refactor: split server modules into smaller more manageable files

modules/nixos-modules/server/forgejo/const.nix

@@ -0,0 +1,4 @@
+{
+  httpPort = 8081;
+  sshPort = 22222;
+}

modules/nixos-modules/server/forgejo/database.nix

@@ -0,0 +1,41 @@
+{
+  lib,
+  config,
+  ...
+}: {
+  config = lib.mkIf config.services.forgejo.enable (
+    lib.mkMerge [
+      {
+        host = {
+          postgres = {
+            enable = true;
+          };
+        };
+
+        assertions = [
+          {
+            assertion = config.services.forgejo.settings.database.DB_TYPE == "postgres";
+            message = "Forgejo database type must be postgres";
+          }
+        ];
+      }
+      (lib.mkIf config.host.postgres.enable {
+        host = {
+          postgres = {
+            extraUsers = {
+              forgejo = {
+                isClient = true;
+                createUser = true;
+              };
+            };
+            extraDatabases = {
+              forgejo = {
+                name = "forgejo";
+              };
+            };
+          };
+        };
+      })
+    ]
+  );
+}

modules/nixos-modules/server/forgejo/default.nix

@@ -0,0 +1,61 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  const = import ./const.nix;
+  httpPort = const.httpPort;
+  sshPort = const.sshPort;
+  db_user = "forgejo";
+in {
+  imports = [
+    ./proxy.nix
+    ./database.nix
+    ./fail2ban.nix
+    ./impermanence.nix
+  ];
+
+  options.services.forgejo = {
+    subdomain = lib.mkOption {
+      type = lib.types.str;
+      description = "subdomain of base domain that forgejo will be hosted at";
+      default = "forgejo";
+    };
+  };
+
+  config = lib.mkIf config.services.forgejo.enable {
+    assertions = [
+      {
+        assertion = config.services.forgejo.settings.server.BUILTIN_SSH_SERVER_USER == config.users.users.git.name;
+        message = "Forgejo BUILTIN_SSH_SERVER_USER hardcoded value does not match expected git user name";
+      }
+    ];
+
+    services.forgejo = {
+      database = {
+        type = "postgres";
+        socket = "/run/postgresql";
+      };
+      lfs.enable = true;
+      settings = {
+        server = {
+          DOMAIN = "${config.services.forgejo.subdomain}.${config.host.reverse_proxy.hostname}";
+          HTTP_PORT = httpPort;
+          START_SSH_SERVER = true;
+          SSH_LISTEN_PORT = sshPort;
+          SSH_PORT = 22;
+          BUILTIN_SSH_SERVER_USER = "git";
+          ROOT_URL = "https://git.jan-leila.com";
+        };
+        service = {
+          DISABLE_REGISTRATION = true;
+        };
+        database = {
+          DB_TYPE = "postgres";
+          NAME = db_user;
+          USER = db_user;
+        };
+      };
+    };
+  };
+}

modules/nixos-modules/server/forgejo/fail2ban.nix

@@ -0,0 +1,32 @@
+{
+  lib,
+  config,
+  pkgs,
+  ...
+}: {
+  config = lib.mkIf (config.services.forgejo.enable && config.services.fail2ban.enable) {
+    environment.etc = {
+      "fail2ban/filter.d/forgejo.local".text = lib.mkIf config.services.forgejo.enable (
+        pkgs.lib.mkDefault (pkgs.lib.mkAfter ''
+          [Definition]
+          failregex = ".*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from <HOST>"
+        '')
+      );
+    };
+
+    services.fail2ban = {
+      jails = {
+        forgejo-iptables.settings = lib.mkIf config.services.forgejo.enable {
+          enabled = true;
+          filter = "forgejo";
+          action = ''iptables-multiport[name=HTTP, port="http,https"]'';
+          logpath = "${config.services.forgejo.settings.log.ROOT_PATH}/*.log";
+          backend = "auto";
+          findtime = 600;
+          bantime = 600;
+          maxretry = 5;
+        };
+      };
+    };
+  };
+}

modules/nixos-modules/server/forgejo/impermanence.nix

@@ -0,0 +1,28 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  stateDir = "/var/lib/forgejo";
+in {
+  config = lib.mkIf (config.services.forgejo.enable && config.host.impermanence.enable) {
+    assertions = [
+      {
+        assertion = config.services.forgejo.stateDir == stateDir;
+        message = "forgejo state directory does not match persistence";
+      }
+    ];
+
+    environment.persistence."/persist/system/root" = {
+      enable = true;
+      hideMounts = true;
+      directories = [
+        {
+          directory = stateDir;
+          user = "forgejo";
+          group = "forgejo";
+        }
+      ];
+    };
+  };
+}

modules/nixos-modules/server/forgejo/proxy.nix

@@ -0,0 +1,18 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  const = import ./const.nix;
+  httpPort = const.httpPort;
+in {
+  config = lib.mkIf (config.services.forgejo.enable && config.host.reverse_proxy.enable) {
+    host.reverse_proxy.subdomains.${config.services.forgejo.subdomain} = {
+      target = "http://localhost:${toString httpPort}";
+    };
+
+    networking.firewall.allowedTCPPorts = [
+      config.services.forgejo.settings.server.SSH_LISTEN_PORT
+    ];
+  };
+}