feat: gitea only secure /urer/settings

2025-08-13 20:14:41 +05:30
parent e7747d0faa
commit 7e6f72a7d0
2 changed files with 16 additions and 6 deletions
--- a/nixos/mirai/services/gitea.nix
+++ b/nixos/mirai/services/gitea.nix
@@ -2,11 +2,12 @@
  lib,
  config,
  ...
-}: {
+}:
+{
  virtualisation.docker.enable = true;
  sops = {
    # secrets."gitea/registration".owner = config.systemd.services.gitea-actions-mirai.serviceConfig.User;
-    secrets."gitea/registration" = {};
+    secrets."gitea/registration" = { };
    templates = {
      "GITEA_REGISTRATION_TOKEN.env".content = ''
        TOKEN=${config.sops.placeholder."gitea/registration"}
@@ -71,6 +72,9 @@
              {
                domain = "git.darksailor.dev";
                policy = "one_factor";
+                resources = [
+                  "/user/settings"
+                ];
              }
            ];
          };