gogs: remove

Upstream development has stalled and several critical vulnerabilities
that weren't addressed within a year[1][2].

Back then it was fair to mark it as insecure, but given nothing has
happened since, it's time to remove it.

[1] https://forgejo.org/2023-11-release-v1-20-5-1/
[2] https://github.com/gogs/gogs/issues/7777

nixos/doc/manual/release-notes/rl-2411.section.md

@@ -207,6 +207,10 @@
 
 - `deno` has been updated to v2 which has breaking changes. Upstream will be abandoning v1 soon but for now you can use `deno_1` if you are yet to migrate (will be removed prior to cutting a final 24.11 release).
 
+- `gogs` has been removed. Upstream development has stalled and it has several
+  [critical vulnerabilities](https://github.com/gogs/gogs/issues/7777) that weren't addressed
+  within a year. Consider migrating to `forgejo` or `gitea`.
+
 - `knot-dns` has been updated to version 3.4.x. Check the [migration guide](https://www.knot-dns.cz/docs/latest/html/migration.html#upgrade-3-3-x-to-3-4-x) for breaking changes.
 
 - `services.kubernetes.kubelet.clusterDns` now accepts a list of DNS resolvers rather than a single string, bringing the module more in line with the upstream Kubelet configuration schema.

nixos/modules/misc/ids.nix

@@ -296,7 +296,7 @@ in
       sickbeard = 265;
       headphones = 266;
       # couchpotato = 267; # unused, removed 2022-01-01
-      gogs = 268;
+      # gogs = 268; # unused, removed in 2024-10-12
       #pdns-recursor = 269; # dynamically allocated as of 2020-20-18
       #kresd = 270; # switched to "knot-resolver" with dynamic ID
       rpc = 271;
@@ -607,7 +607,7 @@ in
       sickbeard = 265;
       headphones = 266;
       # couchpotato = 267; # unused, removed 2022-01-01
-      gogs = 268;
+      # gogs = 268; # unused, removed in 2024-10-12
       #kresd = 270; # switched to "knot-resolver" with dynamic ID
       #rpc = 271; # unused
       #geoip = 272; # unused

nixos/modules/module-list.nix

@@ -759,7 +759,6 @@
   ./services/misc/gitlab.nix
   ./services/misc/gitolite.nix
   ./services/misc/gitweb.nix
-  ./services/misc/gogs.nix
   ./services/misc/gollum.nix
   ./services/misc/gotenberg.nix
   ./services/misc/gpsd.nix

nixos/modules/services/misc/gogs.nix

@@ -1,271 +0,0 @@
-{ config, lib, options, pkgs, ... }:
-let
-  cfg = config.services.gogs;
-  opt = options.services.gogs;
-  configFile = pkgs.writeText "app.ini" ''
-    BRAND_NAME = ${cfg.appName}
-    RUN_USER = ${cfg.user}
-    RUN_MODE = prod
-
-    [database]
-    TYPE = ${cfg.database.type}
-    HOST = ${cfg.database.host}:${toString cfg.database.port}
-    NAME = ${cfg.database.name}
-    USER = ${cfg.database.user}
-    PASSWORD = #dbpass#
-    PATH = ${cfg.database.path}
-
-    [repository]
-    ROOT = ${cfg.repositoryRoot}
-
-    [server]
-    DOMAIN = ${cfg.domain}
-    HTTP_ADDR = ${cfg.httpAddress}
-    HTTP_PORT = ${toString cfg.httpPort}
-    EXTERNAL_URL = ${cfg.rootUrl}
-
-    [session]
-    COOKIE_NAME = session
-    COOKIE_SECURE = ${lib.boolToString cfg.cookieSecure}
-
-    [security]
-    SECRET_KEY = #secretkey#
-    INSTALL_LOCK = true
-
-    [log]
-    ROOT_PATH = ${cfg.stateDir}/log
-
-    ${cfg.extraConfig}
-  '';
-in
-
-{
-  options = {
-    services.gogs = {
-      enable = lib.mkOption {
-        default = false;
-        type = lib.types.bool;
-        description = "Enable Go Git Service.";
-      };
-
-      useWizard = lib.mkOption {
-        default = false;
-        type = lib.types.bool;
-        description = "Do not generate a configuration and use Gogs' installation wizard instead. The first registered user will be administrator.";
-      };
-
-      stateDir = lib.mkOption {
-        default = "/var/lib/gogs";
-        type = lib.types.str;
-        description = "Gogs data directory.";
-      };
-
-      user = lib.mkOption {
-        type = lib.types.str;
-        default = "gogs";
-        description = "User account under which Gogs runs.";
-      };
-
-      group = lib.mkOption {
-        type = lib.types.str;
-        default = "gogs";
-        description = "Group account under which Gogs runs.";
-      };
-
-      database = {
-        type = lib.mkOption {
-          type = lib.types.enum [ "sqlite3" "mysql" "postgres" ];
-          example = "mysql";
-          default = "sqlite3";
-          description = "Database engine to use.";
-        };
-
-        host = lib.mkOption {
-          type = lib.types.str;
-          default = "127.0.0.1";
-          description = "Database host address.";
-        };
-
-        port = lib.mkOption {
-          type = lib.types.port;
-          default = 3306;
-          description = "Database host port.";
-        };
-
-        name = lib.mkOption {
-          type = lib.types.str;
-          default = "gogs";
-          description = "Database name.";
-        };
-
-        user = lib.mkOption {
-          type = lib.types.str;
-          default = "gogs";
-          description = "Database user.";
-        };
-
-        password = lib.mkOption {
-          type = lib.types.str;
-          default = "";
-          description = ''
-            The password corresponding to {option}`database.user`.
-            Warning: this is stored in cleartext in the Nix store!
-            Use {option}`database.passwordFile` instead.
-          '';
-        };
-
-        passwordFile = lib.mkOption {
-          type = lib.types.nullOr lib.types.path;
-          default = null;
-          example = "/run/keys/gogs-dbpassword";
-          description = ''
-            A file containing the password corresponding to
-            {option}`database.user`.
-          '';
-        };
-
-        path = lib.mkOption {
-          type = lib.types.str;
-          default = "${cfg.stateDir}/data/gogs.db";
-          defaultText = lib.literalExpression ''"''${config.${opt.stateDir}}/data/gogs.db"'';
-          description = "Path to the sqlite3 database file.";
-        };
-      };
-
-      appName = lib.mkOption {
-        type = lib.types.str;
-        default = "Gogs: Go Git Service";
-        description = "Application name.";
-      };
-
-      repositoryRoot = lib.mkOption {
-        type = lib.types.str;
-        default = "${cfg.stateDir}/repositories";
-        defaultText = lib.literalExpression ''"''${config.${opt.stateDir}}/repositories"'';
-        description = "Path to the git repositories.";
-      };
-
-      domain = lib.mkOption {
-        type = lib.types.str;
-        default = "localhost";
-        description = "Domain name of your server.";
-      };
-
-      rootUrl = lib.mkOption {
-        type = lib.types.str;
-        default = "http://localhost:3000/";
-        description = "Full public URL of Gogs server.";
-      };
-
-      httpAddress = lib.mkOption {
-        type = lib.types.str;
-        default = "0.0.0.0";
-        description = "HTTP listen address.";
-      };
-
-      httpPort = lib.mkOption {
-        type = lib.types.port;
-        default = 3000;
-        description = "HTTP listen port.";
-      };
-
-      cookieSecure = lib.mkOption {
-        type = lib.types.bool;
-        default = false;
-        description = ''
-          Marks session cookies as "secure" as a hint for browsers to only send
-          them via HTTPS. This option is recommend, if Gogs is being served over HTTPS.
-        '';
-      };
-
-      extraConfig = lib.mkOption {
-        type = lib.types.str;
-        default = "";
-        description = "Configuration lines appended to the generated Gogs configuration file.";
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-
-    systemd.services.gogs = {
-      description = "Gogs (Go Git Service)";
-      after = [ "network.target" ];
-      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.gogs ];
-
-      preStart = let
-        runConfig = "${cfg.stateDir}/custom/conf/app.ini";
-        secretKey = "${cfg.stateDir}/custom/conf/secret_key";
-      in ''
-        mkdir -p ${cfg.stateDir}
-
-        # copy custom configuration and generate a random secret key if needed
-        ${lib.optionalString (cfg.useWizard == false) ''
-          mkdir -p ${cfg.stateDir}/custom/conf
-          cp -f ${configFile} ${runConfig}
-
-          if [ ! -e ${secretKey} ]; then
-              head -c 16 /dev/urandom | base64 > ${secretKey}
-          fi
-
-          KEY=$(head -n1 ${secretKey})
-          DBPASS=$(head -n1 ${cfg.database.passwordFile})
-          sed -e "s,#secretkey#,$KEY,g" \
-              -e "s,#dbpass#,$DBPASS,g" \
-              -i ${runConfig}
-        ''}
-
-        mkdir -p ${cfg.repositoryRoot}
-        # update all hooks' binary paths
-        HOOKS=$(find ${cfg.repositoryRoot} -mindepth 4 -maxdepth 4 -type f -wholename "*git/hooks/*")
-        if [ "$HOOKS" ]
-        then
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gogs,${pkgs.gogs}/bin/gogs,g' $HOOKS
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/env,${pkgs.coreutils}/bin/env,g' $HOOKS
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/bash,${pkgs.bash}/bin/bash,g' $HOOKS
-          sed -ri 's,/nix/store/[a-z0-9.-]+/bin/perl,${pkgs.perl}/bin/perl,g' $HOOKS
-        fi
-      '';
-
-      serviceConfig = {
-        Type = "simple";
-        User = cfg.user;
-        Group = cfg.group;
-        WorkingDirectory = cfg.stateDir;
-        ExecStart = "${pkgs.gogs}/bin/gogs web";
-        Restart = "always";
-        UMask = "0027";
-      };
-
-      environment = {
-        USER = cfg.user;
-        HOME = cfg.stateDir;
-        GOGS_WORK_DIR = cfg.stateDir;
-      };
-    };
-
-    users = lib.mkIf (cfg.user == "gogs") {
-      users.gogs = {
-        description = "Go Git Service";
-        uid = config.ids.uids.gogs;
-        group = "gogs";
-        home = cfg.stateDir;
-        createHome = true;
-        shell = pkgs.bash;
-      };
-      groups.gogs.gid = config.ids.gids.gogs;
-    };
-
-    warnings = lib.optional (cfg.database.password != "")
-      ''config.services.gogs.database.password will be stored as plaintext
-        in the Nix store. Use database.passwordFile instead.'';
-
-    # Create database passwordFile default when password is configured.
-    services.gogs.database.passwordFile =
-      (lib.mkDefault (toString (pkgs.writeTextFile {
-        name = "gogs-database-password";
-        text = cfg.database.password;
-      })));
-  };
-}

pkgs/applications/version-management/gogs/default.nix

@@ -1,54 +0,0 @@
-{ lib, buildGoModule, fetchFromGitHub, makeWrapper
-, git, bash, gzip, openssh, pam
-, sqliteSupport ? true
-, pamSupport ? true
-}:
-
-buildGoModule rec {
-  pname = "gogs";
-  version = "0.13.0";
-
-  src = fetchFromGitHub {
-    owner = "gogs";
-    repo = "gogs";
-    rev = "v${version}";
-    sha256 = "sha256-UfxE+NaqDr3XUXpvlV989Iwjq/lsAwpMTDAPkcOmma8=";
-  };
-
-  vendorHash = "sha256-ISJOEJ1DWO4nnMpDuZ36Nq528LhgekDh3XUF8adlj2w=";
-
-  subPackages = [ "." ];
-
-  postPatch = ''
-    patchShebangs .
-  '';
-
-  nativeBuildInputs = [ makeWrapper openssh ];
-
-  buildInputs = lib.optional pamSupport pam;
-
-  tags =
-    (  lib.optional sqliteSupport "sqlite"
-    ++ lib.optional pamSupport "pam");
-
-  postInstall = ''
-
-    wrapProgram $out/bin/gogs \
-      --prefix PATH : ${lib.makeBinPath [ bash git gzip openssh ]}
-  '';
-
-  meta = with lib; {
-    description = "Painless self-hosted Git service";
-    homepage = "https://gogs.io";
-    license = licenses.mit;
-    maintainers = [ maintainers.schneefux ];
-    mainProgram = "gogs";
-    knownVulnerabilities = [ ''
-      Gogs has known unpatched vulnerabilities and upstream maintainers appears to be unresponsive.
-
-      More information can be found in forgejo's blogpost: https://forgejo.org/2023-11-release-v1-20-5-1/
-
-      You might want to consider migrating to Gitea or forgejo.
-    '' ];
-  };
-}

pkgs/top-level/aliases.nix

@@ -561,6 +561,12 @@ mapAliases {
   gmtp = throw "'gmtp' has been removed due to lack of maintenance upstream. Consider using 'gnome-music' instead"; # Added 2024-09-14
   gnome-latex = throw "'gnome-latex' has been superseded by 'enter-tex'"; # Added 2024-09-18
   gnu-cobol = gnucobol; # Added 2024-09-17
+  gogs = throw ''
+    Gogs development has stalled. Also, it has several unpatched, critical vulnerabilities that
+    weren't addressed within a year: https://github.com/gogs/gogs/issues/7777
+
+    Consider migrating to forgejo or gitea.
+  ''; # Added 2024-10-12
   go-dependency-manager = throw "'go-dependency-manager' is unmaintained and the go community now uses 'go.mod' mostly instead"; # Added 2023-10-04
   gotktrix = throw "'gotktrix' has been removed, as it was broken and unmaintained"; # Added 2023-12-06
   git-backup = throw "git-backup has been removed, as it has been abandoned upstream. Consider using git-backup-go instead.";

pkgs/top-level/all-packages.nix

@@ -7893,8 +7893,6 @@ with pkgs;
 
   gitqlient = libsForQt5.callPackage ../applications/version-management/gitqlient { };
 
-  gogs = callPackage ../applications/version-management/gogs { };
-
   git-latexdiff = callPackage ../tools/typesetting/git-latexdiff { };
 
   gokart = callPackage ../development/tools/gokart { };