From 41f5e6bae860f1998e70724cad805224b2f92d5f Mon Sep 17 00:00:00 2001
From: Tibo De Peuter <tibo.depeuter@ugent.be>
Date: Wed, 5 Aug 2026 19:39:51 +0200
Subject: [PATCH] feat(gitea): add native NATS JetStream and webhook bridge

---
 nixos/flake.nix                      |  1 +
 nixos/modules/apps/gitea/default.nix | 45 ++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/nixos/flake.nix b/nixos/flake.nix
index bd6a5d1..53487fa 100644
--- a/nixos/flake.nix
+++ b/nixos/flake.nix
@@ -71,6 +71,7 @@
 
     hosts = {
       izanagi.modules = [ ./hosts/izanagi ];
+      Gitea.modules = [ ./hosts/Gitea ];
     };
   };
 }
diff --git a/nixos/modules/apps/gitea/default.nix b/nixos/modules/apps/gitea/default.nix
index eeec8b6..0048728 100644
--- a/nixos/modules/apps/gitea/default.nix
+++ b/nixos/modules/apps/gitea/default.nix
@@ -21,6 +21,50 @@ in {
   options.homelab.apps.gitea.enable = lib.mkEnableOption "Gitea";
 
   config = lib.mkIf cfg.enable {
+    services.nats = {
+      enable = true;
+      listenAddress = "0.0.0.0";
+      port = 4222;
+      jetstream = true;
+    };
+
+    networking.firewall.allowedTCPPorts = [ 4222 9000 ];
+
+    systemd.services.gitea-webhook-bridge = {
+      description = "Gitea Webhook Bridge to NATS JetStream";
+      after = [ "network.target" "nats.service" ];
+      wants = [ "nats.service" ];
+      wantedBy = [ "multi-user.target" ];
+      path = with pkgs; [ natscli python3 ];
+      script = ''
+        python3 -c '
+import http.server
+import subprocess
+import sys
+
+class WebhookHandler(http.server.BaseHTTPRequestHandler):
+    def do_POST(self):
+        content_length = int(self.headers.get("Content-Length", 0))
+        body = self.rfile.read(content_length)
+        try:
+            subprocess.run(["nats", "pub", "--server=nats://127.0.0.1:4222", "forgejo.staging"], input=body, check=True)
+            self.send_response(200)
+            self.end_headers()
+            self.wfile.write(b"OK\n")
+        except Exception as e:
+            self.send_response(500)
+            self.end_headers()
+            self.wfile.write(str(e).encode("utf-8"))
+
+    def log_message(self, format, *args):
+        sys.stderr.write("%s - - [%s] %s\n" % (self.client_address[0], self.log_date_time_string(), format%args))
+
+server = http.server.ThreadingHTTPServer(("0.0.0.0", 9000), WebhookHandler)
+server.serve_forever()
+'
+      '';
+    };
+
     homelab = {
       users = {
         apps.enable = true;
@@ -438,6 +482,7 @@ in {
           # ... oath2_client
 
           # ... webhook
+          FORGEJO__webhook__ALLOWED_HOST_LIST = "192.168.0.0/16,127.0.0.0/8,host.docker.internal,*";
 
           FORGEJO__mailer__ENABLED = "true";
           # Buffer length of channel, keep it as it is if you don't know what it is.