feat: provisioned resources properly across microvms

modules/nixos/guests/forgejo/default.nix

@@ -15,13 +15,11 @@ let
 in
 {
   users.users.caddy.extraGroups = [ "acme" ];
-
   security.acme.certs."${host}" = {
     dnsProvider = dns0;
     environmentFile = config.sops.secrets.${dns0Path}.path;
     group = "caddy";
   };
-
   microvm.vms = {
     ${serviceCfg.name} = {
       autostart = true;
@@ -64,7 +62,6 @@ in
               };
             };
           };
-
           openssh = {
             enable = true;
             settings = {
@@ -73,7 +70,6 @@ in
             };
           };
         };
-
         networking.firewall.allowedTCPPorts = [
           22 # SSH
           25 # SMTP
@@ -82,7 +78,6 @@ in
           2525 # SMTP
           serviceCfg.ports.port0
         ];
-
         fileSystems."/tmp" = {
           device = "tmpfs";
           fsType = "tmpfs";
@@ -91,7 +86,6 @@ in
             "mode=1777"
           ];
         };
-
         systemd = {
           network = {
             enable = true;
@@ -110,15 +104,12 @@ in
               ];
             };
           };
-
           tmpfiles.rules = [
             "Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
             # "Z /var/lib/postgresql 0755 postgres postgres -"
           ];
         };
-
         systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
-
         microvm = {
           vcpu = 1;
           mem = 1024;
@@ -166,23 +157,18 @@ in
       };
     };
   };
-
   systemd.tmpfiles.rules = [
     "d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
   ];
-
   services.caddy.virtualHosts."${host}" = {
     extraConfig = ''
       reverse_proxy ${serviceCfg.interface.ip}:${toString serviceCfg.ports.port0} {
         header_up X-Real-IP {remote_host}
       }
-
       tls ${serviceCfg.ssl.cert} ${serviceCfg.ssl.key}
-
       encode zstd gzip
     '';
   };
-
   sops.secrets = {
     "${serviceCfg.name}/smtp" = {
       owner = "root";