modularize tf infrastructure

ignition/forgejo/app.ini

@@ -0,0 +1,98 @@
+APP_NAME = Hklbgd: Git forge beogradskog haklaba.
+RUN_MODE = prod
+RUN_USER = git
+WORK_PATH = /data/gitea
+
+[repository]
+ROOT = /data/git/repositories
+
+[repository.local]
+LOCAL_COPY_PATH = /data/gitea/tmp/local-repo
+
+[repository.upload]
+TEMP_PATH = /data/gitea/uploads
+
+[server]
+APP_DATA_PATH = /data/gitea
+DOMAIN = forge.hklbgd.org
+SSH_DOMAIN = forge.hklbgd.org
+HTTP_PORT = 3000
+ROOT_URL = http://forge.hklbgd.org:3000/
+DISABLE_SSH = false
+SSH_PORT = 22
+SSH_LISTEN_PORT = 22
+LFS_START_SERVER = true
+LFS_JWT_SECRET = Uw3LrBKqyOESkHJDcpfP_AM_eLE-WKWTV48inxIfqNk
+OFFLINE_MODE = false
+
+[database]
+PATH = /data/gitea/gitea.db
+DB_TYPE = sqlite3
+NAME = gitea
+USER = root
+PASSWD =
+LOG_SQL = false
+SCHEMA =
+SSL_MODE = disable
+
+[indexer]
+ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
+
+[session]
+PROVIDER_CONFIG = /data/gitea/sessions
+PROVIDER = file
+
+[picture]
+AVATAR_UPLOAD_PATH = /data/gitea/avatars
+REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars
+
+[attachment]
+PATH = /data/gitea/attachments
+
+[log]
+MODE = console
+LEVEL = info
+ROOT_PATH = /data/gitea/log
+
+[security]
+INSTALL_LOCK = true
+SECRET_KEY =
+REVERSE_PROXY_LIMIT = 1
+REVERSE_PROXY_TRUSTED_PROXIES = *
+INTERNAL_TOKEN = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE3MDg0NDAwODh9.VO3I2beskQWkE-yU5QC3WWjaVuqH80piJroJxj71-HA
+PASSWORD_HASH_ALGO = pbkdf2_hi
+
+[service]
+DISABLE_REGISTRATION = true
+REQUIRE_SIGNIN_VIEW = false
+REGISTER_EMAIL_CONFIRM = false
+ENABLE_NOTIFY_MAIL = false
+ALLOW_ONLY_EXTERNAL_REGISTRATION = false
+ENABLE_CAPTCHA = false
+DEFAULT_KEEP_EMAIL_PRIVATE = true
+DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+DEFAULT_ENABLE_TIMETRACKING = true
+NO_REPLY_ADDRESS = noreply.localhost
+
+[lfs]
+PATH = /data/git/lfs
+
+[mailer]
+ENABLED = false
+
+[openid]
+ENABLE_OPENID_SIGNIN = true
+ENABLE_OPENID_SIGNUP = true
+WHITELISTED_URIS = kanidm.hklbgd.org
+
+[cron.update_checker]
+ENABLED = false
+
+[repository.pull-request]
+DEFAULT_MERGE_STYLE = squash
+
+[repository.signing]
+DEFAULT_TRUST_MODEL = committer
+
+[oauth2]
+JWT_SECRET = 9Xl_coahn4U31L78IxKSZk7k6z_r2uQlQ_DVDlNsKyM

ignition/forgejo/service.bu

@@ -0,0 +1,57 @@
+variant: fcos
+version: 1.5.0
+passwd:
+  users:
+    - name: vladan
+      ssh_authorized_keys:
+        - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEFtUc2UvKFGSSlP3RRXUIToDYh8a8pg5DqDkJS+nBTG vladan@jenga
+      password_hash: "$y$j9T$kBtBBkINmXh6lxmBqCJkr1$bA1fjZ5pC4CUr6VUnRe2FAWrW5tb6lfX/7.38axa5S3"
+      groups:
+        - wheel
+      shell: /bin/bash
+storage:
+  disks:
+    - device: /dev/vdb
+      wipe_table: false
+      partitions:
+        - number: 1
+          label: forgejo
+          start_mib: 0
+          size_mib: 30000
+  filesystems:
+    - path: /var/lib/forgejo
+      device: /dev/disk/by-partlabel/forgejo
+      format: xfs
+      label: data
+      with_mount_unit: true
+      wipe_filesystem: false
+  files:
+    - path: /etc/hostname
+      mode: 0644
+      contents:
+        inline: forge.hklbgd.org
+    - path: /etc/forgejo/app.ini
+      contents:
+        local: app.ini
+    - path: /etc/containers/systemd/forgejo.container
+      contents:
+        inline: |
+          [Unit]
+          Description=Forgejo: Beyond coding. We forge.
+          After=network-online.target
+          Wants=network-online.target
+
+          [Service]
+          TimeoutStartSec=60
+
+          [Container]
+          ContainerName=forgejo
+          Image=codeberg.org/forgejo/forgejo:1.21.5-0
+          Volume=/var/lib/forgejo:/data:z
+          Volume=/etc/forgejo/app.ini:/data/gitea/conf/app.ini:z
+          PublishPort=3000:3000
+          PublishPort=3022:22
+
+          [Install]
+          # Start by default on boot
+          WantedBy=multi-user.target default.target