Forgejo

Self-hosted lightweight software forge. https://forgejo.org

Prerequisites

To allow SSH access to forgejo’s built-in SSH server, a firewall rule needs to be added to the host using the correct interface name. In the below usage example, the interface name is enp3s0.

Usage

momo-cloud.forgejo = {
  enable = true;
  sshListenInterface = "enp3s0";
  sshServerHostKeysFile = config.age.secrets."forgejo-ssh-host-key".path;
  repositorySigningPublicKeyFile = config.age.secrets."forgejo-repository-signing-key.pub".path;
  repositorySigningPrivateKeyFile = config.age.secrets."forgejo-repository-signing-key".path;
  oidcSecretFile = config.age.secrets."forgejo-oidc-secret".path;
};

There are two kanidm groups for using forgejo:

1. forgejo_admins: grants admin rights (not implemented)
2. forgejo_users: allows users to access the application

Secrets

oidcSecretFile

Generate the OIDC secret, used by services.kanidm.provision:

openssl rand -hex 24

sshServerHostKeysFile

Generate the SSH server host key with an empty passphrase, used by services.forgejo.settings.server.SSH_SERVER_HOST_KEYS:

ssh-keygen -t ed25519

repositorySigningPublicKeyFile and repositorySigningPrivateKeyFile

Generate the repository signing key with an empty passphrase, used by services.forgejo.settings."repository.signing".SIGNING_KEY Set this to the public key path. Note that the value for the SIGNING_KEY setting needs to be an absolute path to the public key, where the private key needs to be available in the same directory without the .pub suffix.

ssh-keygen -t ed25519

Troubleshooting

After initial deployment, a restart of nginx.service might be required because the nginx UNIX user needs to be part of the anubis group.