Wire Forge-native release infrastructure

nixos/modules/burrow-forge.nix

@@ -10,6 +10,7 @@ let
   forgejoAdminArgs = "--config ${lib.escapeShellArg forgejoConfigFile} --work-path ${lib.escapeShellArg forgejoWorkPath} --custom-path ${lib.escapeShellArg forgejoCustomPath}";
   homeRepoPath = "/${cfg.homeOwner}/${cfg.homeRepo}";
   homeRepoUrl = "https://${cfg.gitDomain}${homeRepoPath}";
+  sqlLiteral = value: "'${lib.replaceStrings [ "'" ] [ "''" ] value}'";
 in
 {
   options.services.burrow.forge = {
@@ -236,6 +237,7 @@ in
         repository = {
           DEFAULT_BRANCH = "main";
           ENABLE_PUSH_CREATE_USER = false;
+          DISABLE_MIRRORS = true;
         };
 
         ui = {
@@ -334,6 +336,84 @@ in
       '';
     };
 
+    systemd.services.burrow-forgejo-repository-policy = {
+      description = "Apply Burrow Forgejo repository authority policy";
+      after = [
+        "forgejo.service"
+        "postgresql.service"
+      ];
+      requires = [
+        "forgejo.service"
+        "postgresql.service"
+      ];
+      wantedBy = [ "multi-user.target" ];
+      path = [
+        pkgs.postgresql
+      ];
+      serviceConfig = {
+        Type = "oneshot";
+        User = forgejoCfg.user;
+        Group = forgejoCfg.group;
+        WorkingDirectory = forgejoCfg.stateDir;
+      };
+      script = ''
+        set -euo pipefail
+
+        ready=0
+        for attempt in $(seq 1 60); do
+          if ${pkgs.postgresql}/bin/psql -h /run/postgresql -U forgejo forgejo -tAc \
+            "SELECT 1 FROM pg_tables WHERE schemaname='public' AND tablename='repository';" \
+            | grep -q 1; then
+            ready=1
+            break
+          fi
+          sleep 1
+        done
+
+        if [ "$ready" -ne 1 ]; then
+          echo "Forgejo repository table did not become ready" >&2
+          exit 1
+        fi
+
+        ${pkgs.postgresql}/bin/psql -v ON_ERROR_STOP=1 \
+          -h /run/postgresql -U forgejo forgejo <<'SQL'
+        DO $$
+        DECLARE
+          repo_ids BIGINT[];
+        BEGIN
+          SELECT array_agg(r.id)
+            INTO repo_ids
+            FROM repository r
+            JOIN "user" u ON u.id = r.owner_id
+           WHERE u.lower_name = lower(${sqlLiteral cfg.homeOwner})
+             AND r.lower_name = lower(${sqlLiteral cfg.homeRepo});
+
+          IF repo_ids IS NULL THEN
+            RETURN;
+          END IF;
+
+          IF EXISTS (
+            SELECT 1
+              FROM information_schema.columns
+             WHERE table_schema = 'public'
+               AND table_name = 'repository'
+               AND column_name = 'is_mirror'
+          ) THEN
+            UPDATE repository SET is_mirror = FALSE WHERE id = ANY(repo_ids);
+          END IF;
+
+          IF to_regclass('public.mirror') IS NOT NULL THEN
+            DELETE FROM mirror WHERE repo_id = ANY(repo_ids);
+          END IF;
+
+          IF to_regclass('public.push_mirror') IS NOT NULL THEN
+            DELETE FROM push_mirror WHERE repo_id = ANY(repo_ids);
+          END IF;
+        END $$;
+        SQL
+      '';
+    };
+
     systemd.services.burrow-forgejo-oidc-bootstrap = lib.mkIf (cfg.oidcClientSecretFile != null) {
       description = "Seed the Burrow Forgejo OIDC login source";
       after = [