84 lines
2.5 KiB
Terraform
84 lines
2.5 KiB
Terraform
|
data "docker_registry_image" "forgejo" {
|
||
|
|
name = "codeberg.org/forgejo/forgejo:1.21"
|
||
|
|
}
|
||
|
|
|
||
|
|
data "docker_network" "traefik" {
|
||
|
|
name = "traefik"
|
||
|
|
}
|
||
|
|
|
||
|
|
locals {
|
||
|
|
labels = {
|
||
|
|
"shepherd.auto-update" = "true",
|
||
|
|
"traefik.enable" = "true"
|
||
|
|
"traefik.http.services.forgejo.loadbalancer.server.port" = "3000",
|
||
|
|
"traefik.http.routers.forgejo.rule" = "Host(`git.chaoswest.tv`)",
|
||
|
|
"traefik.http.routers.forgejo.tls" = "true",
|
||
|
|
"traefik.http.routers.forgejo.tls.certresolver" = "default",
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "docker_service" "forgejo" {
|
||
|
|
name = "forgejo"
|
||
|
|
|
||
|
|
dynamic "labels" {
|
||
|
|
for_each = local.labels
|
||
|
|
content {
|
||
|
|
label = labels.key
|
||
|
|
value = labels.value
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
task_spec {
|
||
|
|
networks_advanced {
|
||
|
|
name = data.docker_network.traefik.id
|
||
|
|
}
|
||
|
|
|
||
|
|
container_spec {
|
||
|
|
image = "${data.docker_registry_image.forgejo.name}@${data.docker_registry_image.forgejo.sha256_digest}"
|
||
|
|
|
||
|
|
env = {
|
||
|
|
USER_UID = "1000"
|
||
|
|
USER_GID = "1000"
|
||
|
|
FORGEJO__server__DOMAIN = "git.chaoswest.tv"
|
||
|
|
# Enabling checkouts via SSH through docker is possible, but not worth the effort
|
||
|
|
FORGEJO__server__DISABLE_SSH = "true"
|
||
|
|
FORGEJO__server__ROOT_URL = "https://git.chaoswest.tv"
|
||
|
|
# Login only through Authentik
|
||
|
|
FORGEJO__service__DISABLE_REGISTRATION = "false"
|
||
|
|
FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION = "true"
|
||
|
|
FORGEJO__openid__ENABLE_OPENID_SIGNIN = "false"
|
||
|
|
FORGEJO__openid__ENABLE_OPENID_SIGNUP = "false"
|
||
|
|
# Allow everyone to create an account through Authentik
|
||
|
|
FORGEJO__oauth2_client__ENABLE_AUTO_REGISTRATION = "true"
|
||
|
|
# Disable users from being able to create repos/orgs without admin intervention
|
||
|
|
FORGEJO__repository__MAX_CREATION_LIMIT = "0"
|
||
|
|
FORGEJO__admin__DISABLE_REGULAR_ORG_CREATION = "true"
|
||
|
|
}
|
||
|
|
|
||
|
|
mounts {
|
||
|
|
target = "/data"
|
||
|
|
source = "/mnt/data/forgejo/"
|
||
|
|
type = "bind"
|
||
|
|
}
|
||
|
|
|
||
|
|
mounts {
|
||
|
|
target = "/etc/localtime"
|
||
|
|
source = "/etc/localtime"
|
||
|
|
type = "bind"
|
||
|
|
read_only = true
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
data "hetznerdns_zone" "primary" {
|
||
|
|
name = "chaoswest.tv"
|
||
|
|
}
|
||
|
|
|
||
|
|
resource "hetznerdns_record" "primary" {
|
||
|
|
zone_id = data.hetznerdns_zone.primary.id
|
||
|
|
name = "git"
|
||
|
|
value = "ax41-1.fsn.mon2.de."
|
||
|
|
type = "CNAME"
|
||
|
|
}
|