From 15fcf88da296aee5e9367833c6d2f13a05a698bf Mon Sep 17 00:00:00 2001
From: OlivierChiasson <olivierchiasson@hotmail.fr>
Date: Fri, 10 Jul 2026 17:54:04 -0300
Subject: [PATCH] Add Cloudflare Turnstile integration to Gitea configuration

- Introduced `cloudflare-turnstile` secrets in `secrets.yaml` for enhanced CAPTCHA support.
- Updated Gitea service configuration to enable Turnstile CAPTCHA with the new secret and site keys.
- Modified last modified date and MAC in `secrets.yaml` for security compliance.
---
 modules/hosts/nix-server/_services/gitea.nix | 21 ++++++++++++++++++--
 modules/hosts/nix-server/secrets.yaml        |  7 +++++--
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/modules/hosts/nix-server/_services/gitea.nix b/modules/hosts/nix-server/_services/gitea.nix
index 173e4cd..e4d1fee 100644
--- a/modules/hosts/nix-server/_services/gitea.nix
+++ b/modules/hosts/nix-server/_services/gitea.nix
@@ -1,5 +1,13 @@
-{ lib, ... }:
+{ lib, config, ... }:
+let
+  secretFilePath = ../secrets.yaml;
+  in
 {
+
+  sops.secrets."cloudflare-turnstile/secret-key".sopsFile = secretFilePath;
+  sops.secrets."cloudflare-turnstile/site-key".sopsFile = secretFilePath;
+  
+
   services.gitea = {
     enable = true;
 
@@ -22,7 +30,16 @@
         SSH_LISTEN_PORT = 222;
       };
 
-      service.DISABLE_REGISTRATION = false;
+      service = {
+        DISABLE_REGISTRATION = false;
+        ENABLE_CAPTCHA = true;
+        CAPTCHA_TYPE = "cfturnstile";
+        CF_TURNSTILE_SECRET = config.sops.secrets."cloudflare-turnstile/secret-key".path;
+        CF_TURNSTILE_SITEKEY = config.sops.secrets."cloudflare-turnstile/site-key".path;
+        REGISTER_EMAIL_CONFIRM = false;
+        ENABLE_NOTIFY_MAIL = false;
+      };
+
     };
   };
 
diff --git a/modules/hosts/nix-server/secrets.yaml b/modules/hosts/nix-server/secrets.yaml
index 63d5c79..40cb1d7 100644
--- a/modules/hosts/nix-server/secrets.yaml
+++ b/modules/hosts/nix-server/secrets.yaml
@@ -17,6 +17,9 @@ personal-website:
     oauth-discord-client-secret: ENC[AES256_GCM,data:YegPgoSRKNcDaID9LPWxHDz4T7VnhFfuWMyALfFhpg8=,iv:VSLWA1HG1+Y70tKnRoFulBZSKdoJTYmIDzCXIZeFYCc=,tag:yNR8rrm/7Mrj/RIVNLFfsg==,type:str]
 cloudflare-ddns:
     api-token: ENC[AES256_GCM,data:wFKbclETO0YQTcfNUdKyr6mxQODeiaYn3gLeC1mWeRda97rOvlum+Q==,iv:IuT4exNhh0z+9DbY3WNnVqEy4398DTm7aluhOv9XFss=,tag:GGPoSJLBScTmXyQ7Vab6EA==,type:str]
+cloudflare-turnstile:
+    secret-key: ENC[AES256_GCM,data:fSsH5HRLvzwyovBezNQnil7due6+FCE2yW/S91aOwqb4yow=,iv:7hTu9YyACvOys42n8XFBmVykKJ0op8btb3xQ6tGpqP4=,tag:Z4FvKKPsb1rAQuWY4v5frg==,type:str]
+    site-key: ENC[AES256_GCM,data:qKmx5EY3Yl5A3zsofFfskN3DrZI+yrHJ,iv:ZGnhkm12VG/O0TNQsKOIb53BlxXPqhBmSPh6rlLGpN4=,tag:C0vQsXRil72z6SRoLiifcA==,type:str]
 sops:
     age:
         - enc: |
@@ -46,7 +49,7 @@ sops:
             Nf0uOoSWPTJ/2SRNkSu7FMumATH4ldQ6TFSwKda3mBfBwhnFzLq10Q==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1p05z980kdtngk9mw67hfev72h7xhslplpxfk9yskgmf0hl4lu3ls04zht9
-    lastmodified: "2026-06-12T00:44:20Z"
-    mac: ENC[AES256_GCM,data:cyI5NH6+OR/Q4T3atFN+gXsJbRaR/Q5I+MyJHy5qXsShh8LnQvEKBnnIPKz2xpuDwFvKd4DabMOxcu5xe6IRH9TN7G411vp+vruM+TicoCJ4U2xAP/J9Tlh3YKT6kZJqj/zAhvP5qPCzvz7xkFTvluLrWgPlaHWn/rlCskh0t5M=,iv:WBeS1rqjJblNGMVa7hEn5MXbZJU8WKd6541BCxu2rGI=,tag:OfOzQI6ESUdUYCbBEq9GFw==,type:str]
+    lastmodified: "2026-07-10T20:47:30Z"
+    mac: ENC[AES256_GCM,data:gqrsaZ7GwS+qkuVRwGkrTJjL1qfBid3RdbGLEZIr1P4XuKatqiFWs0ihj/Qm6jItktoPXwMHcejzx/wQgTImBvdNXDW5TbgF39VJYCZ8r/ToTX2LdZXCBJHim8F9eVE+aBJfsb/LHyvTJLcp3BgrOFyNYjt067585hDt/D3Tmh0=,iv:cKUPZI1lH1wMJVhgR0/TB3iDU6TUSv8vLo+vlThk2AU=,tag:eT2BwsN8mL5RgpQ+pAaKPg==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.1