init

.gitignore

@@ -0,0 +1,2 @@
+result
+garp*

configuration.nix

@@ -0,0 +1,138 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+let
+  # CHANGE THESE
+  domain = "git.example.com";
+  acmeEmail = "you@example.com";
+  sshKeys = [
+    "ssh-ed25519 AAAA...replace-with-your-public-key... user@host"
+  ];
+in
+{
+  # ─── Boot ──────────────────────────────────────────────────────────
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  # ─── Networking ────────────────────────────────────────────────────
+  networking.hostName = "garp";
+  networking.useDHCP = lib.mkDefault true;
+  networking.firewall.allowedTCPPorts = [
+    22
+    80
+    443
+  ];
+
+  time.timeZone = "UTC";
+
+  nix = {
+    settings.experimental-features = [
+      "nix-command"
+      "flakes"
+    ];
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 14d";
+    };
+  };
+
+  services.xserver.xkb = {
+    layout = "de";
+  };
+  console.keyMap = "de";
+
+  # SSH (needed for nixos-anywhere and later rebuilds)
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = "prohibit-password";
+      PasswordAuthentication = false;
+    };
+  };
+  users.users.root.openssh.authorizedKeys.keys = sshKeys;
+
+  virtualisation.docker = {
+    enable = true;
+    autoPrune.enable = true;
+  };
+
+  # Native module (not Docker) — gets proper systemd units, log
+  # integration, and works with services.forgejo.dump for backups.
+  services.forgejo = {
+    enable = true;
+    database.type = "sqlite3";
+    settings = {
+      server = {
+        DOMAIN = domain;
+        ROOT_URL = "https://${domain}/";
+        HTTP_ADDR = "127.0.0.1";
+        HTTP_PORT = 3000;
+      };
+      service.DISABLE_REGISTRATION = true;
+      session.COOKIE_SECURE = true;
+      log.LEVEL = "Warn";
+    };
+  };
+
+  services.caddy = {
+    enable = true;
+    email = acmeEmail;
+    virtualHosts.${domain}.extraConfig = ''
+      reverse_proxy 127.0.0.1:3000
+    '';
+  };
+
+  environment.systemPackages = with pkgs; [
+    git
+    neovim
+    btop
+    tmux
+    curl
+  ];
+
+  # VM-only overrides (applied by `nixos-rebuild build-vm`)
+  virtualisation.vmVariant = {
+    virtualisation = {
+      memorySize = 2048;
+      cores = 2;
+      forwardPorts = [
+        {
+          from = "host";
+          host.port = 2222;
+          guest.port = 22;
+        }
+        {
+          from = "host";
+          host.port = 3000;
+          guest.port = 3000;
+        }
+        {
+          from = "host";
+          host.port = 8080;
+          guest.port = 80;
+        }
+      ];
+    };
+
+    # Reach Forgejo from the host via the forwarded port
+    services.forgejo.settings.server.HTTP_ADDR = lib.mkForce "0.0.0.0";
+
+    # Caddy without TLS in the VM (no real DNS / ACME)
+    services.caddy.virtualHosts = lib.mkForce {
+      ":80".extraConfig = ''
+        reverse_proxy 127.0.0.1:3000
+      '';
+    };
+
+    # Easy SSH into the VM for poking around
+    services.openssh.settings.PermitRootLogin = lib.mkForce "yes";
+    services.openssh.settings.PasswordAuthentication = lib.mkForce true;
+    users.users.root.password = lib.mkForce "test";
+  };
+
+  system.stateVersion = "25.11";
+}

disko.nix

@@ -0,0 +1,33 @@
+{
+  disko.devices.disk.main = {
+    # CHANGE THIS to match the target disk:
+    #   /dev/sda       — typical SATA / SCSI
+    #   /dev/vda       — KVM / QEMU virtio
+    #   /dev/nvme0n1   — NVMe
+    device = "/dev/vda";
+    type = "disk";
+    content = {
+      type = "gpt";
+      partitions = {
+        ESP = {
+          size = "512M";
+          type = "EF00";
+          content = {
+            type = "filesystem";
+            format = "vfat";
+            mountpoint = "/boot";
+            mountOptions = [ "umask=0077" ];
+          };
+        };
+        root = {
+          size = "100%";
+          content = {
+            type = "filesystem";
+            format = "ext4";
+            mountpoint = "/";
+          };
+        };
+      };
+    };
+  };
+}

flake.lock

@@ -0,0 +1,48 @@
+{
+  "nodes": {
+    "disko": {
+      "inputs": {
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1776613567,
+        "narHash": "sha256-gC9Cp5ibBmGD5awCA9z7xy6MW6iJufhazTYJOiGlCUI=",
+        "owner": "nix-community",
+        "repo": "disko",
+        "rev": "32f4236bfc141ae930b5ba2fb604f561fed5219d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "disko",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1777077449,
+        "narHash": "sha256-AIiMJiqvGrN4HyLEbKAoCSRRYn0rnlW5VbKNIMIYqm4=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a4bf06618f0b5ee50f14ed8f0da77d34ecc19160",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-25.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "disko": "disko",
+        "nixpkgs": "nixpkgs"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,24 @@
+{
+  description = "Minimal NixOS server: Docker + Caddy + Forgejo";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
+    disko = {
+      url = "github:nix-community/disko";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    { nixpkgs, disko, ... }:
+    {
+      nixosConfigurations.garp = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          disko.nixosModules.disko
+          ./disko.nix
+          ./configuration.nix
+        ];
+      };
+    };
+}

justfile

@@ -0,0 +1,11 @@
+# https://just.systems
+
+default:
+    echo 'Hello, world!'
+
+vm:
+    nixos-rebuild build-vm --flake .#server
+    ./result/bin/run-garp-vm -nographic
+ 
+ rebuild-remote:
+     nixos-rebuild switch --flake .#garp --target-host root@{{ domain }}