From 40a116fcae5cc49720e108e13733f20882087538 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 6 Jun 2025 00:39:25 +0200
Subject: [PATCH] nixos/gitea: add support for minio secrets

---
 nixos/modules/services/misc/gitea.nix | 30 +++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/nixos/modules/services/misc/gitea.nix b/nixos/modules/services/misc/gitea.nix
index a393abf8aa08..568a301232f9 100644
--- a/nixos/modules/services/misc/gitea.nix
+++ b/nixos/modules/services/misc/gitea.nix
@@ -373,6 +373,20 @@ in
         description = "Path to a file containing the metrics authentication token.";
       };
 
+      minioAccessKeyId = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "/var/lib/secrets/gitea/minio_access_key_id";
+        description = "Path to a file containing the Minio access key id.";
+      };
+
+      minioSecretAccessKey = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "/var/lib/secrets/gitea/minio_secret_access_key";
+        description = "Path to a file containing the Minio secret access key.";
+      };
+
       settings = mkOption {
         default = { };
         description = ''
@@ -655,6 +669,15 @@ in
         };
 
         packages.CHUNKED_UPLOAD_PATH = "${cfg.stateDir}/tmp/package-upload";
+
+        storage = mkMerge [
+          (mkIf (cfg.minioAccessKeyId != null) {
+            MINIO_ACCESS_KEY_ID = "#minioaccesskeyid#";
+          })
+          (mkIf (cfg.minioSecretAccessKey != null) {
+            MINIO_SECRET_ACCESS_KEY = "#miniosecretaccesskey#";
+          })
+        ];
       };
 
     services.postgresql = optionalAttrs (usePostgresql && cfg.database.createDatabase) {
@@ -797,6 +820,13 @@ in
               ${replaceSecretBin} '#metricstoken#' '${cfg.metricsTokenFile}' '${runConfig}'
             ''}
 
+            ${lib.optionalString (cfg.minioAccessKeyId != null) ''
+              ${replaceSecretBin} '#minioaccesskeyid#' '${cfg.minioAccessKeyId}' '${runConfig}'
+            ''}
+            ${lib.optionalString (cfg.minioSecretAccessKey != null) ''
+              ${replaceSecretBin} '#miniosecretaccesskey#' '${cfg.minioSecretAccessKey}' '${runConfig}'
+            ''}
+
             ${lib.optionalString (cfg.captcha.secretFile != null) ''
               ${replaceSecretBin} '#captchasecret#' '${cfg.captcha.secretFile}' '${runConfig}'
             ''}