From 01906e81f9c0854243c11e7fc95ef953c055bffb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Torjus=20H=C3=A5kestad?= <torjus@usit.uio.no>
Date: Sun, 8 Mar 2026 15:15:35 +0100
Subject: [PATCH] nrec-nixos01: use lfs.enable instead of raw setting

The NixOS module's lfs.enable option properly handles LFS JWT secret
generation via forgejo-secrets.service, fixing the permission denied
error on app.ini.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 services/forgejo/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/forgejo/default.nix b/services/forgejo/default.nix
index 49adf14..a1d8a8b 100644
--- a/services/forgejo/default.nix
+++ b/services/forgejo/default.nix
@@ -3,6 +3,7 @@
   services.forgejo = {
     enable = true;
     database.type = "sqlite3";
+    lfs.enable = true;
     settings = {
       server = {
         DOMAIN = "nrec-nixos01.t-juice.club";
@@ -10,7 +11,6 @@
         HTTP_ADDR = "127.0.0.1";
         HTTP_PORT = 3000;
       };
-      server.LFS_START_SERVER = true;
       service.DISABLE_REGISTRATION = true;
       "service.explore".REQUIRE_SIGNIN_VIEW = true;
       session.COOKIE_SECURE = true;