WIP: enable gickup on bicep

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745502102,
+        "lastModified": 1741786315,
-        "narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
+        "narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
+        "rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de",
         "type": "github"
       },
       "original": {
@@ -48,11 +48,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1746563623,
+        "lastModified": 1736545379,
-        "narHash": "sha256-5DxgNFpSgxft/sWraZnHIUlb4S3Io73SVS7FZCbWSUY=",
+        "narHash": "sha256-PeTTmGumdOX3rd6OKI7QMCrZovCDkrckZbcHr+znxWA=",
         "ref": "refs/heads/main",
-        "rev": "4e0408887f80e61a90286ff630a7855b828ae421",
+        "rev": "74f5316121776db2769385927ec0d0c2cc2b23e4",
-        "revCount": 45,
+        "revCount": 42,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
       },
@@ -124,11 +124,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1743881366,
+        "lastModified": 1736531400,
-        "narHash": "sha256-ScGA2IHPk9ugf9bqEZnp+YB/OJgrkZblnG/XLEKvJAo=",
+        "narHash": "sha256-+X/HVI1AwoPcud28wI35XRrc1kDgkYdDUGABJBAkxDI=",
         "ref": "refs/heads/main",
-        "rev": "db2e4becf1b11e5dfd33de12a90a7d089fcf68ec",
+        "rev": "e4dafd06b3d7e9e6e07617766e9c3743134571b7",
-        "revCount": 11,
+        "revCount": 7,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
       },
@@ -139,11 +139,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1745526780,
+        "lastModified": 1741969460,
-        "narHash": "sha256-LXXYBmFPMQU2lTb6alKWfjgQs08BKn+txMNcgbu00hI=",
+        "narHash": "sha256-SCNxTTBfMJV7XuTcLUfdAd6cgCGsazzi+DoPrceQrZ0=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "9204750b34cae1a8347ab4b5588115edfeebc6d7",
+        "rev": "68612419aa6c9fd5b178b81e6fabbdf46d300ea4",
         "type": "github"
       },
       "original": {
@@ -155,11 +155,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1745688173,
+        "lastModified": 1741960758,
-        "narHash": "sha256-fgvG1O5JvSSjeQx+ea0DJ3GfMbLPVhAQta/DqQ2y6jc=",
+        "narHash": "sha256-pSGMbfkxF7TSeco54W+B1q+g22YCVp1qXHgtrdgtyR4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6a2957c7978b189202e03721aab901c0a9dc1e1a",
+        "rev": "845dc1e9cbc2e48640b8968af58b4a19db67aa8f",
         "type": "github"
       },
       "original": {
@@ -233,11 +233,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1746498961,
+        "lastModified": 1729391507,
-        "narHash": "sha256-rp+oh/N88JKHu7ySPuGiA3lBUVIsrOtHbN2eWJdYCgk=",
+        "narHash": "sha256-as0I9xieJUHf7kiK2a9znDsVZQTFWhM1pLivII43Gi0=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "24b00064cdd1d7ba25200c4a8565dc455dc732ba",
+        "rev": "784981a9feeba406de38c1c9a3decf966d853cca",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1745310711,
+        "lastModified": 1741861888,
-        "narHash": "sha256-ePyTpKEJTgX0gvgNQWd7tQYQ3glIkbqcW778RpHlqgA=",
+        "narHash": "sha256-ynOgXAyToeE1UdLNfrUn/hL7MN0OpIS2BtNdLjpjPf0=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "5e3e92b16d6fdf9923425a8d4df7496b2434f39c",
+        "rev": "d016ce0365b87d848a57c12ffcfdc71da7a2b55f",
         "type": "github"
       },
       "original": {

hosts/bicep/services/git-mirrors/default.nix

@@ -1,67 +1,49 @@
-{ config, ... }:
+{ ... }:
 {
-  sops.secrets."gickup/github-token" = {
-    owner = "gickup";
-  };
-
   services.gickup = {
     enable = true;
 
-    destinationSettings = {
+    settings = {
-      structured = true;
+      source = {
-      zip = false;
+        github = [{
-      keep = 10;
+          # token_file = sops
-      bare = true;
+          include = [
-      lfs = true;
+            "go-gitea/gitea"
-    };
+            "unmojang/FjordLauncher"
-
+            "unmojang/drasl"
-    instances = let
+            "NixOS/nixpkgs"
-      defaultGithubConfig = {
+            "saltstack/salt"
-        settings.token_file = sops.secrets."gickup/github-token".path;
+            "heimdal/heimdal"
+            "yushijinhun/authlib-injector"
+            "Git-Mediawiki/Git-Mediawiki"
+          ];
+          wiki = true;
+          issues = true;
+        }];
+        gitlab = [{
+          include = [
+            "mx-puppet/discord/better-discord.js"
+            "mx-puppet/discord/matrix-discord-parser"
+            "mx-puppet/discord/discord-markdown"
+            "mx-puppet/discord/mx-puppet-discord"
+            "mx-puppet/mx-puppet-bridge"
+          ];
+        }];
+        any = [
+          {
+            url = "https://sourceware.org/git/glibc.git";
+          }
+        ];
       };
-      defaultGitlabConfig = {
-        # settings.token_file = ...
-      };
-    in {
-      "github:go-gitea/gitea" = defaultGithubConfig;
-      "github:unmojang/FjordLauncher" = defaultGithubConfig;
-      "github:unmojang/drasl" = defaultGithubConfig;
-      "github:NixOS/nixpkgs" = defaultGithubConfig;
-      "github:saltstack/salt" = defaultGithubConfig;
-      "github:heimdal/heimdal" = defaultGithubConfig;
-      "github:yushijinhun/authlib-injector" = defaultGithubConfig;
-      "github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
 
-      # "gitlab:mx-puppet/discord/better-discord.js" = defaultGitlabConfig;
+      destination.local = [{
-      # "gitlab:mx-puppet/discord/matrix-discord-parser" = defaultGitlabConfig;
+        path = "/data/git-mirrors";
-      # "gitlab:mx-puppet/discord/discord-markdown" = defaultGitlabConfig;
+        structured = true;
-      # "gitlab:mx-puppet/discord/mx-puppet-discord" = defaultGitlabConfig;
+        zip = true;
-      # "gitlab:mx-puppet/mx-puppet-bridge" = defaultGitlabConfig;
+        keep = 5;
-
+        bare = true;
-      "any:glibc" = {
+        lfs = true;
-        settings.url = "https://sourceware.org/git/glibc.git";
+      }];
-      };
     };
   };
-
-  # services.cgit = let
-  #   domain = "mirrors.pvv.ntnu.no";
-  # in {
-  #   ${domain} = {
-  #     enable = true;
-  #     group = "gickup";
-  #     scanPath = "/var/lib/gickup";
-  #     settings = {
-  #       enable-commit-graph = true;
-  #       enable-follow-links = true;
-  #       enable-http-clone = true;
-  #       enable-remote-branches = true;
-  #       clone-url = "https://${domain}/$CGIT_REPO_URL";
-  #       remove-suffix = true;
-  #       root-title = "https://${domain}";
-  #       root-desc = "PVV's repository mirroring service";
-  #       snapshots = "all";
-  #     };
-  #   };
-  # };
 }

modules/gickup.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, utils, ... }:
+{ config, pkgs, lib, ... }:
 let
   cfg = config.services.gickup;
   format = pkgs.formats.yaml { };
@@ -6,199 +6,30 @@ in
 {
   options.services.gickup = {
     enable = lib.mkEnableOption "gickup, a git repository mirroring service";
-
     package = lib.mkPackageOption pkgs "gickup" { };
+
     gitPackage = lib.mkPackageOption pkgs "git" { };
     gitLfsPackage = lib.mkPackageOption pkgs "git-lfs" { };
 
-    destinationSettings = lib.mkOption {
+    settings = lib.mkOption {
-      description = ''
-        Settings for destination local, see gickup configuration file
-
-        Note that `path` will be set automatically to `/var/lib/gickup`
-      '';
       type = lib.types.submodule {
         freeformType = format.type;
       };
-      default = { };
-      example = {
-        structured = true;
-        zip = false;
-        keep = 10;
-        bare = true;
-        lfs = true;
-      };
-    };
-
-    instances = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.submodule (submoduleInputs@{ name, ... }: let
-        submoduleName = name;
-
-        nameParts = rec {
-          repoType = builtins.head (lib.splitString ":" submoduleName);
-
-          owner = if repoType == "any"
-                  then null
-                  else lib.pipe submoduleName [
-                    (lib.removePrefix "${repoType}:")
-                    (lib.splitString "/")
-                    builtins.head
-                    lib.toLower
-                  ];
-
-          repo = if repoType == "any"
-                 then null
-                 else lib.pipe submoduleName [
-                    (lib.removePrefix "${repoType}:")
-                    (lib.splitString "/")
-                    lib.last
-                    lib.toLower
-                  ];
-
-          slug = if repoType == "any"
-                 then builtins.replaceStrings [ ":" "/" ] [ "-" "-" ] submoduleName
-                 else "${repoType}-${owner}-${repo}";
-        };
-      in {
-        options = {
-          interval = lib.mkOption {
-            type = lib.types.str;
-            default = "daily";
-            example = "weekly";
-            description = ''
-              Specification (in the format described by {manpage}`systemd.time(7)`) of the time
-              interval at which to run the service.
-            '';
-          };
-
-          type = lib.mkOption {
-            type = lib.types.enum [
-              "github"
-              "gitlab"
-              "gitea"
-              "gogs"
-              "bitbucket"
-              "onedev"
-              "sourcehut"
-              "any"
-            ];
-            example = "github";
-            default = nameParts.repoType;
-            description = ''
-              The type of the repository to mirror.
-            '';
-          };
-
-          owner = lib.mkOption {
-            type = with lib.types; nullOr str;
-            example = "go-gitea";
-            default = nameParts.owner;
-            description = ''
-              The owner of the repository to mirror (if applicable)
-            '';
-          };
-
-          repo = lib.mkOption {
-            type = with lib.types; nullOr str;
-            example = "gitea";
-            default = nameParts.repo;
-            description = ''
-              The name of the repository to mirror (if applicable)
-            '';
-          };
-
-          slug = lib.mkOption {
-            type = lib.types.str;
-            default = nameParts.slug;
-            example = "github-go-gitea-gitea";
-            description = ''
-              The slug of the repository to mirror.
-            '';
-          };
-
-          settings = lib.mkOption {
-            description = "Instance specific settings, see gickup configuration file";
-            type = lib.types.submodule {
-              freeformType = format.type;
-            };
-            default = { };
-            example = {
-              username = "gickup";
-              password = "hunter2";
-              wiki = true;
-              issues = true;
-            };
-          };
-        };
-      }));
     };
   };
 
   config = lib.mkIf cfg.enable {
-    services.gickup.destinationSettings.path = "/var/lib/gickup";
+    users.users.gickup = {
-
+      isSystemUser = true;
-    systemd.slices."system-gickup" = {
+      group = "gickup";
-      description = "Gickup git repository mirroring service";
+      home = "/var/lib/gickup";
-      after = [ "network.target" ];
     };
 
-    systemd.targets.gickup = {
+    users.groups.gickup = { };
+
+    systemd.services.gickup = {
       description = "Gickup git repository mirroring service";
-      wants = map ({ slug, ... }: "gickup@${slug}.service") (lib.attrValues cfg.instances);
+      wantedBy = [ "multi-user.target" ];
-    };
-
-    systemd.timers = {
-      "gickup@" = {
-        description = "Gickup git repository mirroring service for %i";
-
-        timerConfig = {
-          OnCalendar = "daily";
-          RandomizedDelaySec = "1h";
-          Persistent = true;
-          AccuracySec = "1s";
-        };
-      };
-    }
-    //
-    # Overrides for mirrors which are not "daily"
-    (lib.pipe cfg.instances [
-      builtins.attrValues
-      (builtins.filter (instance: instance.interval != "daily"))
-      (map ({ slug, interval, ... }: {
-        name = "gickup@${slug}";
-        value = {
-          overrideStrategy = "asDropin";
-          timerConfig.OnCalendar = interval;
-        };
-      }))
-      builtins.listToAttrs
-    ]);
-
-    systemd.targets.timers.wants = map ({ slug, ... }: "gickup@${slug}.timer") (lib.attrValues cfg.instances);
-
-    systemd.services."gickup@" = let
-      configDir = lib.pipe cfg.instances [
-        (lib.mapAttrsToList (name: instance: {
-          name = "${instance.slug}.yml";
-          path = format.generate "gickup-configuration-${name}.yml" {
-            destination.local = [ cfg.destinationSettings ];
-            source.${instance.type} = [
-              (
-                (lib.optionalAttrs (instance.type != "any") {
-                  user = instance.owner;
-                  includeorgs = [ instance.owner ];
-                  include = [ instance.repo ];
-                })
-                //
-                instance.settings
-              )
-            ];
-          };
-        }))
-        (pkgs.linkFarm "gickup-configuration-files")
-      ];
-    in {
-      description = "Gickup git repository mirroring service for %i";
       after = [ "network.target" ];
 
       path = [
@@ -207,17 +38,15 @@ in
       ];
 
       serviceConfig = {
-        Slice = "system-gickup.slice";
+        ExecStart = utils.escapeSystemdExecArgs [
-        ExecStart = "'${pkgs.gickup}/bin/gickup' '${configDir}/%i.yml' --debug";
+          (lib.getExe cfg.package)
+          (format.generate "gickup-settings.conf" cfg.settings)
+        ];
 
-        User = "gickup";
-        Group = "gickup";
-
-        SyslogIdentifier = "gickup-%i";
         StateDirectory = "gickup";
-        # WorkingDirectory = "gickup";
+        WorkingDirectory = "gickup";
-        # RuntimeDirectory = "gickup";
+        RuntimeDirectory = "gickup";
-        # RuntimeDirectoryMode = "0700";
+        RuntimeDirectoryMode = "0700";
 
         # Hardening options
         AmbientCapabilities = [];
@@ -235,8 +64,8 @@ in
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
-        # ProtectProc = "invisible";
+        ProtectProc = "invisible";
-        # ProtectSystem = "strict";
+        ProtectSystem = "strict";
         RemoveIPC = true;
         RestrictAddressFamilies = [
           "AF_INET"
@@ -246,22 +75,14 @@ in
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
-        # SystemCallFilter = [
+        SystemCallFilter = [
-        #   "@system-service"
+          "@system-service"
-        #   "~@resources"
+          "~@resources"
-        #   "~@privileged"
+          "~@privileged"
-        # ];
+        ];
         UMask = "0002";
         CapabilityBoundingSet = [];
       };
     };
-
-    users.users.gickup = {
-      isSystemUser = true;
-      group = "gickup";
-      home = "/var/lib/gickup";
-    };
-
-    users.groups.gickup = { };
   };
 }

secrets/bicep/bicep.yaml

@@ -3,8 +3,6 @@ calendar-bot:
     mysql_password: ENC[AES256_GCM,data:Gqag8yOgPH3ntoT5TmaqJWv1j+si2qIyz5Ryfw5E2A==,iv:kQDcxnPfwJQcFovI4f87UDt18F8ah3z5xeY86KmdCyY=,tag:A1sCSNXJziAmtUWohqwJgg==,type:str]
 mysql:
     password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
-gickup:
-    github-token: ENC[AES256_GCM,data:ICv6BP/kCrpx6qPCfdEeLK2NP/3iGmmv8hkHhHdwD1qyQb5g4NYBkm+OyRM4F75WUpg3j80x7I4k1vuSeVLzOldyIQ4uK00NQ58D8Ej/Wfm0ojMQM9g4Sr+6wyor,iv:TovZIU4Cs8nriYHXlCgnj3HV6c9F4A08xFOqrM3ls14=,tag:WwgM7z0ErREUvkafFK3AeQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -65,8 +63,8 @@ sops:
             cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
             0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-05-07T20:27:27Z"
+    lastmodified: "2024-08-15T21:18:33Z"
-    mac: ENC[AES256_GCM,data:8K+epmSfXj8kne76KieVETzcinH/csyGRKIclGq0woKlSW/U6F8vhaRMQzw3Jvp/aCYYj0N5evmNsVwufgUmvBFovZ/aJ9wZXHRBrwBm9cqLxpb/inA5uB9adOQYXC6JF3RjqA/eKmXMLIuRck9WL65vB5XPny8iOZcgHJ/415w=,iv:21hG0/Ypy4EFWu4VjIgodQa7hFHyFuPSSSJtlIuLqJ8=,tag:I1d+p1V/ByJN+0pY76kOeQ==,type:str]
+    mac: ENC[AES256_GCM,data:uR5HgeDAYqoqB9kk1V6p0T30+v6WpQJi4+qIeCDRnoUPnQKUVR10hvBhICck+E+Uh8p+tGhM6Uf3YrAJAV0ZCUiNJjtwDJQQLUDT53vdOAXN4xADCQqNuhgVwVMaruoTheEiwOswRuhFeEwy0gBj3Ze2pu47lueHYclmEzumLeQ=,iv:t0UyXN2YaR2m7M/pV2wTLJG5wVfqTIUs7wSQMmyeTVw=,tag:O7dIffzrDAXz3kGx5uazhw==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:40Z"
           enc: |-
@@ -89,4 +87,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.9.4
+    version: 3.9.0