Services are ready.

modules/services/gitea.nix

@@ -3,29 +3,32 @@
 with lib;
 
 let
+  giteaVersion = "1.25.4-rootless";
+  databaseVersion = "18-alpine";
   helper = import ./lib.nix { inherit config pkgs lib; };
   cfg = config.numbus.services.gitea;
 in
 
 helper.mkPodmanService {
-  name = "gitea";
   description = "Gitea, your own self-hosted git platform";
-  defaultPort = "3000";
+  name = "gitea";
   pod = "gitea";
+  defaultPort = "3000";
 
   composeText = ''
     services:
       gitea-server:
-        image: docker.gitea.com/gitea:latest-rootless
+        image: docker.gitea.com/gitea:${giteaVersion}
         container_name: gitea-server
         hostname: gitea-server
+        user: '1000:1000'
         networks:
           gitea:
         ports:
           - "${cfg.port}:3000/tcp"
         volumes:
-          - ${cfg.dataDir}:/var/lib/gitea
-          - ${cfg.configDir}:/etc/gitea
+          - ${cfg.configDir}/data:/var/lib/gitea
+          - ${cfg.configDir}/config:/etc/gitea
           - /etc/localtime:/etc/localtime:ro
         environment:
           - GITEA__database__DB_TYPE=postgres
@@ -37,22 +40,32 @@ helper.mkPodmanService {
           - GITEA__server__ROOT_URL=${cfg.subdomain}.${config.numbus.services.domain}
         depends_on:
           - gitea-database
+        security_opt:
+          - no-new-privileges:true
+        cap_drop:
+          - NET_RAW
         restart: unless-stopped
       gitea-database:
-        image: docker.io/library/postgres:14
+        image: docker.io/library/postgres:${databaseVersion}
         container_name: gitea-database
         hostname: gitea-database
+        user: '999:999'
         networks:
           gitea:
         volumes:
-          - gitea_database:/var/lib/postgresql/data
+          - ${cfg.configDir}/database:/var/lib/postgresql
         environment:
           - POSTGRES_USER=$DB_USERNAME
           - POSTGRES_PASSWORD=$DB_PASSWORD
           - POSTGRES_DB=$DB_NAME
+        security_opt:
+          - no-new-privileges:true
+        cap_drop:
+          - NET_RAW
         restart: unless-stopped
     volumes:
       gitea_database:
+        name: gitea_database
     networks:
       gitea:
         name: gitea