nixos-config/modules/services/forgejo.nix

{pkgs, ...}: 
let
  import ../../config/globals.nix;
in {
  # --- Utilisateur dédié ---
  users.users.git = {
    isSystemUser = true;
    home = "/var/lib/forgejo";
    shell = pkgs.bash;
    group = "git";
  };
  users.groups.git = {};

  # --- Forgejo ---
  services = {
    forgejo = {
      enable = true;
      user = "git";
      group = "git";
      database = {
        type = "sqlite3";
        path = "/var/lib/forgejo/data/gitea.db";
      };
      settings = {
        server = {
          DOMAIN = globals.services.forgejo.url ;
          ROOT_URL = "https://${globals.services.forgejo.url}/";
          SSH_DOMAIN = globals.services.forgejo.url;
          HTTP_PORT = globals.services.forgejo.port;
          SSH_PORT = 22;
          START_SSH_SERVER = false;
        };
        service = {
          DISABLE_REGISTRATION = true;
          REGISTER_EMAIL_CONFIRM = false;
        };
        repository = {
          DEFAULT_BRANCH = "master";
        };
      };
    };
    openssh.enable = true;
    caddy = {
      enable = true;
      virtualHosts.${globals.services.forgejo.url} = {
        extraConfig = ''
          reverse_proxy localhost:${globals.services.forgejo.port}
        '';
      };
    };
  };

  # --- Ouvrir les ports nécessaires ---
  networking.firewall = {
    allowedTCPPorts = [80 443 2222];
    interfaces."eth0".allowedTCPPorts = [22];
  };
  # --- Pour que Forgejo génère les bonnes URLs Git ---
  #  networking.hostName = "git"; # non strictement obligatoire

  # --- Optionnel : config DNS ---
  # git.lomig.me -> ton IP publique (ou IP locale si LAN)

  # --- Pour te cloner un dépôt : ---
  # git clone git@git.lomig.me:lomig/nom-du-repo.git

  # --- Astuce : génère une paire de clés pour l’accès SSH Git ---
  # ssh-keygen -t ed25519 -f ~/.ssh/id_git_forgejo
  # puis ajoute la clé publique dans ton compte Forgejo
}