fixup! WIP: enable gickup on bicep

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741786315,
+        "lastModified": 1745502102,
-        "narHash": "sha256-VT65AE2syHVj6v/DGB496bqBnu1PXrrzwlw07/Zpllc=",
+        "narHash": "sha256-LqhRwzvIVPEjH0TaPgwzqpyhW6DtCrvz7FnUJDoUZh8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "0d8c6ad4a43906d14abd5c60e0ffe7b587b213de",
+        "rev": "ca27b88c88948d96feeee9ed814cbd34f53d0d70",
         "type": "github"
       },
       "original": {
@@ -48,11 +48,11 @@
         "rust-overlay": "rust-overlay"
       },
       "locked": {
-        "lastModified": 1736545379,
+        "lastModified": 1746563623,
-        "narHash": "sha256-PeTTmGumdOX3rd6OKI7QMCrZovCDkrckZbcHr+znxWA=",
+        "narHash": "sha256-5DxgNFpSgxft/sWraZnHIUlb4S3Io73SVS7FZCbWSUY=",
         "ref": "refs/heads/main",
-        "rev": "74f5316121776db2769385927ec0d0c2cc2b23e4",
+        "rev": "4e0408887f80e61a90286ff630a7855b828ae421",
-        "revCount": 42,
+        "revCount": 45,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Grzegorz/greg-ng.git"
       },
@@ -124,11 +124,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1736531400,
+        "lastModified": 1743881366,
-        "narHash": "sha256-+X/HVI1AwoPcud28wI35XRrc1kDgkYdDUGABJBAkxDI=",
+        "narHash": "sha256-ScGA2IHPk9ugf9bqEZnp+YB/OJgrkZblnG/XLEKvJAo=",
         "ref": "refs/heads/main",
-        "rev": "e4dafd06b3d7e9e6e07617766e9c3743134571b7",
+        "rev": "db2e4becf1b11e5dfd33de12a90a7d089fcf68ec",
-        "revCount": 7,
+        "revCount": 11,
         "type": "git",
         "url": "https://git.pvv.ntnu.no/Drift/nix-gitea-themes.git"
       },
@@ -139,11 +139,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1741969460,
+        "lastModified": 1745526780,
-        "narHash": "sha256-SCNxTTBfMJV7XuTcLUfdAd6cgCGsazzi+DoPrceQrZ0=",
+        "narHash": "sha256-LXXYBmFPMQU2lTb6alKWfjgQs08BKn+txMNcgbu00hI=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "68612419aa6c9fd5b178b81e6fabbdf46d300ea4",
+        "rev": "9204750b34cae1a8347ab4b5588115edfeebc6d7",
         "type": "github"
       },
       "original": {
@@ -155,11 +155,11 @@
     },
     "nixpkgs-unstable": {
       "locked": {
-        "lastModified": 1741960758,
+        "lastModified": 1745688173,
-        "narHash": "sha256-pSGMbfkxF7TSeco54W+B1q+g22YCVp1qXHgtrdgtyR4=",
+        "narHash": "sha256-fgvG1O5JvSSjeQx+ea0DJ3GfMbLPVhAQta/DqQ2y6jc=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "845dc1e9cbc2e48640b8968af58b4a19db67aa8f",
+        "rev": "6a2957c7978b189202e03721aab901c0a9dc1e1a",
         "type": "github"
       },
       "original": {
@@ -233,11 +233,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1729391507,
+        "lastModified": 1746498961,
-        "narHash": "sha256-as0I9xieJUHf7kiK2a9znDsVZQTFWhM1pLivII43Gi0=",
+        "narHash": "sha256-rp+oh/N88JKHu7ySPuGiA3lBUVIsrOtHbN2eWJdYCgk=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "784981a9feeba406de38c1c9a3decf966d853cca",
+        "rev": "24b00064cdd1d7ba25200c4a8565dc455dc732ba",
         "type": "github"
       },
       "original": {
@@ -253,11 +253,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1741861888,
+        "lastModified": 1745310711,
-        "narHash": "sha256-ynOgXAyToeE1UdLNfrUn/hL7MN0OpIS2BtNdLjpjPf0=",
+        "narHash": "sha256-ePyTpKEJTgX0gvgNQWd7tQYQ3glIkbqcW778RpHlqgA=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "d016ce0365b87d848a57c12ffcfdc71da7a2b55f",
+        "rev": "5e3e92b16d6fdf9923425a8d4df7496b2434f39c",
         "type": "github"
       },
       "original": {

hosts/bicep/services/git-mirrors/default.nix

@@ -1,49 +1,67 @@
-{ ... }:
+{ config, ... }:
 {
+  sops.secrets."gickup/github-token" = {
+    owner = "gickup";
+  };
+
   services.gickup = {
     enable = true;
 
-    settings = {
+    destinationSettings = {
-      source = {
-        github = [{
-          # token_file = sops
-          include = [
-            "go-gitea/gitea"
-            "unmojang/FjordLauncher"
-            "unmojang/drasl"
-            "NixOS/nixpkgs"
-            "saltstack/salt"
-            "heimdal/heimdal"
-            "yushijinhun/authlib-injector"
-            "Git-Mediawiki/Git-Mediawiki"
-          ];
-          wiki = true;
-          issues = true;
-        }];
-        gitlab = [{
-          include = [
-            "mx-puppet/discord/better-discord.js"
-            "mx-puppet/discord/matrix-discord-parser"
-            "mx-puppet/discord/discord-markdown"
-            "mx-puppet/discord/mx-puppet-discord"
-            "mx-puppet/mx-puppet-bridge"
-          ];
-        }];
-        any = [
-          {
-            url = "https://sourceware.org/git/glibc.git";
-          }
-        ];
-      };
-
-      destination.local = [{
-        path = "/data/git-mirrors";
       structured = true;
-        zip = true;
+      zip = false;
-        keep = 5;
+      keep = 10;
       bare = true;
       lfs = true;
-      }];
+    };
+
+    instances = let
+      defaultGithubConfig = {
+        settings.token_file = sops.secrets."gickup/github-token".path;
+      };
+      defaultGitlabConfig = {
+        # settings.token_file = ...
+      };
+    in {
+      "github:go-gitea/gitea" = defaultGithubConfig;
+      "github:unmojang/FjordLauncher" = defaultGithubConfig;
+      "github:unmojang/drasl" = defaultGithubConfig;
+      "github:NixOS/nixpkgs" = defaultGithubConfig;
+      "github:saltstack/salt" = defaultGithubConfig;
+      "github:heimdal/heimdal" = defaultGithubConfig;
+      "github:yushijinhun/authlib-injector" = defaultGithubConfig;
+      "github:Git-Mediawiki/Git-Mediawiki" = defaultGithubConfig;
+
+      # "gitlab:mx-puppet/discord/better-discord.js" = defaultGitlabConfig;
+      # "gitlab:mx-puppet/discord/matrix-discord-parser" = defaultGitlabConfig;
+      # "gitlab:mx-puppet/discord/discord-markdown" = defaultGitlabConfig;
+      # "gitlab:mx-puppet/discord/mx-puppet-discord" = defaultGitlabConfig;
+      # "gitlab:mx-puppet/mx-puppet-bridge" = defaultGitlabConfig;
+
+      "any:glibc" = {
+        settings.url = "https://sourceware.org/git/glibc.git";
       };
     };
+  };
+
+  # services.cgit = let
+  #   domain = "mirrors.pvv.ntnu.no";
+  # in {
+  #   ${domain} = {
+  #     enable = true;
+  #     group = "gickup";
+  #     scanPath = "/var/lib/gickup";
+  #     settings = {
+  #       enable-commit-graph = true;
+  #       enable-follow-links = true;
+  #       enable-http-clone = true;
+  #       enable-remote-branches = true;
+  #       clone-url = "https://${domain}/$CGIT_REPO_URL";
+  #       remove-suffix = true;
+  #       root-title = "https://${domain}";
+  #       root-desc = "PVV's repository mirroring service";
+  #       snapshots = "all";
+  #     };
+  #   };
+  # };
 }

modules/gickup.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, pkgs, lib, utils, ... }:
 let
   cfg = config.services.gickup;
   format = pkgs.formats.yaml { };
@@ -6,30 +6,199 @@ in
 {
   options.services.gickup = {
     enable = lib.mkEnableOption "gickup, a git repository mirroring service";
-    package = lib.mkPackageOption pkgs "gickup" { };
 
+    package = lib.mkPackageOption pkgs "gickup" { };
     gitPackage = lib.mkPackageOption pkgs "git" { };
     gitLfsPackage = lib.mkPackageOption pkgs "git-lfs" { };
 
-    settings = lib.mkOption {
+    destinationSettings = lib.mkOption {
+      description = ''
+        Settings for destination local, see gickup configuration file
+
+        Note that `path` will be set automatically to `/var/lib/gickup`
+      '';
       type = lib.types.submodule {
         freeformType = format.type;
       };
+      default = { };
+      example = {
+        structured = true;
+        zip = false;
+        keep = 10;
+        bare = true;
+        lfs = true;
+      };
+    };
+
+    instances = lib.mkOption {
+      type = lib.types.attrsOf (lib.types.submodule (submoduleInputs@{ name, ... }: let
+        submoduleName = name;
+
+        nameParts = rec {
+          repoType = builtins.head (lib.splitString ":" submoduleName);
+
+          owner = if repoType == "any"
+                  then null
+                  else lib.pipe submoduleName [
+                    (lib.removePrefix "${repoType}:")
+                    (lib.splitString "/")
+                    builtins.head
+                    lib.toLower
+                  ];
+
+          repo = if repoType == "any"
+                 then null
+                 else lib.pipe submoduleName [
+                    (lib.removePrefix "${repoType}:")
+                    (lib.splitString "/")
+                    lib.last
+                    lib.toLower
+                  ];
+
+          slug = if repoType == "any"
+                 then builtins.replaceStrings [ ":" "/" ] [ "-" "-" ] submoduleName
+                 else "${repoType}-${owner}-${repo}";
+        };
+      in {
+        options = {
+          interval = lib.mkOption {
+            type = lib.types.str;
+            default = "daily";
+            example = "weekly";
+            description = ''
+              Specification (in the format described by {manpage}`systemd.time(7)`) of the time
+              interval at which to run the service.
+            '';
+          };
+
+          type = lib.mkOption {
+            type = lib.types.enum [
+              "github"
+              "gitlab"
+              "gitea"
+              "gogs"
+              "bitbucket"
+              "onedev"
+              "sourcehut"
+              "any"
+            ];
+            example = "github";
+            default = nameParts.repoType;
+            description = ''
+              The type of the repository to mirror.
+            '';
+          };
+
+          owner = lib.mkOption {
+            type = with lib.types; nullOr str;
+            example = "go-gitea";
+            default = nameParts.owner;
+            description = ''
+              The owner of the repository to mirror (if applicable)
+            '';
+          };
+
+          repo = lib.mkOption {
+            type = with lib.types; nullOr str;
+            example = "gitea";
+            default = nameParts.repo;
+            description = ''
+              The name of the repository to mirror (if applicable)
+            '';
+          };
+
+          slug = lib.mkOption {
+            type = lib.types.str;
+            default = nameParts.slug;
+            example = "github-go-gitea-gitea";
+            description = ''
+              The slug of the repository to mirror.
+            '';
+          };
+
+          settings = lib.mkOption {
+            description = "Instance specific settings, see gickup configuration file";
+            type = lib.types.submodule {
+              freeformType = format.type;
+            };
+            default = { };
+            example = {
+              username = "gickup";
+              password = "hunter2";
+              wiki = true;
+              issues = true;
+            };
+          };
+        };
+      }));
     };
   };
 
   config = lib.mkIf cfg.enable {
-    users.users.gickup = {
+    services.gickup.destinationSettings.path = "/var/lib/gickup";
-      isSystemUser = true;
+
-      group = "gickup";
+    systemd.slices."system-gickup" = {
-      home = "/var/lib/gickup";
+      description = "Gickup git repository mirroring service";
+      after = [ "network.target" ];
     };
 
-    users.groups.gickup = { };
+    systemd.targets.gickup = {
-
-    systemd.services.gickup = {
       description = "Gickup git repository mirroring service";
-      wantedBy = [ "multi-user.target" ];
+      wants = map ({ slug, ... }: "gickup@${slug}.service") (lib.attrValues cfg.instances);
+    };
+
+    systemd.timers = {
+      "gickup@" = {
+        description = "Gickup git repository mirroring service for %i";
+
+        timerConfig = {
+          OnCalendar = "daily";
+          RandomizedDelaySec = "1h";
+          Persistent = true;
+          AccuracySec = "1s";
+        };
+      };
+    }
+    //
+    # Overrides for mirrors which are not "daily"
+    (lib.pipe cfg.instances [
+      builtins.attrValues
+      (builtins.filter (instance: instance.interval != "daily"))
+      (map ({ slug, interval, ... }: {
+        name = "gickup@${slug}";
+        value = {
+          overrideStrategy = "asDropin";
+          timerConfig.OnCalendar = interval;
+        };
+      }))
+      builtins.listToAttrs
+    ]);
+
+    systemd.targets.timers.wants = map ({ slug, ... }: "gickup@${slug}.timer") (lib.attrValues cfg.instances);
+
+    systemd.services."gickup@" = let
+      configDir = lib.pipe cfg.instances [
+        (lib.mapAttrsToList (name: instance: {
+          name = "${instance.slug}.yml";
+          path = format.generate "gickup-configuration-${name}.yml" {
+            destination.local = [ cfg.destinationSettings ];
+            source.${instance.type} = [
+              (
+                (lib.optionalAttrs (instance.type != "any") {
+                  user = instance.owner;
+                  includeorgs = [ instance.owner ];
+                  include = [ instance.repo ];
+                })
+                //
+                instance.settings
+              )
+            ];
+          };
+        }))
+        (pkgs.linkFarm "gickup-configuration-files")
+      ];
+    in {
+      description = "Gickup git repository mirroring service for %i";
       after = [ "network.target" ];
 
       path = [
@@ -38,15 +207,17 @@ in
       ];
 
       serviceConfig = {
-        ExecStart = utils.escapeSystemdExecArgs [
+        Slice = "system-gickup.slice";
-          (lib.getExe cfg.package)
+        ExecStart = "'${pkgs.gickup}/bin/gickup' '${configDir}/%i.yml' --debug";
-          (format.generate "gickup-settings.conf" cfg.settings)
-        ];
 
+        User = "gickup";
+        Group = "gickup";
+
+        SyslogIdentifier = "gickup-%i";
         StateDirectory = "gickup";
-        WorkingDirectory = "gickup";
+        # WorkingDirectory = "gickup";
-        RuntimeDirectory = "gickup";
+        # RuntimeDirectory = "gickup";
-        RuntimeDirectoryMode = "0700";
+        # RuntimeDirectoryMode = "0700";
 
         # Hardening options
         AmbientCapabilities = [];
@@ -64,8 +235,8 @@ in
         ProtectKernelLogs = true;
         ProtectKernelModules = true;
         ProtectKernelTunables = true;
-        ProtectProc = "invisible";
+        # ProtectProc = "invisible";
-        ProtectSystem = "strict";
+        # ProtectSystem = "strict";
         RemoveIPC = true;
         RestrictAddressFamilies = [
           "AF_INET"
@@ -75,14 +246,22 @@ in
         RestrictRealtime = true;
         RestrictSUIDSGID = true;
         SystemCallArchitectures = "native";
-        SystemCallFilter = [
+        # SystemCallFilter = [
-          "@system-service"
+        #   "@system-service"
-          "~@resources"
+        #   "~@resources"
-          "~@privileged"
+        #   "~@privileged"
-        ];
+        # ];
         UMask = "0002";
         CapabilityBoundingSet = [];
       };
     };
+
+    users.users.gickup = {
+      isSystemUser = true;
+      group = "gickup";
+      home = "/var/lib/gickup";
+    };
+
+    users.groups.gickup = { };
   };
 }

secrets/bicep/bicep.yaml

@@ -3,6 +3,8 @@ calendar-bot:
     mysql_password: ENC[AES256_GCM,data:Gqag8yOgPH3ntoT5TmaqJWv1j+si2qIyz5Ryfw5E2A==,iv:kQDcxnPfwJQcFovI4f87UDt18F8ah3z5xeY86KmdCyY=,tag:A1sCSNXJziAmtUWohqwJgg==,type:str]
 mysql:
     password: ENC[AES256_GCM,data:KqEe0TVdeMIzPKsmFg9x0X9xWijnOk306ycyXTm2Tpqo/O0F,iv:Y+hlQ8n1ZIP9ncXBzd2kCSs/DWVTWhiEluFVwZFKRCA=,tag:xlaUk0Wftk62LpYE5pKNQw==,type:str]
+gickup:
+    github-token: ENC[AES256_GCM,data:ICv6BP/kCrpx6qPCfdEeLK2NP/3iGmmv8hkHhHdwD1qyQb5g4NYBkm+OyRM4F75WUpg3j80x7I4k1vuSeVLzOldyIQ4uK00NQ58D8Ej/Wfm0ojMQM9g4Sr+6wyor,iv:TovZIU4Cs8nriYHXlCgnj3HV6c9F4A08xFOqrM3ls14=,tag:WwgM7z0ErREUvkafFK3AeQ==,type:str]
 sops:
     kms: []
     gcp_kms: []
@@ -63,8 +65,8 @@ sops:
             cTh5bnJ3WW90aXRCSUp6NHFYeU1tZ0kK4afdtJwGNu6wLRI0fuu+mBVeqVeB0rgX
             0q5hwyzjiRnHnyjF38CmcGgydSfDRmF6P+WIMbCwXC6LwfRhAmBGPg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-08-15T21:18:33Z"
+    lastmodified: "2025-05-07T20:27:27Z"
-    mac: ENC[AES256_GCM,data:uR5HgeDAYqoqB9kk1V6p0T30+v6WpQJi4+qIeCDRnoUPnQKUVR10hvBhICck+E+Uh8p+tGhM6Uf3YrAJAV0ZCUiNJjtwDJQQLUDT53vdOAXN4xADCQqNuhgVwVMaruoTheEiwOswRuhFeEwy0gBj3Ze2pu47lueHYclmEzumLeQ=,iv:t0UyXN2YaR2m7M/pV2wTLJG5wVfqTIUs7wSQMmyeTVw=,tag:O7dIffzrDAXz3kGx5uazhw==,type:str]
+    mac: ENC[AES256_GCM,data:8K+epmSfXj8kne76KieVETzcinH/csyGRKIclGq0woKlSW/U6F8vhaRMQzw3Jvp/aCYYj0N5evmNsVwufgUmvBFovZ/aJ9wZXHRBrwBm9cqLxpb/inA5uB9adOQYXC6JF3RjqA/eKmXMLIuRck9WL65vB5XPny8iOZcgHJ/415w=,iv:21hG0/Ypy4EFWu4VjIgodQa7hFHyFuPSSSJtlIuLqJ8=,tag:I1d+p1V/ByJN+0pY76kOeQ==,type:str]
     pgp:
         - created_at: "2024-08-04T00:03:40Z"
           enc: |-
@@ -87,4 +89,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: F7D37890228A907440E1FD4846B9228E814A2AAC
     unencrypted_suffix: _unencrypted
-    version: 3.9.0
+    version: 3.9.4