fix: forgejo settings misplaced

home/terminal/ssh/default.nix

@@ -6,6 +6,7 @@
 }:
 let
   inherit (lib) mkIf;
+  inherit (osConfig.modules.meta) hostname;
 in
 mkIf config.programs.ssh.enable {
   programs.ssh = {
@@ -16,7 +17,7 @@ mkIf config.programs.ssh.enable {
         user = "deck";
         port = 22;
       };
-      vm = mkIf (osConfig.networking.hostName == "marr") {
+      vm = mkIf (hostname == "marr") {
         hostname = "192.168.122.152";
         user = "ny";
         port = 22;

hosts/raptus/default.nix

@@ -14,6 +14,7 @@ in
     (modulesPath + "/profiles/qemu-guest.nix")
     ./disk-config.nix
     ./forgejo.nix
+    ./forgejo-runner.nix
     ./headscale
     ./fail2ban.nix
   ];
@@ -41,7 +42,7 @@ in
       settings = {
         server = {
           url = "https://rusty.ccnlc.eu";
-          max_content_length = "50MB";
+          max_content_length = "1000MB";
           timeout = "30s";
           expose_version = false;
           expose_list = false;
@@ -76,8 +77,6 @@ in
     };
   };
 
-  services.headscale.enable = true;
-
   networking = {
     nftables.enable = true;
     firewall = {
@@ -85,37 +84,42 @@ in
       allowedTCPPorts = [
         80 # for acme challenges
         443
-      ] ++ [ config.services.endlessh.port ];
+      ];
     };
   };
 
   age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 
-  security.acme.defaults.email = "admin@ccnlc.eu";
+  security = {
-  security.acme.acceptTerms = true;
+    polkit.enable = true;
 
-  services.nginx = {
+    acme = {
-    package = pkgs.nginxQuic;
+      defaults.email = "admin@ccnlc.eu";
-    enable = true;
+      acceptTerms = true;
-    recommendedProxySettings = true;
+    };
-    recommendedTlsSettings = true;
-    clientMaxBodySize = "50M";
-    virtualHosts = builtins.listToAttrs [
-      (mkVHost "rusty.ccnlc.eu" 8000 true)
-    ];
   };
 
-  services.endlessh = {
+  services = {
-    enable = true;
+    fail2ban.enable = true;
-    port = 22;
+    headscale.enable = true;
+
+    nginx = {
+      package = pkgs.nginxQuic;
+      enable = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      clientMaxBodySize = "100M";
+      virtualHosts = builtins.listToAttrs [
+        (mkVHost "rusty.ccnlc.eu" 8000 true)
+      ];
+    };
+
+    endlessh = {
+      enable = true;
+      port = 22;
+      openFirewall = true;
+    };
   };
 
-  services.fail2ban.enable = true;
-
-  environment.systemPackages = map lib.lowPrio [
-    pkgs.curl
-    pkgs.gitMinimal
-  ];
-
   system.stateVersion = "24.11";
 }

hosts/raptus/forgejo-runner.nix

@@ -0,0 +1,49 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  inherit (lib) mkIf;
+  inherit (config.modules.meta) hostname;
+
+  cfg = config.services.forgejo;
+in
+{
+  config = mkIf cfg.enable {
+    services.gitea-actions-runner = {
+      package = pkgs.forgejo-runner;
+
+      instances."${hostname}" = {
+        enable = true;
+        name = "${hostname}";
+        tokenFile = config.age.secrets.forgejo-runner-token.path;
+        url = "https://git.ccnlc.eu";
+
+        labels = [
+          "debian-latest:docker://node:18-bullseye"
+          "ubuntu-latest:docker://node:18-bullseye"
+        ];
+
+        settings = {
+          runner = {
+            capacity = 2;
+            timeout = "2h";
+
+            shutdown_timeout = "5s";
+          };
+
+          cache.enabled = true;
+
+          container = {
+            force_pull = false;
+            force_rebuild = false;
+          };
+        };
+      };
+    };
+
+    virtualisation.docker.enable = true;
+  };
+}

hosts/raptus/forgejo.nix

@@ -16,21 +16,6 @@ in
       "L+ ${config.services.forgejo.customDir}/public/robots.txt - - - - ${robots.outPath}"
     ];
 
-  services.gitea-actions-runner = {
-    instances."raptus" = {
-      enable = true;
-      name = "raptus";
-      tokenFile = config.age.secrets.forgejo-runner-token.path;
-      url = "https://git.ccnlc.eu";
-      labels = [
-        "debian-latest:docker://node:18-bullseye"
-        "nixos:docker://ghcr.io/nydragon/runner@sha256:2d353515d7461fe493cb69f538ebf188944b0de8fd2613a652636fc75098acac"
-      ];
-    };
-  };
-
-  virtualisation.docker.enable = true;
-
   networking.firewall.allowedTCPPorts = [ sshPort ];
 
   services.nginx = {

options/default.nix

@@ -2,6 +2,7 @@
   imports = [
     ./media.nix
     ./fs.nix
+    ./meta.nix
 
     ./services
     ./system

options/meta.nix

@@ -0,0 +1,14 @@
+{ lib, ... }:
+let
+  inherit (lib) mkOption;
+  inherit (lib.types) nullOr str;
+in
+{
+  options.modules.meta = {
+    hostname = mkOption {
+      default = null;
+      type = nullOr str;
+      description = "The system's hostname.";
+    };
+  };
+}

options/system/networking/default.nix

@@ -1,6 +1,13 @@
+{ config, ... }:
+let
+  inherit (config.modules.meta) hostname;
+in
 {
   imports = [
     ./wifi.nix
     ./bluetooth.nix
   ];
+  config = {
+    networking.hostName = hostname;
+  };
 }

parts/lib/functions.nix

@@ -43,7 +43,7 @@ in
           "${self}/hosts/${hostname}"
           "${self}/options"
           "${self}/modules"
-          { networking.hostName = hostname; }
+          { modules.meta.hostname = hostname; }
         ] ++ extraModules;
         specialArgs = {
           inherit inputs inputs';