commit 419027863b0dd7e37cee356873a10c554485ef4d · ryan.freumh.org/eilean-nix

+12 -7
modules/gitea.nix
···

       3
       3
        
       let

     

       4
       4
        
         cfg = config.eilean;

     

       5
       5
        
         domain = config.networking.domain;

     

       6
       6
       -
         sshPort = 3001;

     

       7
       6
        
       in {

     

       8
       8
       -
         options.eilean.gitea.enable = lib.mkEnableOption "gitea";

     

       7
       7
       +
         options.eilean.gitea = {

     

       8
       8
       +
           enable = lib.mkEnableOption "gitea";

     

       9
       9
       +
           sshPort = lib.mkOption {

     

       10
       10
       +
             type = lib.types.int;

     

       11
       11
       +
             default = 3001;

     

       12
       12
       +
           };

     

       13
       13
       +
         };

     

       9
       14
        
       

     

       10
       15
        
         config = lib.mkIf cfg.gitea.enable {

     

       11
       16
        
           services.nginx = {

     
···

       97
       102
        
       

     

       98
       103
        
           networking.firewall.extraCommands = ''

     

       99
       104
        
             # proxy all traffic on public interface to the gitea SSH server

     

       100
       100
       -
             iptables -A PREROUTING -t nat -i ${config.eilean.publicInterface} -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString sshPort}

     

       101
       101
       -
             ip6tables -A PREROUTING -t nat -i ${config.eilean.publicInterface} -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString sshPort}

     

       105
       105
       +
             iptables -A PREROUTING -t nat -i ${config.eilean.publicInterface} -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString cfg.gitea.sshPort}

     

       106
       106
       +
             ip6tables -A PREROUTING -t nat -i ${config.eilean.publicInterface} -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString cfg.gitea.sshPort}

     

       102
       107
        
       

     

       103
       108
        
             # proxy locally originating outgoing packets

     

       104
       104
       -
             iptables -A OUTPUT -d ${config.eilean.serverIpv4} -t nat -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString sshPort}

     

       105
       105
       -
             ip6tables -A OUTPUT -d ${config.eilean.serverIpv6} -t nat -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString sshPort}

     

       109
       109
       +
             iptables -A OUTPUT -d ${config.eilean.serverIpv4} -t nat -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString cfg.gitea.sshPort}

     

       110
       110
       +
             ip6tables -A OUTPUT -d ${config.eilean.serverIpv6} -t nat -p tcp --dport 22 -j REDIRECT --to-port ${builtins.toString cfg.gitea.sshPort}

     

       106
       111
        
           '';

     

       107
       112
        
       

     

       108
       113
        
           services.gitea.settings.server = {

     

       109
       114
        
             START_SSH_SERVER = true;

     

       110
       110
       -
             SSH_LISTEN_PORT = sshPort;

     

       115
       115
       +
             SSH_LISTEN_PORT = cfg.gitea.sshPort;

     

       111
       116
        
           };

     

       112
       117
        
         };

     

       113
       118
        
       }