feat: init codeberg-pages

lib/mkmachine.nix

@@ -53,6 +53,7 @@ import "${nixpkgs}/nixos/lib/eval-config.nix" {
           # My own packages
           keycloak-keywind = prev.pkgs.callPackage ../packages/keycloak-keywind { };
           hydrasect = prev.pkgs.callPackage ../packages/hydrasect { };
+          codeberg-pages-custom = prev.pkgs.callPackage ../packages/codeberg-pages-custom { };
         })
       ];
     }

modules/codeberg-pages/default.nix

@@ -0,0 +1,66 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+with lib;
+
+let
+  cfg = config.services.codeberg-pages;
+in
+{
+
+  options = {
+    services.codeberg-pages = {
+      enable = mkEnableOption "Codeberg pages server";
+
+      package = mkPackageOption pkgs "codeberg-pages" { };
+
+      settings = lib.mkOption {
+        type = lib.types.submodule { freeformType = with lib.types; attrsOf str; };
+        default = { };
+        example = { };
+        description = ''
+          Configuration for the codeberg page server, see
+          <https://codeberg.org/Codeberg/pages-server>
+          for supported values.
+        '';
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+
+    systemd.services.codeberg-pages = {
+      description = "Codeberg pages server";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      environment = cfg.settings;
+      serviceConfig = {
+        Type = "simple";
+        StateDirectory = "codeberg-pages";
+        WorkingDirectory = "/var/lib/codeberg-pages";
+        DynamicUser = true;
+        ExecStart = "${cfg.package}/bin/pages";
+        Restart = "on-failure";
+        ProtectHome = true;
+        ProtectSystem = "strict";
+        PrivateTmp = true;
+        PrivateDevices = true;
+        ProtectHostname = true;
+        ProtectClock = true;
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        NoNewPrivileges = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        RemoveIPC = true;
+        PrivateMounts = true;
+      };
+    };
+  };
+}

packages/codeberg-pages-custom/default.nix

@@ -0,0 +1,53 @@
+{
+  lib,
+  fetchFromGitea,
+  buildGoModule,
+  nix-update-script,
+}:
+
+buildGoModule rec {
+  pname = "codeberg-pages";
+  version = "5.1";
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "Codeberg";
+    repo = "pages-server";
+    rev = "9524b1eb12f77fa345cc8a220f67ae244da0ab12";
+    hash = "sha256-RZjwy0Vdqu2XdF14hwXvQ7Bj11+1Q2VxDm1GTU1brA8=";
+  };
+
+  patches = [ ./update-lego.patch ];
+
+  vendorHash = "sha256-TivaGyKR5axr+DX/hvt4u5qbxyc2AqL5jVDuTG7zf3g=";
+
+  postPatch = ''
+    # disable httptest
+    rm server/handler/handler_test.go
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+  ];
+
+  tags = [
+    "sqlite"
+    "sqlite_unlock_notify"
+    "netgo"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = with lib; {
+    mainProgram = "pages";
+    maintainers = with maintainers; [
+      laurent-f1z1
+      christoph-heiss
+    ];
+    license = licenses.eupl12;
+    homepage = "https://codeberg.org/Codeberg/pages-server";
+    description = "Static websites hosting from Gitea repositories";
+    changelog = "https://codeberg.org/Codeberg/pages-server/releases/tag/v${version}";
+  };
+}