
|
|
DOMAIN = "git.mgaction.town";
|
|
SSH_DOMAIN = "git.mgaction.town";
|
|
# https, not http: neptun's Caddy terminates TLS for this name. Gitea
|
|
# builds its absolute URLs (clone buttons, redirects, webhooks) from
|
|
# ROOT_URL, so an http:// value hands out downgraded links.
|
|
ROOT_URL = "https://git.mgaction.town/";
|
|
HTTP_PORT = 3000;
|
|
START_SSH_SERVER = true;
|
|
SSH_PORT = 2222;
|
|
SSH_LISTEN_PORT = 2222;
|
|
};
|
|
service = {
|
|
DISABLE_REGISTRATION = true;
|
|
};
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 2222 ];
|
|
|
|
users.users.gitea.extraGroups = [ "users" ];
|
|
}
|