gita and upgrade

hosts/nixserve/services.nix

@@ -1,4 +1,4 @@
-{ pkgs, rssdownloader-src, ... }:
+{ config, pkgs, rssdownloader-src, ... }:
 
 let
   rssdownloader = pkgs.callPackage ./rssdownloader.nix { src = rssdownloader-src; };
@@ -87,6 +87,40 @@ in
     mediaLocation = "/media/immich";
   };
 
+  users.users.git = {
+    isSystemUser = true;
+    group = "git";
+    home = "/media/git";
+    shell = pkgs.bash;
+  };
+  users.groups.git = {};
+
+  services.gitea = {
+    enable = true;
+    user = "git";
+    group = "git";
+    stateDir = "/media/git";
+    settings = {
+      server = {
+        DOMAIN = "git.maybec.at";
+        ROOT_URL = "https://git.maybec.at/";
+        HTTP_ADDR = "127.0.0.1";
+        HTTP_PORT = 3001;
+        START_SSH_SERVER = false;
+        SSH_DOMAIN = "git.maybec.at";
+        SSH_PORT = 22;
+        SSH_USER = "git";
+      };
+      service.DISABLE_REGISTRATION = true;
+    };
+  };
+
+  services.openssh.extraConfig = ''
+    Match User git
+      AuthorizedKeysCommand ${config.services.gitea.package}/bin/gitea keys -c ${config.services.gitea.customDir}/conf/app.ini -e git -u %u -t %t -k %k
+      AuthorizedKeysCommandUser git
+  '';
+
   services.zfs.autoScrub = {
     enable = true;
     interval = "monthly";
@@ -173,5 +207,6 @@ virtualHosts."aftersummer.maybec.at"  = proxyVhost { upstream = "http://127.0.0.
     virtualHosts."jelly.maybec.at"       = proxyVhost { upstream = "http://127.0.0.1:8096"; };
     virtualHosts."photos.maybec.at"      = proxyVhost { upstream = "http://[::1]:2283"; maxBodySize = "50g"; };
     virtualHosts."colony.maybec.at"      = proxyVhost { upstream = "http://127.0.0.1:3333"; };
+    virtualHosts."git.maybec.at"         = proxyVhost { upstream = "http://127.0.0.1:3001"; maxBodySize = "10g"; };
   };
 }