From d083b69cd6ef0a690e8ce9ebc6690b219a39425b Mon Sep 17 00:00:00 2001
From: tux <t@tux.rs>
Date: Sun, 9 Aug 2026 20:14:59 +0530
Subject: [PATCH] feat: add gitea module

---
 modules/nixos/services/gitea.nix | 123 +++++++++++++++++++++++++++++++
 1 file changed, 123 insertions(+)
 create mode 100644 modules/nixos/services/gitea.nix

diff --git a/modules/nixos/services/gitea.nix b/modules/nixos/services/gitea.nix
new file mode 100644
index 0000000..743159a
--- /dev/null
+++ b/modules/nixos/services/gitea.nix
@@ -0,0 +1,123 @@
+{
+  flake.modules.nixos.services =
+    {
+      config,
+      lib,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.services.gitea;
+      port = toString cfg.port;
+      acmeHost = config.tnix.services.nginx.domain;
+    in
+    {
+      options.tnix.services.gitea = {
+        enable = mkEnableOption "Gitea";
+
+        host = mkOption {
+          type = types.str;
+          default = "127.0.0.1";
+          description = "Host on which Gitea listens";
+        };
+
+        port = mkOption {
+          type = types.port;
+          default = 1114;
+          description = "Port on which Gitea listens";
+        };
+
+        domain = mkOption {
+          type = types.str;
+          default = "";
+          description = "Domain on which Gitea is available";
+        };
+
+        configureNginx = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether to configure Nginx as a reverse proxy for Gitea";
+        };
+
+        configurePangolin = mkOption {
+          type = types.bool;
+          default = false;
+          description = "Whether to configure Pangolin as a reverse proxy for Gitea";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        assertions = [
+          {
+            assertion = cfg.domain != "";
+            message = "tnix.services.gitea.domain must be set when tnix.services.gitea.enable is true.";
+          }
+        ];
+
+        services = {
+          gitea = {
+            enable = true;
+            settings = {
+              service.DISABLE_REGISTRATION = true;
+              server = {
+                HTTP_ADDR = cfg.host;
+                HTTP_PORT = cfg.port;
+                DOMAIN = cfg.domain;
+                ROOT_URL = "https://${cfg.domain}";
+              };
+            };
+            database = {
+              type = "postgres";
+              name = "gitea";
+              user = "gitea";
+            };
+          };
+
+          nginx.virtualHosts.${cfg.domain} = mkIf cfg.configureNginx {
+            forceSSL = acmeHost != "";
+            useACMEHost = mkIf (acmeHost != "") acmeHost;
+            locations."/" = {
+              proxyPass = "http://${cfg.host}:${port}";
+              proxyWebsockets = true;
+            };
+          };
+
+          newt.blueprint.proxy-resources = mkIf cfg.configurePangolin {
+            gitea = {
+              auth = {
+                sso-enabled = false;
+              };
+              full-domain = cfg.domain;
+              name = "gitea";
+              protocol = "http";
+              targets = [
+                {
+                  hostname = "localhost";
+                  method = "http";
+                  port = cfg.port;
+                  healthcheck = {
+                    hostname = "localhost";
+                    port = cfg.port;
+                    scheme = "http";
+                    method = "GET";
+                    path = "/";
+                  };
+                }
+              ];
+            };
+          };
+
+          postgresql = {
+            enable = true;
+            ensureDatabases = [ "gitea" ];
+            ensureUsers = [
+              {
+                name = "gitea";
+                ensureDBOwnership = true;
+              }
+            ];
+          };
+        };
+      };
+    };
+}