gita and upgrade

flake.lock

@@ -6,11 +6,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1786831869,
+        "lastModified": 1787536184,
-        "narHash": "sha256-ALhahxbdgnN8rMvlKmgB5py0etICwyYY75Uz0jLIpM4=",
+        "narHash": "sha256-BElMdZnbe7Trt7Rs0u5utMbLm8Fydq6g0XhRHQCixAU=",
         "owner": "ogulcancelik",
         "repo": "herdr",
-        "rev": "51b7064ef0a02642393bab1d2eea0f4dbd8414d2",
+        "rev": "7d56b4c51b046a5d477439bcea4512339f8841aa",
         "type": "github"
       },
       "original": {
@@ -26,11 +26,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1785119570,
+        "lastModified": 1787377438,
-        "narHash": "sha256-Rgs2xKnGLFWQscxUaXX07oyZeuMDOHEbqDOsgliLFGM=",
+        "narHash": "sha256-Sxu1NLTD/Ern6hFGLlZmtKCSct3YQXZI/lls8RE1XeM=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "d4fd24667c8cbef124bb70a20380cab75ec8474d",
+        "rev": "65258d5c65a250189fde2e35f490d15e064c4c62",
         "type": "github"
       },
       "original": {
@@ -58,11 +58,11 @@
     },
     "nixpkgs_2": {
       "locked": {
-        "lastModified": 1786711500,
+        "lastModified": 1787414105,
-        "narHash": "sha256-mB6w7h+UsvxLf3PY6U3hSDVWCfmn2Q6VtSw5JugbeY0=",
+        "narHash": "sha256-8FnH9CMQCQ9i7d7xrXK30SBjgODxlkltCa0thsRgrxg=",
-        "rev": "02e08985a27c65ffd33d434eeb2e660a2e4dc84d",
+        "rev": "a9e6d84f9c2f9012f5fe7d964a7851352300e61a",
         "type": "tarball",
-        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.7675.02e08985a27c/nixexprs.tar.xz"
+        "url": "https://releases.nixos.org/nixos/26.05/nixos-26.05.8255.a9e6d84f9c2f/nixexprs.tar.xz"
       },
       "original": {
         "id": "nixpkgs",

hosts/nixserve/default.nix

@@ -58,6 +58,7 @@
     wget
     curl
     git
+    gitea
     transmission_4
   ];
 

hosts/nixserve/services.nix

@@ -1,4 +1,4 @@
-{ pkgs, rssdownloader-src, ... }:
+{ config, pkgs, rssdownloader-src, ... }:
 
 let
   rssdownloader = pkgs.callPackage ./rssdownloader.nix { src = rssdownloader-src; };
@@ -87,6 +87,40 @@ in
     mediaLocation = "/media/immich";
   };
 
+  users.users.git = {
+    isSystemUser = true;
+    group = "git";
+    home = "/media/git";
+    shell = pkgs.bash;
+  };
+  users.groups.git = {};
+
+  services.gitea = {
+    enable = true;
+    user = "git";
+    group = "git";
+    stateDir = "/media/git";
+    settings = {
+      server = {
+        DOMAIN = "git.maybec.at";
+        ROOT_URL = "https://git.maybec.at/";
+        HTTP_ADDR = "127.0.0.1";
+        HTTP_PORT = 3001;
+        START_SSH_SERVER = false;
+        SSH_DOMAIN = "git.maybec.at";
+        SSH_PORT = 22;
+        SSH_USER = "git";
+      };
+      service.DISABLE_REGISTRATION = true;
+    };
+  };
+
+  services.openssh.extraConfig = ''
+    Match User git
+      AuthorizedKeysCommand ${config.services.gitea.package}/bin/gitea keys -c ${config.services.gitea.customDir}/conf/app.ini -e git -u %u -t %t -k %k
+      AuthorizedKeysCommandUser git
+  '';
+
   services.zfs.autoScrub = {
     enable = true;
     interval = "monthly";
@@ -173,5 +207,6 @@ virtualHosts."aftersummer.maybec.at"  = proxyVhost { upstream = "http://127.0.0.
     virtualHosts."jelly.maybec.at"       = proxyVhost { upstream = "http://127.0.0.1:8096"; };
     virtualHosts."photos.maybec.at"      = proxyVhost { upstream = "http://[::1]:2283"; maxBodySize = "50g"; };
     virtualHosts."colony.maybec.at"      = proxyVhost { upstream = "http://127.0.0.1:3333"; };
+    virtualHosts."git.maybec.at"         = proxyVhost { upstream = "http://127.0.0.1:3001"; maxBodySize = "10g"; };
   };
 }

modules/home-common.nix

@@ -198,6 +198,11 @@
     settings = {
       user.name = "ulve";
       user.email = "johansson.olov@gmail.com";
+      credential."https://git.maybec.at" = {
+        helper = "manager";
+        credentialStore = "gpg";
+        provider = "generic";
+      };
     };
     includes = [
       {