flake/hosts/butterfly/services/forgejo.nix

{
  config,
  lib,
  ...
}: let
  cfg = config.services.forgejo;
in {
  # REF: https://github.com/NixOS/nixpkgs/blob/nixos-25.11/nixos/modules/services/misc/forgejo.nix
  # REF: forgejo doesn't create the user/group by default if its name isn't "forgejo"
  users.users = lib.mkIf (cfg.user != "forgejo") {
    ${cfg.user} = {
      home = cfg.stateDir;
      useDefaultShell = true;
      group = cfg.group;
      isSystemUser = true;
    };
  };
  users.groups = lib.mkIf (cfg.group != "forgejo") {
    ${cfg.group} = {};
  };

  # more options here: https://mynixos.com/nixpkgs/options/services.forgejo
  # TODO: set a favicon https://forgejo.org/docs/next/contributor/customization/#changing-the-logo
  #       (might need me to override settings in the nixpkg)
  # TODO: create a custom theme for forgejo (modify the source files most likely)
  services.forgejo = {
    enable = true;

    # XXX: WARNING: XXX: WARNING: XXX: TODO: set user="git" and settings.server.SSH_PORT=22
    # XXX: WARNING: XXX: WARNING: XXX: TODO: (currently both cause errors)
    # XXX: WARNING: XXX: WARNING: XXX: TODO: THE USER FAILS I THINK CAUSE THE DIRECTORY DOESNT CHANGE THE USER PERMISSIONS

    user = "git"; # user forgejo runs as
    # group = "forgejo"; # group forgejo runs as
    # stateDir = "/var/lib/forgejo";

    # enable support for Git Large File Storage
    lfs.enable = true;
    database = {
      type = "sqlite3"; # postgres
      host = "127.0.0.1";
      port = "3306"; # 5432 if postgres
    };
    # settings are written directly to the `app.ini` config file
    # refer to: https://forgejo.org/docs/latest/admin/config-cheat-sheet/
    settings = {
      server = {
        # ENABLE_ACME = true;
        # ACME_EMAIL = "them@dobutterfliescry.net";
        DOMAIN = "tearforge.net";
        ROOT_URL = "https://tearforge.net";
        # address and port to listen on
        HTTP_ADDR = "127.0.0.1";
        HTTP_PORT = 3000;
        PROTOCOL = "http"; # http internally, reverse proxy uses https externally

        START_SSH_SERVER = true;
        DISABLE_SSH = false;
        SSH_PORT = 2222;
      };

      DEFAULT = {
        APP_NAME = "tearforge";
        APP_SLOGIN = "but cozy";
        APP_DISPLAY_NAME_FORMAT = "{APP_NAME} ::{APP_SLOGAN}::";
      };

      repository = {
        DEFAULT_PRIVATE = "private"; # last, private, public
        # repo/org created on push to non-existent
        ENABLE_PUSH_CREATE_USER = true;
        ENABLE_PUSH_CREATE_ORG = true;
        DEFAULT_PUSH_CREATE_PRIVATE = true;
        MAX_CREATION_LIMIT = -1;
      };

      "repository.upload" = {
        # max per-file size in MB
        FILE_MAX_SIZE = 50;
        # max number of files per upload
        MAX_FILES = 5;
      };

      badges = let
        # flat, flat-square, plastic, for-the-badge, social
        style = "for-the-badge";
      in {
        ENABLED = true;
        GENERATOR_URL_TEMPLATE = "https://img.shields.io/badge/{{.label}}-{{.text}}-{{.color}}?style=${style}";
      };

      ui = {
        DEFAULT_THEME = "forgejo-dark";
        THEMES = "forgejo-auto,forgejo-light,forgejo-dark";
      };
      "ui.meta" = {
        AUTHOR = "Emile Clark-Boman - emileclarkb";
        DESCRIPTION = "This is my personal self-hosted git forge, where I keep and maintain personal projects! PS do butterflies cry when they're sad?";
        KEYWORDS = "emile,clark,boman,clarkboman,emileclarkb,git,forge,forgejo,self-hosted,dobutterfliescry,butterfly,butterflies,cry,tearforge";
      };

      markdown = {
        ENABLE_HARD_LINE_BREAK_IN_COMMENTS = true;
        ENABLE_MATH = true;
      };

      admin = {
        DEFAULT_EMAIL_NOTIFICATIONS = "enabled";
        SEND_NOTIFICATION_EMAIL_ON_NEW_USER = true;
      };

      security = {
        # Controls access to the installation page.
        # When set to “true”, the installation page is not accessible.
        #INSTALL_LOCK = false;

        PASSWORD_HASH_ALGO = "argon2"; # ARGON2 BEST ALGO FR!! (default: argon2$2$65536$8$50)
        MIN_PASSWORD_LENGTH = 12;
        PASSWORD_COMPLEXITY = "lower,upper,digit,spec";
        PASSWORD_CHECK_PWN = true;
      };

      service = {
        DISABLE_REGISTRATION = true; # toggle for new users
        #DEFAULT_USER_IS_RESTRICTED = true;
        # Forbid login with third-party services (ie github)
        ALLOW_ONLY_INTERNAL_REGISTRATION = true;
        ENABLE_CAPTCHA = true;
        REQUIRE_CAPTCHA_FOR_LOGIN = true;
        REQUIRE_EXTERNAL_REGISTRATION_CAPTCHA = true;
        LOGIN_REMEMBER_DAYS = 365;
        ENABLE_NOTIFY_MAIL = true;
      };
      "service.explore" = {
        REQUIRE_SIGNIN_VIEW = false;
        DISABLE_USERS_PAGE = false;
        DISABLE_ORGANIZATIONS_PAGE = false;
        DISABLE_CODE_PAGE = false;
      };

      cache = {
        ADAPTER = "twoqueue";
        HOST = "{\"size\":100, \"recent_ratio\":0.25, \"ghost_ratio\":0.5}";
        ITEM_TTL = "16h";
      };

      # TODO: fill this in once my mail server is configured
      # email.incoming = { ... };

      # optional
      mailer = {
        ENABLED = false;
        SMTP_ADDR = "mail.tearforge.net";
        FROM = "noreply@tearforge.net";
        USER = "noreply@tearforge.net";
      };

      log = {
        MODE = "file";
        LEVEL = "Info"; # "Trace", "Debug", "Info", "Warn", "Error", "Critical"
        ENABLE_SSH_LOG = true;
      };

      cron = {
        ENABLED = true;
        RUN_AT_START = false;
      };

      other = {
        SHOW_FOOTER_VERSION = true;
        SHOW_FOOTER_TEMPLATE_LOAD_TIME = true;
        SHOW_FOOTER_POWERED_BY = true;
        ENABLE_SITEMAP = true;
        ENABLE_FEED = true;
      };
    };
  };
}