From db84a0bcc1195802a1f7cf33d80c91cd5b92300b Mon Sep 17 00:00:00 2001
From: beatzaplenty <wayne.bennett@live.com>
Date: Thu, 30 Jul 2026 17:47:22 +1000
Subject: [PATCH] Add Gitea read-only token to nix access-tokens for private
 repo rebuilds

---
 modules/common/configuration.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/modules/common/configuration.nix b/modules/common/configuration.nix
index 639ec21..88081d0 100644
--- a/modules/common/configuration.nix
+++ b/modules/common/configuration.nix
@@ -71,18 +71,19 @@ in
       "root-hashedPassword".neededForUsers = true;
       "nixos-hashedPassword".neededForUsers = true;
       "nix-github-token" = { };
+      "nix-gitea-token" = { };
     };
 
-    # nix.conf has no *File-style option for access-tokens, so the token is
+    # nix.conf has no *File-style option for access-tokens, so tokens are
     # rendered into a runtime-only file (never touches the Nix store) and
     # pulled in via nix.conf's native !include directive.
-    templates."nix-github-token.conf".content = ''
-      access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
+    templates."nix-access-tokens.conf".content = ''
+      access-tokens = github.com=${config.sops.placeholder."nix-github-token"} ${vars.giteaDomain}=${config.sops.placeholder."nix-gitea-token"}
     '';
   };
 
   nix.extraOptions = ''
-    !include ${config.sops.templates."nix-github-token.conf".path}
+    !include ${config.sops.templates."nix-access-tokens.conf".path}
   '';
 
   users = {