danvics/selfhostblocks
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

forgejo: use secrets contract for smtp password

Browse source
This commit is contained in:
ibizaman 2025-12-15 08:12:07 +01:00 committed by Pierre Penninckx
parent 328a27d89e
commit 0c1d5ca455
3 changed files with 58 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

28
docs/redirects.json
View file

@ -2795,8 +2795,29 @@
"services-forgejo-options-shb.forgejo.smtp.host": [
"services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.host"
],
"services-forgejo-options-shb.forgejo.smtp.passwordFile": [
"services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.passwordFile"
"services-forgejo-options-shb.forgejo.smtp.password": [
"services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password"
],
"services-forgejo-options-shb.forgejo.smtp.password.request": [
"services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.request"
],
"services-forgejo-options-shb.forgejo.smtp.password.request.group": [
"services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.request.group"
],
"services-forgejo-options-shb.forgejo.smtp.password.request.mode": [
"services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.request.mode"
],
"services-forgejo-options-shb.forgejo.smtp.password.request.owner": [
"services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.request.owner"
],
"services-forgejo-options-shb.forgejo.smtp.password.request.restartUnits": [
"services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.request.restartUnits"
],
"services-forgejo-options-shb.forgejo.smtp.password.result": [
"services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.result"
],
"services-forgejo-options-shb.forgejo.smtp.password.result.path": [
"services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.password.result.path"
],
"services-forgejo-options-shb.forgejo.smtp.port": [
"services-forgejo.html#services-forgejo-options-shb.forgejo.smtp.port"
@ -2939,6 +2960,9 @@
"services-forgejo-usage-ldap": [
"services-forgejo.html#services-forgejo-usage-ldap"
],
"services-forgejo-usage-smtp": [
"services-forgejo.html#services-forgejo-usage-smtp"
],
"services-forgejo-usage-sso": [
"services-forgejo.html#services-forgejo-usage-sso"
],

13
modules/services/forgejo.nix
View file

@ -385,9 +385,16 @@ in
type = str;
description = "Username to connect to the SMTP host.";
};
passwordFile = mkOption {
type = str;
password = mkOption {
description = "File containing the password to connect to the SMTP host.";
type = submodule {
options = shb.contracts.secret.mkRequester {
mode = "0440";
owner = "forgejo";
group = "forgejo";
restartUnits = [ "forgejo.service" ];
};
};
};
};
});
@ -617,7 +624,7 @@ in
SMTP_ADDR = "${cfg.smtp.host}:${toString cfg.smtp.port}";
FROM = cfg.smtp.from_address;
USER = cfg.smtp.username;
PASSWD = cfg.smtp.passwordFile;
PASSWD = cfg.smtp.password.result.path;
};
})

22
modules/services/forgejo/docs/default.md
View file

@ -163,6 +163,28 @@ must have the same content. The former is a file that must be owned by the `forg
the latter must be owned by the `authelia` user. I want to avoid needing to define the same secret
twice with a future secrets SHB block.
### SMTP {#services-forgejo-usage-smtp}
To send e-mails, notifications, define the SMTP settings like so:
```nix
{
services.forgejo = {
smtp = {
host = "smtp.mailgun.org";
port = 587;
username = "postmaster@mg.${domain}";
from_address = "authelia@${domain}";
password.result = config.shb.sops.secret."forgejo/smtpPassword".result;
};
};
shb.sops.secret."forgejo/smtpPassword" = {
request = config.shb.forgejo.smtp.password.request;
};
}
```
### Backup {#services-forgejo-usage-backup}
Every hour, Forgejo takes a backup using the [built-in `dump` command](https://forgejo.org/docs/latest/admin/command-line/#dump).