feat(etna): add forgejo

systems/etna/default.nix

@@ -23,6 +23,7 @@ in {
       ./reposilite.nix
       ./uku.nix
       ./vaultwarden.nix
+      ./forgejo.nix
     ];
 
   age.secrets = mkSecrets {

systems/etna/forgejo.nix

@@ -0,0 +1,42 @@
+_: {
+  cfTunnels."git.uku3lig.net" = "http://localhost:3000";
+
+  services.forgejo = {
+      enable = true;
+
+      database = {
+        type = "postgres";
+        createDatabase = true;
+      };
+
+      settings = {
+        DEFAULT.APP_NAME = "uku's forge";
+
+        server = {
+          DISABLE_SSH = true;
+          ROOT_URL = "https://git.uku3lig.net";
+        };
+
+        service = {
+          ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+          # TODO enable turnstile once it gets fixed
+          # see codeberg:forgejo/forgejo#3832
+          ENABLE_CAPTCHA = true;
+        };
+
+        oauth2 = {
+          # providers are configured in the admin panel
+          ENABLED = true;
+        };
+
+        "ui.meta" = {
+          AUTHOR = "uku's forge";
+          DESCRIPTION = "the place where literally nothing gets done";
+        };
+
+        "repository.signing" = {
+          DEFAULT_TRUST_MODEL = "committer";
+        };
+      };
+    };
+}