Olivier/chiasson-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Cloudflare Turnstile integration to Gitea configuration

Browse Source 
- Introduced `cloudflare-turnstile` secrets in `secrets.yaml` for enhanced CAPTCHA support.
- Updated Gitea service configuration to enable Turnstile CAPTCHA with the new secret and site keys.
- Modified last modified date and MAC in `secrets.yaml` for security compliance.
This commit is contained in:
OlivierChiasson
2026-07-10 17:54:04 -03:00
parent b70f9f4822
commit 15fcf88da2
2 changed files with 24 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/hosts/nix-server/_services/gitea.nix
+19 -2
View File
@@ -1,5 +1,13 @@
{ lib, ... }: { lib, config, ... }:
let
secretFilePath = ../secrets.yaml;
in
{ {
sops.secrets."cloudflare-turnstile/secret-key".sopsFile = secretFilePath;
sops.secrets."cloudflare-turnstile/site-key".sopsFile = secretFilePath;
services.gitea = { services.gitea = {
enable = true; enable = true;
@@ -22,7 +30,16 @@
SSH_LISTEN_PORT = 222; SSH_LISTEN_PORT = 222;
}; };
service.DISABLE_REGISTRATION = false; service = {
DISABLE_REGISTRATION = false;
ENABLE_CAPTCHA = true;
CAPTCHA_TYPE = "cfturnstile";
CF_TURNSTILE_SECRET = config.sops.secrets."cloudflare-turnstile/secret-key".path;
CF_TURNSTILE_SITEKEY = config.sops.secrets."cloudflare-turnstile/site-key".path;
REGISTER_EMAIL_CONFIRM = false;
ENABLE_NOTIFY_MAIL = false;
};
}; };
}; };
modules/hosts/nix-server/secrets.yaml
+5 -2
View File
@@ -17,6 +17,9 @@ personal-website:
oauth-discord-client-secret: ENC[AES256_GCM,data:YegPgoSRKNcDaID9LPWxHDz4T7VnhFfuWMyALfFhpg8=,iv:VSLWA1HG1+Y70tKnRoFulBZSKdoJTYmIDzCXIZeFYCc=,tag:yNR8rrm/7Mrj/RIVNLFfsg==,type:str] oauth-discord-client-secret: ENC[AES256_GCM,data:YegPgoSRKNcDaID9LPWxHDz4T7VnhFfuWMyALfFhpg8=,iv:VSLWA1HG1+Y70tKnRoFulBZSKdoJTYmIDzCXIZeFYCc=,tag:yNR8rrm/7Mrj/RIVNLFfsg==,type:str]
cloudflare-ddns: cloudflare-ddns:
api-token: ENC[AES256_GCM,data:wFKbclETO0YQTcfNUdKyr6mxQODeiaYn3gLeC1mWeRda97rOvlum+Q==,iv:IuT4exNhh0z+9DbY3WNnVqEy4398DTm7aluhOv9XFss=,tag:GGPoSJLBScTmXyQ7Vab6EA==,type:str] api-token: ENC[AES256_GCM,data:wFKbclETO0YQTcfNUdKyr6mxQODeiaYn3gLeC1mWeRda97rOvlum+Q==,iv:IuT4exNhh0z+9DbY3WNnVqEy4398DTm7aluhOv9XFss=,tag:GGPoSJLBScTmXyQ7Vab6EA==,type:str]
cloudflare-turnstile:
secret-key: ENC[AES256_GCM,data:fSsH5HRLvzwyovBezNQnil7due6+FCE2yW/S91aOwqb4yow=,iv:7hTu9YyACvOys42n8XFBmVykKJ0op8btb3xQ6tGpqP4=,tag:Z4FvKKPsb1rAQuWY4v5frg==,type:str]
site-key: ENC[AES256_GCM,data:qKmx5EY3Yl5A3zsofFfskN3DrZI+yrHJ,iv:ZGnhkm12VG/O0TNQsKOIb53BlxXPqhBmSPh6rlLGpN4=,tag:C0vQsXRil72z6SRoLiifcA==,type:str]
sops: sops:
age: age:
- enc: | - enc: |
@@ -46,7 +49,7 @@ sops:
Nf0uOoSWPTJ/2SRNkSu7FMumATH4ldQ6TFSwKda3mBfBwhnFzLq10Q== Nf0uOoSWPTJ/2SRNkSu7FMumATH4ldQ6TFSwKda3mBfBwhnFzLq10Q==
-----END AGE ENCRYPTED FILE----- -----END AGE ENCRYPTED FILE-----
recipient: age1p05z980kdtngk9mw67hfev72h7xhslplpxfk9yskgmf0hl4lu3ls04zht9 recipient: age1p05z980kdtngk9mw67hfev72h7xhslplpxfk9yskgmf0hl4lu3ls04zht9
lastmodified: "2026-06-12T00:44:20Z" lastmodified: "2026-07-10T20:47:30Z"
mac: ENC[AES256_GCM,data:cyI5NH6+OR/Q4T3atFN+gXsJbRaR/Q5I+MyJHy5qXsShh8LnQvEKBnnIPKz2xpuDwFvKd4DabMOxcu5xe6IRH9TN7G411vp+vruM+TicoCJ4U2xAP/J9Tlh3YKT6kZJqj/zAhvP5qPCzvz7xkFTvluLrWgPlaHWn/rlCskh0t5M=,iv:WBeS1rqjJblNGMVa7hEn5MXbZJU8WKd6541BCxu2rGI=,tag:OfOzQI6ESUdUYCbBEq9GFw==,type:str] mac: ENC[AES256_GCM,data:gqrsaZ7GwS+qkuVRwGkrTJjL1qfBid3RdbGLEZIr1P4XuKatqiFWs0ihj/Qm6jItktoPXwMHcejzx/wQgTImBvdNXDW5TbgF39VJYCZ8r/ToTX2LdZXCBJHim8F9eVE+aBJfsb/LHyvTJLcp3BgrOFyNYjt067585hDt/D3Tmh0=,iv:cKUPZI1lH1wMJVhgR0/TB3iDU6TUSv8vLo+vlThk2AU=,tag:eT2BwsN8mL5RgpQ+pAaKPg==,type:str]
unencrypted_suffix: _unencrypted unencrypted_suffix: _unencrypted
version: 3.13.1 version: 3.13.1