From 061c7078c29b7c22f094e041cfd4c393d985fd0a Mon Sep 17 00:00:00 2001
From: ibizaman <ibizaman@tiserbox.com>
Date: Mon, 15 Dec 2025 08:12:07 +0100
Subject: [PATCH] forgejo: use secrets contract for smtp password

---
 docs/redirects.json                      | 28 ++++++++++++++++++++++--
 modules/services/forgejo.nix             | 13 ++++++++---
 modules/services/forgejo/docs/default.md | 22 +++++++++++++++++++
 3 files changed, 58 insertions(+), 5 deletions(-)

diff --git a/docs/redirects.json b/docs/redirects.json
index 485cee2..988c20f 100644
--- a/docs/redirects.json
+++ b/docs/redirects.json
@@ -2795,8 +2795,29 @@
   "services-forgejo-options-shb.forgejo.smtp.host": [
     "services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.host"
   ],
-  "services-forgejo-options-shb.forgejo.smtp.passwordFile": [
-    "services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.passwordFile"
+  "services-forgejo-options-shb.forgejo.smtp.password": [
+    "services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password"
+  ],
+  "services-forgejo-options-shb.forgejo.smtp.password.request": [
+    "services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.request"
+  ],
+  "services-forgejo-options-shb.forgejo.smtp.password.request.group": [
+    "services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.request.group"
+  ],
+  "services-forgejo-options-shb.forgejo.smtp.password.request.mode": [
+    "services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.request.mode"
+  ],
+  "services-forgejo-options-shb.forgejo.smtp.password.request.owner": [
+    "services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.request.owner"
+  ],
+  "services-forgejo-options-shb.forgejo.smtp.password.request.restartUnits": [
+    "services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.request.restartUnits"
+  ],
+  "services-forgejo-options-shb.forgejo.smtp.password.result": [
+    "services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.result"
+  ],
+  "services-forgejo-options-shb.forgejo.smtp.password.result.path": [
+    "services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.result.path"
   ],
   "services-forgejo-options-shb.forgejo.smtp.port": [
     "services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.port"
@@ -2939,6 +2960,9 @@
   "services-forgejo-usage-ldap": [
     "services-forgejo.html#services-forgejo-usage-ldap"
   ],
+  "services-forgejo-usage-smtp": [
+    "services-forgejo.html#services-forgejo-usage-smtp"
+  ],
   "services-forgejo-usage-sso": [
     "services-forgejo.html#services-forgejo-usage-sso"
   ],
diff --git a/modules/services/forgejo.nix b/modules/services/forgejo.nix
index 9fb01b0..0253de9 100644
--- a/modules/services/forgejo.nix
+++ b/modules/services/forgejo.nix
@@ -385,9 +385,16 @@ in
             type = str;
             description = "Username to connect to the SMTP host.";
           };
-          passwordFile = mkOption {
-            type = str;
+          password = mkOption {
             description = "File containing the password to connect to the SMTP host.";
+            type = submodule {
+              options = shb.contracts.secret.mkRequester {
+                mode = "0440";
+                owner = "forgejo";
+                group = "forgejo";
+                restartUnits = [ "forgejo.service" ];
+              };
+            };
           };
         };
       });
@@ -617,7 +624,7 @@ in
         SMTP_ADDR = "${cfg.smtp.host}:${toString cfg.smtp.port}";
         FROM = cfg.smtp.from_address;
         USER = cfg.smtp.username;
-        PASSWD = cfg.smtp.passwordFile;
+        PASSWD = cfg.smtp.password.result.path;
       };
     })
 
diff --git a/modules/services/forgejo/docs/default.md b/modules/services/forgejo/docs/default.md
index 2416b90..86c16c3 100644
--- a/modules/services/forgejo/docs/default.md
+++ b/modules/services/forgejo/docs/default.md
@@ -163,6 +163,28 @@ must have the same content. The former is a file that must be owned by the `forg
 the latter must be owned by the `authelia` user. I want to avoid needing to define the same secret
 twice with a future secrets SHB block.
 
+### SMTP {#services-forgejo-usage-smtp}
+
+To send e-mails, notifications, define the SMTP settings like so:
+
+```nix
+{
+  services.forgejo = {
+    smtp = {
+      host = "smtp.mailgun.org";
+      port = 587;
+      username = "postmaster@mg.${domain}";
+      from_address = "authelia@${domain}";
+      password.result = config.shb.sops.secret."forgejo/smtpPassword".result;
+    };
+  };
+
+  shb.sops.secret."forgejo/smtpPassword" = {
+    request = config.shb.forgejo.smtp.password.request;
+  };
+}
+```
+
 ### Backup {#services-forgejo-usage-backup}
 
 Every hour, Forgejo takes a backup using the [built-in `dump` command](https://forgejo.org/docs/latest/admin/command-line/#dump).