nixos: migrate server services to thegeneralist

Move hosted services and secrets from the retired central hosts, persist USB storage and ownership, harden RTL8822BU Wi-Fi, repair DNS behavior, and order CoreDNS after Tailscale.

hosts/thegeneralist/forgejo/default.nix

@@ -0,0 +1,174 @@
+{ config, lib, pkgs, ... }:
+
+let
+  forgejoStateDir = "/mnt/usb/services/forgejo/stateDir";
+  domain = "git.thegeneralist01.com";
+in
+{
+  imports = [ ../../../modules/postgresql.nix ];
+
+  age.secrets.forgejoRunnerToken.file = ./forgejo-runner-token.age;
+
+  services.forgejo = {
+    enable = true;
+    stateDir = forgejoStateDir;
+
+    lfs.enable = true;
+
+    settings =
+      let
+        title = "thegeneralist01's forgejo";
+        desc = "the attic of thegeneralist01's random repositories";
+      in
+      {
+        default.APP_NAME = title;
+        "ui.meta" = {
+          AUTHOR = title;
+          DESCRIPTION = desc;
+        };
+
+        attachment.ALLOWED_TYPES = "*/*";
+        actions = {
+          ENABLED = true;
+        };
+        cache.ENABLED = true;
+
+        "cron.archive_cleanup" =
+          let
+            interval = "4h";
+          in
+          {
+            SCHEDULE = "@every ${interval}";
+            OLDER_THAN = interval;
+          };
+
+        packages.ENABLED = true;
+        mailer = {
+          ENABLED = false;
+
+          # PROTOCOL = "smtps";
+          # SMTP_ADDR = self.disk.mailserver.fqdn;
+          # USER = "git@${domain}";
+        };
+
+        other = {
+          SHOW_FOOTER_TEMPLATE_LOAD_TIME = false;
+          SHOW_FOOTER_VERSION = false;
+        };
+
+        repository = {
+          DEFAULT_BRANCH = "master";
+          DEFAULT_MERGE_STYLE = "rebase-merge";
+          DEFAULT_REPO_UNITS = "repo.code, repo.issues, repo.pulls";
+
+          DEFAULT_PUSH_CREATE_PRIVATE = false;
+          ENABLE_PUSH_CREATE_ORG = true;
+          ENABLE_PUSH_CREATE_USER = true;
+
+          DISABLE_STARS = true;
+        };
+
+        "repository.upload" = {
+          FILE_MAX_SIZE = 100;
+          MAX_FILES = 10;
+        };
+
+        server = {
+          ROOT_URL = "https://${domain}/";
+          DOMAIN = domain;
+          LANDING_PAGE = "/explore";
+
+          HTTP_ADDR = "127.0.0.1";
+          HTTP_PORT = 3000;
+
+          SSH_LISTEN_HOST = "0.0.0.0";
+          SSH_PORT = 2222;
+          SSH_LISTEN_PORT = 2222;
+        };
+
+        service.DISABLE_REGISTRATION = true;
+
+        session = {
+          COOKIE_SECURE = true;
+          SAME_SITE = "strict";
+        };
+      };
+  };
+
+  systemd.services.forgejo = {
+    requires = [ "forgejo-data-ownership.service" ];
+    after = [ "forgejo-data-ownership.service" ];
+  };
+
+  systemd.services.forgejo-data-ownership = {
+    description = "Prepare persisted Forgejo state";
+    unitConfig.RequiresMountsFor = [ forgejoStateDir ];
+    before = [ "forgejo.service" ];
+    serviceConfig.Type = "oneshot";
+    script = ''
+      marker=${forgejoStateDir}/.nixos-ownership-v1
+      if [ ! -e "$marker" ]; then
+        ${pkgs.coreutils}/bin/chown -R forgejo:forgejo ${forgejoStateDir}
+        ${pkgs.coreutils}/bin/touch "$marker"
+        ${pkgs.coreutils}/bin/chown forgejo:forgejo "$marker"
+      fi
+    '';
+  };
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.thegeneralist = {
+      enable = true;
+      name = "thegeneralist";
+      url = "https://${domain}";
+      tokenFile = config.age.secrets.forgejoRunnerToken.path;
+      labels = [
+        "native:host"
+        # "node-22:docker://node:22-bookworm"
+        # "nixos-latest:docker://nixos/nix"
+      ];
+
+      # Host-executed jobs need nix + ssh in PATH.
+      hostPackages = with pkgs; [
+        bash
+        coreutils
+        curl
+        gawk
+        gitMinimal
+        gnused
+        nodejs
+        nix
+        openssh
+        wget
+      ];
+    };
+  };
+
+  networking.firewall.trustedInterfaces = [ "br-+" ];
+
+
+  # Avoid /var/lib/private so the runner can write its state.
+  systemd.services.gitea-runner-thegeneralist.serviceConfig = {
+    DynamicUser = lib.mkForce false;
+    StateDirectory = lib.mkForce "gitea-runner";
+    StateDirectoryMode = "0755";
+    # Ensure newly created files are group-writable for the shared repo.
+    UMask = "0002";
+  };
+
+  users.groups.gitea-runner = { };
+  users.users.gitea-runner = {
+    isSystemUser = true;
+    group = "gitea-runner";
+    extraGroups = [ "users" ];
+    home = "/var/lib/gitea-runner/thegeneralist";
+    createHome = true;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/gitea-runner 0755 gitea-runner gitea-runner -"
+    "d /var/lib/gitea-runner/thegeneralist 0755 gitea-runner gitea-runner -"
+  ];
+
+  networking.firewall.allowedTCPPorts = [ 2222 ];
+}

hosts/thegeneralist/forgejo/forgejo-runner-token.age

@@ -0,0 +1,6 @@
+age-encryption.org/v1
+-> ssh-ed25519 pp9qdQ 3zI5p1EPKcJdRWK0ZikK7MEwLON9oX2qRy0Ll8+7rXE
++66HhKgUa3AsYO4gHQmlypR7CgkdaQI7goZCPTHGxEE
+--- R+2xHNQawIBenqYp5t4s7XGDeDLt9cFZXprJSNHe8dE
+74›îA<0X”oexõúVüåÂn²#AÁeàDSã}þb¡§I ¤´Ðh“ÔÇD!`¥QB¿œˆ[û:ˆÛÙúf§$æñÁ™¦—ÏC?2Û“›Möþ
Ô‰ƒNC÷ŸU2¡ÉNuèý
+¸é@&Ç s‚©«÷ؽ‹Ìs…ñ<E280A6>DÉãsdÚÐÞÓ–D¸Xˆ1nØJ