Add forgejo on git.hunner.dev

hosts/ruil/modules/forgejo.nix

@@ -0,0 +1,51 @@
+{ config, ... }:
+
+let
+  domain = "git.hunner.dev";
+  port = 3000;
+in
+{
+  services.forgejo = {
+    enable = true;
+    user = "git";
+    group = "git";
+    lfs.enable = true;
+
+    settings = {
+      DEFAULT.APP_NAME = domain;
+
+      server = {
+        DOMAIN = domain;
+        ROOT_URL = "https://${domain}/";
+        HTTP_ADDR = "127.0.0.1";
+        HTTP_PORT = port;
+        DISABLE_SSH = false;
+        SSH_DOMAIN = domain;
+        SSH_PORT = 22;
+      };
+
+      session.COOKIE_SECURE = true;
+      service.DISABLE_REGISTRATION = false;
+    };
+  };
+
+  # Forgejo on git.hunner.dev (Cloudflare proxy -> nginx -> localhost:3000).
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString port}";
+      proxyWebsockets = true;
+      recommendedProxySettings = true;
+    };
+  };
+
+  users.users.git = {
+    home = config.services.forgejo.stateDir;
+    useDefaultShell = true;
+    group = "git";
+    isSystemUser = true;
+  };
+
+  users.groups.git = { };
+}