quasar/sourcehut.nix

# vim: tabstop=2 shiftwidth=2 expandtab
{ base-domain, ... }:
let
  fqdn = "sourcehut.${base-domain}";
in
{
  # workaround: https://github.com/NixOS/nixpkgs/issues/317865
  programs.git.config.safe.directory = "*";
  services.sourcehut = {
    enable = true;
    meta = {
      enable = true;
    };
    git = {
      enable = true;
    };
    nginx.enable = true;
    postgresql.enable = true;
    redis.enable = true;
    settings = {
      "sr.ht" = {
        environment = "production";
        site-blurb = "logistic-bot's forge";
        global-domain = fqdn;
        origin = "https://${fqdn}";
        network-key = "/etc/nixos/secrets/sourcehut/network.key";
        service-key = "/etc/nixos/secrets/sourcehut/service.key";
      };
      "meta.sr.ht" = {
        onboarding-redirect = "https://meta.${fqdn}";
        origin = "https://meta.${fqdn}";
      };
      "git.sr.ht" = {
        oauth-client-id = "";
        oauth-client-secret = "/etc/nixos/secrets/sourcehut/git.oauth";
        origin = "https://git.${fqdn}";
      };
      "mail" = {
        pgp-key-id = "/etc/nixos/secrets/sourcehut/mail.key.id";
        pgp-privkey = "/etc/nixos/secrets/sourcehut/mail.key";
        pgp-pubkey = "/etc/nixos/secrets/sourcehut/mail.key.pub";
        smtp-from = "mail@${fqdn}";
      };
      webhooks.private-key = "/etc/nixos/secrets/sourcehut/webhook.key";
    };
  };
}