feat: replace gitea with forgejo and move to MOMO

flake.lock

@@ -52,11 +52,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1762276996,
-        "narHash": "sha256-TtcPgPmp2f0FAnc+DMEw4ardEgv1SGNR3/WFGH0N19M=",
+        "lastModified": 1764627417,
+        "narHash": "sha256-D6xc3Rl8Ab6wucJWdvjNsGYGSxNjQHzRc2EZ6eeQ6l4=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "af087d076d3860760b3323f6b583f4d828c1ac17",
+        "rev": "5a88a6eceb8fd732b983e72b732f6f4b8269bef3",
         "type": "github"
       },
       "original": {
@@ -88,11 +88,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1762847253,
-        "narHash": "sha256-BWWnUUT01lPwCWUvS0p6Px5UOBFeXJ8jR+ZdLX8IbrU=",
+        "lastModified": 1764440730,
+        "narHash": "sha256-ZlJTNLUKQRANlLDomuRWLBCH5792x+6XUJ4YdFRjtO4=",
         "owner": "NixOS",
         "repo": "nixos-hardware",
-        "rev": "899dc449bc6428b9ee6b3b8f771ca2b0ef945ab9",
+        "rev": "9154f4569b6cdfd3c595851a6ba51bfaa472d9f3",
         "type": "github"
       },
       "original": {
@@ -104,27 +104,27 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1763334038,
-        "narHash": "sha256-LBVOyaH6NFzQ3X/c6vfMZ9k4SV2ofhpxeL9YnhHNJQQ=",
+        "lastModified": 1764677808,
+        "narHash": "sha256-H3lC7knbXOBrHI9hITQ7modLuX20mYJVhZORL5ioms0=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "4c8cdd5b1a630e8f72c9dd9bf582b1afb3127d2c",
+        "rev": "1aab89277eb2d87823d5b69bae631a2496cff57a",
         "type": "github"
       },
       "original": {
         "owner": "nixos",
-        "ref": "nixos-25.05",
+        "ref": "nixos-25.11",
         "repo": "nixpkgs",
         "type": "github"
       }
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1763421233,
-        "narHash": "sha256-Stk9ZYRkGrnnpyJ4eqt9eQtdFWRRIvMxpNRf4sIegnw=",
+        "lastModified": 1764667669,
+        "narHash": "sha256-7WUCZfmqLAssbDqwg9cUDAXrSoXN79eEEq17qhTNM/Y=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "89c2b2330e733d6cdb5eae7b899326930c2c0648",
+        "rev": "418468ac9527e799809c900eda37cbff999199b6",
         "type": "github"
       },
       "original": {

flake.nix

@@ -1,7 +1,7 @@
 {
   description = "nix los hier";
   inputs = {
-    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.05";
+    nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11";
     nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
     nixos-hardware.url = "github:NixOS/nixos-hardware/master";
     agenix = {
@@ -31,7 +31,10 @@
             { system.stateVersion = state; }
             agenix.nixosModules.default
             disko.nixosModules.disko
-            { environment.systemPackages = [ agenix.packages.${sys}.default ]; }
+            { 
+              nixpkgs.hostPlatform = nixpkgs.lib.mkDefault sys;
+              environment.systemPackages = [ agenix.packages.${sys}.default ];
+            }
           ];
         };
       };
@@ -40,7 +43,7 @@
       nixosConfigurations = nixpkgs.lib.mergeAttrsList (
         nixpkgs.lib.forEach [
           [ "APPA" "x86_64-linux" "23.05" ]
-          [ "MOMO" "x86_64-linux" "23.05" ]
+          [ "MOMO" "aarch64-linux" "25.11" ]
           [ "PABU" "x86_64-linux" "24.05" ]
         ] (uncurry mkSystem)
       );

hosts/APPA/services/adguard-home.nix

@@ -21,58 +21,92 @@
           {
             domain = "dryb.org";
             answer = "192.168.2.40";
+            enabled = true;
           }
           {
             domain = "speedport.ip";
             answer = "192.168.2.1";
+            enabled = true;
           }
           {
             domain = "speedport.dryb.org";
             answer = "192.168.2.1";
+            enabled = true;
           }
           {
             domain = "tplink.dryb.org";
             answer = "192.168.2.30";
+            enabled = true;
+          }
+          {
+            domain = "shell-server";
+            answer = "192.168.2.50";
+            enabled = true;
+          }
+          {
+            domain = "shell-infra";
+            answer = "192.168.2.51";
+            enabled = true;
+          }
+          {
+            domain = "shell-lamp";
+            answer = "192.168.2.52";
+            enabled = true;
           }
           {
             domain = "adguard.dryb.org";
             answer = "192.168.2.40";
-          }
-          {
-            domain = config.services.gitea.settings.server.DOMAIN;
-            answer = "192.168.2.40";
+            enabled = true;
           }
           {
             domain = config.services.nextcloud.hostName;
             answer = "192.168.2.40";
+            enabled = true;
           }
           {
             domain = "anki.dryb.org";
             answer = "192.168.2.40";
+            enabled = true;
           }
           {
             domain = "paperless.dryb.org";
             answer = "192.168.2.40";
+            enabled = true;
           }
           {
             domain = "jellyfin.dryb.org";
             answer = "192.168.2.40";
+            enabled = true;
           }
           {
             domain = "momo.dryb.org";
-            answer = "188.245.216.128";
+            answer = "144.24.175.22";
+            enabled = true;
           }
           {
-            domain = "momo.dryb.org";
-            answer = "2a01:4f8:1c1e:8abc::1";
+            domain = "git.dryb.org";
+            answer = "momo.dryb.org";
+            enabled = true;
           }
           {
             domain = "syncthing.dryb.org";
             answer = "momo.dryb.org";
+            enabled = true;
           }
           {
             domain = "vaultwarden.dryb.org";
             answer = "momo.dryb.org";
+            enabled = true;
+          }
+          {
+            domain = "miniflux.dryb.org";
+            answer = "momo.dryb.org";
+            enabled = true;
+          }
+          {
+            domain = "hedgedoc.dryb.org";
+            answer = "momo.dryb.org";
+            enabled = true;
           }
         ];
       };
@@ -99,11 +133,7 @@
   };
 
   networking.firewall = {
-    allowedTCPPorts = [ 53 8080 ];
-    allowedUDPPorts = [
-      53
-      67
-      547
-    ];
+    allowedTCPPorts = [ 53 ];
+    allowedUDPPorts = [ 53 67 547 ];
   };
 }

hosts/APPA/services/default.nix

@@ -4,7 +4,6 @@
     ./adguard-home.nix
     ./anki.nix
     ./ddclient.nix
-    ./gitea.nix
     ./homepage-dashboard.nix
     ./jellyfin.nix
     ./nextcloud.nix

hosts/APPA/services/gitea.nix

@@ -1,28 +0,0 @@
-{ config, ... }:
-{
-  age.secrets.passwords-gitea-db = {
-    file = ../../../secrets/passwords/gitea/db.age;
-    mode = "640";
-    owner = config.services.gitea.user;
-    group = config.services.gitea.group;
-  };
-
-  services.gitea = {
-    enable = true;
-    appName = "dryb.org: Gitea Service";
-    database = {
-      type = "postgres";
-      passwordFile = config.age.secrets.passwords-gitea-db.path;
-    };
-    settings = {
-      server = rec {
-        HTTP_PORT = 8003;
-        DOMAIN = "git.dryb.org";
-        ROOT_URL = "http://${DOMAIN}/";
-      };
-      service = {
-        DISABLE_REGISTRATION = true;
-      };
-    };
-  };
-}

hosts/APPA/services/homepage-dashboard.nix

@@ -2,6 +2,7 @@
   services.homepage-dashboard = {
     enable = true;
     listenPort = 8002;
+    allowedHosts = "localhost:8002,127.0.0.1:8002,dryb.org";
     settings = {
       title = "dryb.org";
       theme = "light";
@@ -79,11 +80,11 @@
             };
           }
           {
-            "Shelly Test" = {
-              description = "http://shelly-test.dryb.org (192.168.2.52)";
-              href = "http://shelly-test.dryb.org";
+            "Shelly Lamp" = {
+              description = "http://shelly-lamp.dryb.org (192.168.2.52)";
+              href = "http://shelly-lamp.dryb.org";
               icon = "shelly";
-              ping = "shelly-test.dryb.org";
+              ping = "shelly-lamp.dryb.org";
             };
           }
         ];
@@ -97,13 +98,6 @@
               icon = "nextcloud";
             };
           }
-          {
-            "Gitea" = {
-              description = "https://git.dryb.org";
-              href = "https://git.dryb.org";
-              icon = "gitea";
-            };
-          }
           {
             "Anki" = {
               description = "https://anki.dryb.org";

hosts/APPA/services/nextcloud.nix

@@ -11,7 +11,7 @@
 
   services.nextcloud = {
     enable = true;
-    package = pkgs.nextcloud31;
+    package = pkgs.nextcloud32;
     https = true;
     hostName = "nextcloud.dryb.org";
     database.createLocally = true;

hosts/APPA/services/nginx.nix

@@ -28,13 +28,6 @@
       useACMEHost = "dryb.org";
       forceSSL = true;
     };
-    virtualHosts."${config.services.gitea.settings.server.DOMAIN}" = {
-      useACMEHost = "dryb.org";
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:8003";
-      };
-    };
     virtualHosts."anki.dryb.org" = {
       useACMEHost = "dryb.org";
       forceSSL = true;

hosts/APPA/services/postgresql.nix

@@ -4,7 +4,6 @@
   services.postgresql = {
     enable = true;
     ensureDatabases = [
-      config.services.gitea.user
       config.services.paperless.user
     ];
 
@@ -18,13 +17,11 @@
     # type   database     DBuser  auth-method  mapping
     authentication = ''
       local  all          postgres  peer
-      local  gitea        all       ident        map=gitea-users
       local  paperless    all       ident        map=paperless-users
     '';
 
     # name               sysuser        dbuser
     identMap = ''
-      gitea-users        gitea          gitea
       paperless-users    paperless      paperless
     '';
   };

hosts/APPA/system.nix

@@ -22,7 +22,9 @@
     };
   };
 
-  services.logind.lidSwitch = "ignore";
+  services.logind.settings.Login.HandleLidSwitch = "ignore";
+
+  boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
 
   users.groups.media = { };
   systemd.tmpfiles.rules = [ "d /var/lib/media 2770 root media" ];

hosts/MOMO/default.nix

@@ -7,13 +7,6 @@
     ../../modules
   ];
 
-  bchmnn = {
-    network = {
-      resolved.enable = true;
-      networkd.enable = true;
-    };
-  };
-
   services.openssh = {
     settings = {
       PasswordAuthentication = false;

hosts/MOMO/hardware.nix

@@ -44,25 +44,15 @@
           };
           root = {
             name = "ROOT";
-            end = "-8G";
+            size = "100%";
             content = {
               type = "filesystem";
               format = "ext4";
               mountpoint = "/";
             };
           };
-          plainSwap = {
-            size = "100%";
-            content = {
-              type = "swap";
-              discardPolicy = "both";
-            };
-          };
         };
       };
     };
   };
-
-  networking.useDHCP = lib.mkDefault true;
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
 }

hosts/MOMO/network.nix

@@ -1,22 +1,27 @@
-{ ... }:
+{ lib, ... }:
 {
   networking = {
     hostName = "MOMO";
-    interfaces.enp1s0 = {
-      ipv6.addresses = [
+    defaultGateway = "10.0.0.1";
+    nameservers = [
+      "9.9.9.9"
+      "149.112.112.112"
+      "2620:fe::fe"
+      "2620:fe::9"
+    ];
+    interfaces.enp0s6 = {
+      ipv4.addresses = [
         {
-          address = "2a01:4f8:1c1e:8abc::1";
-          prefixLength = 64;
+          address = "10.0.0.183";
+          prefixLength = 24;
         }
       ];
     };
     defaultGateway6 = {
       address = "fe80::1";
-      interface = "enp1s0";
+      interface = "enp0s6";
     };
-    nameservers = [
-      "2a01:4ff:ff00::add:1"
-      "2a01:4ff:ff00::add:2"
-    ];
   };
+
+  networking.useDHCP = lib.mkDefault true;
 }

hosts/MOMO/services/default.nix

@@ -1,6 +1,7 @@
 {
   imports = [
     ./acme.nix
+    ./forgejo.nix
     ./hedgedoc.nix
     ./miniflux.nix
     ./nginx.nix

hosts/MOMO/services/forgejo.nix

@@ -0,0 +1,20 @@
+{ config, ... }: {
+  services.forgejo = {
+    enable = true;
+    database = {
+      type = "postgres";
+      createDatabase = true;
+    };
+    settings = {
+      server = rec {
+        HTTP_PORT = 8003;
+        HTTP_ADDR = "127.0.0.1";
+        DOMAIN = "git.dryb.org";
+        ROOT_URL = "https://${DOMAIN}/";
+      };
+      service = {
+        DISABLE_REGISTRATION = true;
+      };
+    };
+  };
+}

hosts/MOMO/services/nginx.nix

@@ -1,4 +1,4 @@
-{ ... }:
+{ config, ... }:
 {
   services.nginx = {
     enable = true;
@@ -8,11 +8,18 @@
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
 
-    virtualHosts."hedgedoc.dryb.org" = {
+    virtualHosts."${config.services.forgejo.settings.server.DOMAIN}" = {
       addSSL = true;
       enableACME = true;
       locations."/" = {
-        proxyPass = "http://127.0.0.1:8009";
+        proxyPass = "http://127.0.0.1:8003";
+      };
+    };
+    virtualHosts."vaultwarden.dryb.org" = {
+      addSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8005";
       };
     };
     virtualHosts."miniflux.dryb.org" = {
@@ -22,6 +29,13 @@
         proxyPass = "http://127.0.0.1:8008";
       };
     };
+    virtualHosts."hedgedoc.dryb.org" = {
+      addSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:8009";
+      };
+    };
     virtualHosts."syncthing.dryb.org" = {
       addSSL = true;
       enableACME = true;
@@ -29,13 +43,6 @@
         proxyPass = "http://127.0.0.1:8384";
       };
     };
-    virtualHosts."vaultwarden.dryb.org" = {
-      addSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:8005";
-      };
-    };
   };
 
   networking.firewall = {

hosts/MOMO/services/postgresql.nix

@@ -1,8 +1,11 @@
-{ ... }: {
+{ config, ... }: {
 
   services.postgresql = {
     enable = true;
-    ensureDatabases = [ "vaultwarden" "hedgedoc" ];
+    ensureDatabases = [
+      "vaultwarden"
+      "hedgedoc"
+    ];
 
     ensureUsers = [
       {
@@ -18,12 +21,14 @@
     # type   database     DBuser    auth-method  mapping
     authentication = ''
       local  all          postgres  peer
+      local  forgejo      all       ident        map=forgejo-users
       local  vaultwarden  all       ident        map=vaultwarden-users
       local  hedgedoc     all       ident        map=hedgedoc-users
     '';
 
     # name               sysuser        dbuser
     identMap = ''
+      forgejo-users      forgejo        forgejo
       vaultwarden-users  vaultwarden    vaultwarden
       hedgedoc-users     hedgedoc       hedgedoc
     '';

hosts/PABU/applications.nix

@@ -30,7 +30,6 @@
     # stuff
     nixd
     nixfmt-rfc-style
-    inputs.agenix.packages.x86_64-linux.default
     nix-output-monitor
     nvd
   ];

modules/core/network.nix

@@ -10,12 +10,6 @@
       nm = {
         enable = lib.mkEnableOption "nm";
       };
-      resolved = {
-        enable = lib.mkEnableOption "resolved";
-      };
-      networkd = {
-        enable = lib.mkEnableOption "networkd";
-      };
     };
   };
   config = {

secrets/passwords/gitea/db.age

@@ -1,11 +1,11 @@
 age-encryption.org/v1
--> ssh-ed25519 lfMVeg ejjgNEnMOnPNlvp6kHNN4+FTaURnw/khEyk71q4pmX4
-GO80ST5fOV2OggwXXnRxahancZJnSOE6XhKIzanf6xM
--> ssh-ed25519 ueRyzQ 4Wl+WB42XSsp6vplm22uAEeWP9TqxMcdmjlFGr7dCAo
-/IO0WGVrMQOaFq61E+xp9Lxdv2qRhvrabNV0UUqZ5QI
--> ssh-ed25519 IYnDOQ UM+pMKLlneDup00dYXRz3vIWY5LTbFRhpKE2KkT5RFM
-2/c1gonJkrk5Cwngks/Ib+IVNOWSuJmX4YymwvYv4x8
---- fUKSKeqg8Y9qCdKg0lZpL1OPZDkRgnmsHo16owGX1nM
-ïsÒÍn–
-š3dì„k²G4ÿóÊÉ@QñHá6?,4Td"P ˆÿ	ß`º|
;`ÖRŸgt¯
-]?‰M7Ó·úàÐþ<C390>Æ@•¢KäPÑt¶
+-> ssh-ed25519 lfMVeg sKw7P77Yj9ihIeOHoc02ZBEWJf79TK6DnrgB/486J0E
+YtZ7tkjnWH23rHN1XoWVvXIkCh9X5fTNXZq2sveiWCI
+-> ssh-ed25519 ueRyzQ dVvsSHh6jrphQUAu3Rz74JoW0+I/ta4lEy1c4kxYywo
+5bJw1bOwbxtdC63g74ey+4WDEXr55itKBhGF3jqxEyM
+-> ssh-ed25519 IYnDOQ R4qlE6Tr56MrRz8LJlmsUyyMtOGnWK2n+UNpdiHr9Ac
+kgCdfY+LRb7SGnx6trr7bE9oxku3XJoeVKnXpNMK5JY
+-> ssh-ed25519 HDF3Lg s+ztnMwn83F4Fj4sTT7ejYxfKnjg5dPTMgoKLFOMHh8
+bPbOkHMseBCzExS7FURgVzQEp2iTT/is/FL9V2bw8nE
+--- tDGtEh6zW4CoInvkAd5YPzGnv+erMiSyZcpkA9/H+6Q
+·TÔŒ+üGZ@
Ö“äx¾>5jjÊ•s?·šRè•ÙDmò¯µRVhx‰áIò9‰Í›¸–ûøüTOE:Å/©xÕËÄXcJ‚TŽ1c

secrets/passwords/paperless/admin.age

@@ -1,9 +1,12 @@
 age-encryption.org/v1
--> ssh-ed25519 lfMVeg cuYTx24l4NmkI6j3/LXlK/7AoSmGn91bVwsALwyEeg8
-u8kIquf9+b1D3pL2MWKk/uInbI+0IcNK7Cpe2fzmtFk
--> ssh-ed25519 ueRyzQ Ee63Opci8c5srBzPKRLK3AF5SGwC6MqGcKbHS1hlwX4
-2Sg/l9fADn6uFV2eRtV9cwluCGtateXR/fDF1n8+BLs
--> ssh-ed25519 IYnDOQ Fg5g+CIqJu08ApVV5zdPqXPvQ4PaC1MiYG2ANNEVMnE
-8DjMqxmcutUDD455tQDtcA76dedfqicO0CoBpjaWssI
---- H/6V7b1UEtCW0BbLpEwSm3T2M9kvYC/83wIKsDwZve8
-ù¶VÔxÌnËüfL´!÷ÁÛ€:àb›¡Ã`ö罋‹,Ky“¡¼-hI¨O6<0F>êVD2XŒÍ&Vq@“?
+-> ssh-ed25519 lfMVeg THPNrpb41SFy4x4+D3ZrMf8AuoRL8MQpn6DbCcEGgH4
+Qbo7PCCPwGhaMyEa2gRjmaN6t3us6NfG78r5h98rpZo
+-> ssh-ed25519 ueRyzQ jnoSbBMvEZAH/oHNqVr3T6ytyQ7/UQ/YCGzNy7a2YHI
+9wBXCDaemGH0qUnNYqoqU6BCsBLBzqEEFsICvrIqYLk
+-> ssh-ed25519 IYnDOQ TQN80BmcNxz6vD6adPftf4oGkB1oQXU7HuWkKfGFpgs
+P9FUyS+0muH8LUUDe2wqGY8gcIKyom6iuO9EqCGT1YM
+-> ssh-ed25519 HDF3Lg V47k+SMUvuCCnsLXbhgicyFZERGXhRfJPFw0bHqZFHk
+MkrS7g7R5NhoWvdXbJ4mx6ZgCq2ABUgsyq+KMLnLRd4
+--- N3GpbRoA+uqRkbnLAIaihurobQRgiEWGAQSPCHH3V8M
+Ü…ºÈi
+,±˜ùïÑœií¹®ŸkÃâé>‡o$ïƒñcÕ$mò~¼Ù¨z€Rø69³ÈkèþPoŒH8ßSf

secrets/secrets.nix

@@ -1,6 +1,6 @@
 let
   APPA = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGvQbYHiB17BfsvHBgPYJN50Th+da+rtbsTIjOSaT+1Y root@APPA";
-  MOMO = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQ8YOOaQj3NnMlTjlFX9iWDIpPMrO2W4EkL65GJP+y4 root@MOMO";
+  MOMO = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMHuXl/Llex0+xBmDJmJkwp4kT3mWRTfRPeyJDHgAJzM root@MOMO";
 
   gandalf = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAOG8Sja2i6nepkEkuxYdu86XbT9vS5uniBmZifSMZ0t jacob.bachmann@posteo.de";