From cdf71a5ded74ed57a8af220202f4a1e78a24c02c Mon Sep 17 00:00:00 2001
From: Daniel Lindenfelser <daniel@lindenfelser.de>
Date: Mon, 15 Dec 2025 09:46:14 +0100
Subject: [PATCH] Add Gitea container configuration and update firewall rules
 for access

---
 modules/fileserver.nix | 25 ++++++++++++++++++++++++-
 modules/gateway.nix    | 25 +++++++++++++++++++++++++
 2 files changed, 49 insertions(+), 1 deletion(-)

diff --git a/modules/fileserver.nix b/modules/fileserver.nix
index af41726..747c663 100644
--- a/modules/fileserver.nix
+++ b/modules/fileserver.nix
@@ -134,6 +134,9 @@
     "d /data/daten 0775 danlin users -"
     "d /data/daten/share 0775 danlin users -"
 
+    # Gitea (runs as git user inside container, uid 1000)
+    "d /data/gitea 0755 root root -"
+
     # DJ-Struktur
     "d /data/daten/DJing 0775 danlin users -"
     "d /data/daten/DJing/Music 0775 danlin users -"
@@ -166,6 +169,26 @@
     };
   };
 
+  virtualisation.oci-containers.containers.gitea = {
+    image = "gitea/gitea:1.25";
+    autoStart = true;
+    ports = [ "3000:3000" "2222:2222" ];
+    volumes = [
+      "/data/gitea:/data"
+    ];
+    environment = {
+      USER_UID = "1000";
+      USER_GID = "1000";
+      TZ = "Europe/Berlin";
+      GITEA__server__DOMAIN = "git.home.lindenfelser.de";
+      GITEA__server__ROOT_URL = "https://git.home.lindenfelser.de/";
+      GITEA__server__SSH_DOMAIN = "git.home.lindenfelser.de";
+      GITEA__server__SSH_PORT = "2222";
+      GITEA__server__SSH_LISTEN_PORT = "2222";
+      GITEA__server__START_SSH_SERVER = "true";
+    };
+  };
+
   virtualisation.oci-containers.containers.dj-beets-cli = {
     image = "dj-beets:latest";
     autoStart = false;  # Run manually or via systemd service
@@ -317,6 +340,6 @@
   ########################################
   networking.firewall.enable = true;
   
-  networking.firewall.allowedTCPPorts = [ 22 139 445 8080 8337 5357 ]; # 5357 WSD
+  networking.firewall.allowedTCPPorts = [ 22 139 445 8080 8337 5357 3000 2222 ]; # 5357 WSD
   networking.firewall.allowedUDPPorts = [ 137 138 3702 5353 ]; # NetBIOS + WSD (3702) + mDNS (5353)
 }
\ No newline at end of file
diff --git a/modules/gateway.nix b/modules/gateway.nix
index febd038..3816068 100644
--- a/modules/gateway.nix
+++ b/modules/gateway.nix
@@ -37,6 +37,11 @@
           reverse_proxy 10.202.82.30:8123
         '';
       };
+      "git.home.lindenfelser.de" = {
+        extraConfig = ''
+          reverse_proxy 10.202.82.6:3000
+        '';
+      };
     };
   };
 
@@ -49,9 +54,29 @@
     22    # SSH
     80    # HTTP (Caddy)
     443   # HTTPS (Caddy)
+    2222  # External SSH to Gitea
   ];
 
   networking.firewall.allowedUDPPorts = [
     53    # DNS (AdGuardHome)
   ];
+
+  ########################################
+  # NAT / Port Forwarding
+  ########################################
+  networking.nat = {
+    enable = true;
+    externalInterface = "ens18";
+    # Hairpin NAT for LAN clients hitting gateway:2222 so replies go back via gateway
+    extraCommands = ''
+      iptables -t nat -A POSTROUTING -p tcp -d 10.202.82.6 --dport 2222 -j MASQUERADE
+    '';
+    forwardPorts = [
+      {
+        proto = "tcp";
+        sourcePort = 2222;
+        destination = "10.202.82.6:2222";
+      }
+    ];
+  };
 }
\ No newline at end of file