modules/nixos/services/gitea.nix

@@ -1,4 +1,4 @@
-{ config, pkgs, lib, ... }:
+{ config, lib, ... }:
 
 let giteaPath = "/var/lib/gitea"; # Default service directory
 
@@ -44,7 +44,6 @@ in {
     };
 
     networking.firewall.allowedTCPPorts = [ 122 ];
-    users.users.${config.user}.extraGroups = [ "gitea" ];
 
     caddy.routes = [{
       match = [{ host = [ config.gitServer ]; }];
@@ -85,34 +84,6 @@ in {
       requires = [ "gitea.service" ];
     };
 
-    # Run a repository file backup on a schedule
-    systemd.timers.gitea-backup = lib.mkIf (config.backup.s3.endpoint != null) {
-      timerConfig = {
-        OnCalendar = "*-*-* 00:00:00"; # Once per day
-        Unit = "gitea-backup.service";
-      };
-      wantedBy = [ "timers.target" ];
-    };
-
-    # Backup Gitea repos to object storage
-    systemd.services.gitea-backup =
-      lib.mkIf (config.backup.s3.endpoint != null) {
-        description = "Backup Gitea data";
-        environment.AWS_ACCESS_KEY_ID = config.backup.s3.accessKeyId;
-        serviceConfig = {
-          Type = "oneshot";
-          User = "gitea";
-          Group = "backup";
-          EnvironmentFile = config.secrets.backup.dest;
-        };
-        script = ''
-          ${pkgs.awscli2}/bin/aws s3 sync --exclude */gitea.db* \
-              ${giteaPath}/ \
-              s3://${config.backup.s3.bucket}/gitea-data/ \
-              --endpoint-url=https://${config.backup.s3.endpoint}
-        '';
-      };
-
   };
 
 }

modules/nixos/services/prometheus.nix

@@ -20,15 +20,16 @@
       webExternalUrl = lib.mkIf config.services.grafana.enable
         "https://${config.prometheusServer}";
       # Web config file: https://prometheus.io/docs/prometheus/latest/configuration/https/
-      webConfigFile = lib.mkIf config.services.grafana.enable
+      webConfigFile =
-        ((pkgs.formats.yaml { }).generate "webconfig.yml" {
+        lib.mkIf config.services.grafana.enable (pkgs.formats.yaml { }).generate
+        "webconfig.yml" {
           basic_auth_users = {
             # Generate password: htpasswd -nBC 10 "" | tr -d ':\n'
             # Encrypt and place in private/prometheus.age
             "prometheus" =
               "$2y$10$r7FWHLHTGPAY312PdhkPEuvb05aGn9Nk1IO7qtUUUjmaDl35l6sLa";
           };
-        });
+        };
       remoteWrite = lib.mkIf (!config.services.grafana.enable) [{
         name = config.networking.hostName;
         url = "https://${config.prometheusServer}";