Add and set up a basic Gitea

This commit is contained in:
Salt 2020-10-29 20:39:59 -05:00
parent e9e1936b50
commit 70c609c94a
28 changed files with 970 additions and 0 deletions

View File

@ -13,3 +13,34 @@ apache_ssl_protocol: all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
# For geerlingguy.php # For geerlingguy.php
## There is no circumstance in which I need PHP but DON'T need mod_php ## There is no circumstance in which I need PHP but DON'T need mod_php
php_packages_extra: [ libapache2-mod-php ] php_packages_extra: [ libapache2-mod-php ]
# For gitea
secret_gitea_db_pass: !vault |
$ANSIBLE_VAULT;1.1;AES256
35343032343364306363646232613831386530313430663664396432353431393039626230626137
6339653038633534313562333431613362313263623130300a383930626437636466623763663334
64646239633830656338336135313261396536303739373731633830633366313262313035626233
6463663332623635320a356565666638306661356365643930303664346232303165373333613235
62396535653338396232616531323738656636613065336337333336306437363539303766623866
3932386635393061643737326163643164643365303866643766
gitea_secret_key: !vault |
$ANSIBLE_VAULT;1.1;AES256
34373339636233393231363531323338306330653139376661356336343133373836323065333665
3537613462316361646161653966643862633033646134370a643133393162313434383663643538
31343164666235316235393163376134636433386361353266613263363839366432356132383533
3434643430306234350a353037373530653865363931333237663133626537643730643634356162
33353632613637306336653734343332393661343539393034313437373636383732393062333530
3337633338323131373130376137393766363737393536386636
gitea_internal_token: !vault |
$ANSIBLE_VAULT;1.1;AES256
34323237383664663266653034656437643363316538663338383262663931356665383363656466
3861653830626538303761303638663835316239343033370a323164303164613265363535643432
31393732393361666331396533333339623665623562643962323632653537666339346266393632
6639663137613232640a383633343038626638626434636230346634373533616564316262333833
64376163636230303361326532316665366633373035336164393033653366653564633339386338
35326462333364353032343238363230343235303037306532333765376464326234633739396534
31333332613964313031346534306236383434346430396233646132393962383636383631643461
37366163373863653164626365383761623431613164653932363730633134633032336266616335
61626133316161616335323630333461663163613430353438633235336331343934386464373866
62633234313261363537663061373931303832653531356566633739636264666635653936313965
623964653936646334313864643030653763

View File

@ -0,0 +1,9 @@
use_default_rules: true
exclude_paths:
- venv/
- molecule/default/
- tests/
#skip_list:
# - '301'

10
roles/gitea/.gitignore vendored Normal file
View File

@ -0,0 +1,10 @@
*.pyc
# Environments
.env
.venv
env/
venv/
ENV/
env.bak/
venv.bak/

26
roles/gitea/.travis.yml Normal file
View File

@ -0,0 +1,26 @@
---
language: python
python:
- "3.7"
env:
matrix:
- MOLECULE_DISTRO: centos8
- MOLECULE_DISTRO: centos7
- MOLECULE_DISTRO: ubuntu1804
- MOLECULE_DISTRO: ubuntu1604
- MOLECULE_DISTRO: debian10
- MOLECULE_DISTRO: debian9
- MOLECULE_DISTRO: fedora31
services:
- docker
install:
- python -m pip -q install -r requirements-travis.txt
script:
- molecule test
notifications:
webhooks: https://galaxy.ansible.com/api/v1/notifications/

12
roles/gitea/.yamllint Normal file
View File

@ -0,0 +1,12 @@
---
extends: default
rules:
line-length:
max: 100
level: warning
ignore: |
/venv/
/env/
/molecule/

11
roles/gitea/LICENSE Normal file
View File

@ -0,0 +1,11 @@
Copyright 2019-present Thomas Maurice
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

190
roles/gitea/README.md Normal file
View File

@ -0,0 +1,190 @@
# Ansible role gitea - Install a gitea server
[![Build Status](https://travis-ci.org/thomas-maurice/ansible-role-gitea.svg?branch=master)](https://travis-ci.org/thomas-maurice/ansible-role-gitea)
![Ansible Role](https://img.shields.io/ansible/role/38779)
![Ansible Role](https://img.shields.io/ansible/role/d/38779)
![Ansible Quality Score](https://img.shields.io/ansible/quality/38779)
This role installs and manages a [gitea](https://gitea.io) server -
[Source code & screenshots](https://github.com/go-gitea/gitea).
Gitea is a Golang Git repository webapp, having the same look and feel as GitHub.
## Sample example of use in a playbook
The following code has been tested with Debian 8, it should work on Ubuntu as well.
```yaml
- name: "Install gitea"
hosts: all
vars:
gitea_user: "gitea"
gitea_home: "/var/lib/gitea"
# To limit your users to 30 repos
gitea_user_repo_limit: 30
# Don't use a public CDN for frontend assets
gitea_offline_mode: true
# Some 'rendering' options for your URLs
gitea_http_domain: git.yourdomain.fr
gitea_root_url: https://git.yourdomain.fr
# Here we assume we are behind a reverse proxy that will
# handle https for us, so we bind on localhost:3000 using HTTP
gitea_protocol: http
gitea_http_listen: 127.0.0.1
gitea_http_port: 3000
# SSH server configuration
gitea_ssh_listen: 0.0.0.0
gitea_ssh_port: 2222
# For URLs rendering again
gitea_ssh_domain: git.yourdomain.fr
gitea_start_ssh: true
gitea_secret_key: 3sp00ky5me
gitea_disable_gravatar: true
# To make at least your first user register
gitea_disable_registration: false
gitea_require_signin: true
gitea_enable_captcha: true
gitea_show_user_email: false
roles:
- gitea
```
## More detailed options
### General
* `gitea_version_check`: Check if installed version != `gitea_version` before initiating binary download
* `gitea_user`: UNIX user used by Gitea
* `gitea_home`: Base directory to work
* `gitea_dl_url`: The URL, the compiled gitea-binary will be downloaded from
* `gitea_systemd_cap_net_bind_service`: Adds `AmbientCapabilities=CAP_NET_BIND_SERVICE` to systemd service file
### Look and feel
* `gitea_app_name`: Displayed application name
* `gitea_show_user_email`: Do you want to display email addresses ? (true/false)
* `gitea_disable_gravatar`: Do you want to disable Gravatar ? (privacy and so on) (true/false)
* `gitea_offline_mode`: Same but for disabling CDNs for frontend assets (true/false)
* `gitea_disable_registration`: Do you want to disable user registration ? (true/false)
* `gitea_only_allow_external_registration`: Do you want to force registration only using third-party services ? (true/false)
* `gitea_show_registration_button`: Do you want to show the registration button? (true/false)
* `gitea_require_signin`: Do you require a signin to see repo's (even public ones) ? (true/false)
* `gitea_enable_captcha`: Do you want to enable captcha's ? (true/false)
* `gitea_secret_key`: Cookie secret key
* `gitea_internal_token`: Internal API token
* `gitea_themes`: List of enabled themes
* `gitea_theme_default`: Default theme
### Limits
* `gitea_user_repo_limit`: Limit how many repos a user can have (-1 for unlimited)
### HTTP configuration
* `gitea_http_domain`: HTTP domain (displayed in your clone URLs, just the domain like git.foo.fr)
* `gitea_root_url`: Root URL used to access your web app (full URL)
* `gitea_protocol`: Listening protocol (http/https)
* `gitea_http_listen`: Bind address
* `gitea_http_port`: Bind port
* `gitea_disable_http_git`: Disable the use of Git over HTTP ? (true/false)
### SSH configuration
* `gitea_ssh_listen`: Bind address for the SSH server
* `gitea_ssh_domain`: SSH domain (displayed in your clone URLs)
* `gitea_start_ssh`: Do you want to start a built-in SSH server ? (true/false)
* `gitea_ssh_port`: SSH bind port
### Database configuration
* `gitea_db_type`: Database type, can be `mysql`, `postgres` or `sqlite3`
* `gitea_db_host`: Database host string `host:port` or `/run/postgresql/` when connectiong to postgres via local unix socket (peer authentication)
* `gitea_db_name`: Database name
* `gitea_db_user`: Database username
* `gitea_db_password`: Database password
* `gitea_db_ssl`: Use SSL ? (postgres only!). Can be `required`, `disable`, `verify-full`
* `gitea_db_path`: DB path, if you use `sqlite3`. The default is good enough to work though.
### Mailer configuration
* `gitea_mailer_enabled`: Whether to enable the mailer. Default: `false`
* `gitea_mailer_skip_verify`: Skip SMTP TLS certificate verification (true/false)
* `gitea_mailer_tls_enabled`: Enable TLS for SMTP connections (true/false)
* `gitea_mailer_host`: SMTP server hostname and port
* `gitea_mailer_user`: SMTP server username
* `gitea_mailer_password`: SMTP server password
* `gitea_mailer_from`: Sender mail address
* `gitea_enable_notify_mail`: Whether e-mail should be send to watchers of a repository when something happens. Default: `false`
### Fail2Ban configuration
If enabled, this will deploy a fail2ban filter and jail config for Gitea as described in the [Gitea Documentation](https://docs.gitea.io/en-us/fail2ban-setup/).
As this will only deploy config files, fail2ban already has to be installed or otherwise the role will fail.
* `gitea_fail2ban_enabled`: Whether to deploy the fail2ban config or not
* `gitea_fail2ban_jail_maxretry`: fail2ban jail `maxretry` setting. Default: `10`
* `gitea_fail2ban_jail_findtime`: fail2ban jail `findtime` setting. Default: `3600`
* `gitea_fail2ban_jail_bantime`: fail2ban jail `bantime` setting. Default: `900`
* `gitea_fail2ban_jail_action`: fail2ban jail `action` setting. Default: `iptables-allports`
### Oauth2 provider configuration
* `gitea_oauth2_enabled`: Enable the Oauth2 provider (true/false)
* `gitea_oauth2_jwt_secret`: JWT secret, cannot be longer than 32 characters
### Metrics endpoint configuration
* `gitea_metrics_enabled`: Enable the metrics endpoint
* `gitea_metrics_token`: Bearer token for the Prometheus scrape job
### Repository Indexer configuration
* `gitea_repo_indexer_enabled`: Whether to enable the repository indexer (code search). Default: `false`
* `gitea_repo_indexer_include`: Glob patterns to include in the index (comma-separated list). Default: `""` (all files)
* `gitea_repo_indexer_exclude`: Glob patterns to exclude from the index (comma-separated list). Default: `""` (no files)
* `gitea_repo_exclude_vendored`: Exclude vendored files from the index. Default: `true`
* `gitea_repo_indexer_max_file_size`: Maximum size of files to be indexed (in bytes). Default: `1048576` (1 MB)
## Contributing
Don't hesitate to create a pull request, and when in doubt you can reach me on
Twitter [@thomas_maurice](https://twitter.com/thomas_maurice).
I'm happy to fix any issue that's been opened, or even better, review your pull requests :)
## Testing
Testing uses [molecule](https://molecule.readthedocs.io/en/stable-1.22/usage.html). To start the
tests, install the dependencies first. I would recommend you use [a virtual env](https://virtualenv.pypa.io/en/latest/) for that but who am I to tell you what to do.
```
pip install pew # install pew to manage the venvs
pew new ansible # create the venv
pip install -r requirements-travis.txt # install the requirements
molecule test # Run the actual tests
```
Note: you need Docker installed
### Known testing limitations
Currently it's mainly validating that the playbook runs, the lint is ok, and that kind of things.
Since it runs in Docker, we currently have no way to check if the service is actually launched by systemd
and so on. This has to be worked on.
## License
```
Copyright 2019-present Thomas Maurice
Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
```

View File

@ -0,0 +1,81 @@
---
gitea_version: "1.12.4"
gitea_version_check: true
gitea_dl_url: "https://github.com/go-gitea/gitea/releases/download/v{{ gitea_version }}/gitea-{{ gitea_version }}-linux-{{ gitea_arch }}"
gitea_app_name: "Gitea"
gitea_user: "gitea"
gitea_home: "/var/lib/gitea"
gitea_shell: "/bin/false"
gitea_systemd_cap_net_bind_service: false
gitea_repository_root: "{{ gitea_home }}"
gitea_user_repo_limit: -1
gitea_http_domain: localhost
gitea_root_url: http://localhost:3000
gitea_protocol: http
gitea_http_listen: 127.0.0.1
gitea_http_port: 3000
gitea_disable_http_git: false
gitea_offline_mode: true
gitea_lfs_server_enabled: false
gitea_lfs_content_path: "data/lfs"
gitea_db_type: sqlite3
gitea_db_host: 127.0.0.0:3306
gitea_db_name: root
gitea_db_user: gitea
gitea_db_password: lel
gitea_db_ssl: disable
gitea_db_path: "{{ gitea_home }}/data/gitea.db"
gitea_ssh_listen: 0.0.0.0
gitea_ssh_domain: localhost
gitea_start_ssh: true
gitea_ssh_port: 2222
gitea_secret_key: T0pS3cr31
gitea_internal_token: SomethingVeryLong
gitea_show_user_email: false
gitea_disable_gravatar: true
gitea_disable_registration: false
gitea_show_registration_button: true
gitea_require_signin: true
gitea_enable_captcha: true
gitea_only_allow_external_registration: false
gitea_enable_notify_mail: false
gitea_force_private: false
gitea_mailer_enabled: false
gitea_mailer_skip_verify: false
gitea_mailer_tls_enabled: true
gitea_mailer_host: localhost:25
gitea_mailer_from: noreply@your.domain
gitea_mailer_user: ""
gitea_mailer_password: ""
gitea_mailer_type: smtp
gitea_fail2ban_enabled: false
gitea_fail2ban_jail_maxretry: 10
gitea_fail2ban_jail_findtime: 3600
gitea_fail2ban_jail_bantime: 900
gitea_fail2ban_jail_action: iptables-allports
gitea_oauth2_enabled: true
gitea_oauth2_jwt_secret: ChangeMe
gitea_metrics_enabled: false
gitea_metrics_token: ~
gitea_themes: gitea,arc-green
gitea_theme_default: gitea
gitea_repo_indexer_enabled: false
gitea_repo_indexer_include: ""
gitea_repo_indexer_exclude: ""
gitea_repo_exclude_vendored: true
gitea_repo_indexer_max_file_size: 1048576

View File

@ -0,0 +1,17 @@
---
- name: "Restart gitea"
service:
name: gitea
state: restarted
when: ansible_service_mgr == "systemd"
- name: "Reload systemd"
systemd:
daemon_reload: true
when: ansible_service_mgr == "systemd"
- name: "Restart fail2ban"
service:
name: fail2ban
state: restarted
when: ansible_service_mgr == "systemd"

View File

@ -0,0 +1,2 @@
install_date: Thu Oct 29 10:23:07 2020
version: master

27
roles/gitea/meta/main.yml Normal file
View File

@ -0,0 +1,27 @@
---
galaxy_info:
author: Thomas Maurice
description: Ansible Role - Gitea
min_ansible_version: 2.7.9
license: BSD-3-Clause
galaxy_tags:
- git
- gitea
- system
- development
- sourcecontrol
- selfhosted
- gitserver
- gogs
platforms:
- name: Debian
versions:
- jessie
- stretch
- name: EL
versions:
- 7
- name: Ubuntu
versions:
- xenial
- bionic

View File

@ -0,0 +1,9 @@
---
- name: Converge
hosts: all
become: true
roles:
- ansible-role-gitea
vars:
gitea_http_domain: localhost
gitea_root_url: http://localhost

View File

@ -0,0 +1,43 @@
---
dependency:
name: galaxy
driver:
name: docker
lint: |
set -e
yamllint .
ansible-lint
platforms:
- name: instance
image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu1804}-ansible:latest
pre_build_image: true
command: ${MOLECULE_DOCKER_COMMAND:-""}
volumes:
- /sys/fs/cgroup:/sys/fs/cgroup:ro
privileged: true
provisioner:
name: ansible
playbooks:
prepare: prepare.yml
converge: converge.yml
scenario:
test_sequence:
- lint
- destroy
- syntax
- create
- prepare
- converge
- verify
- destroy
verifier:
name: testinfra
lint:
name: flake8

View File

@ -0,0 +1,22 @@
---
- name: Perpare
hosts: all
become: true
tasks:
- name: install dependencies for gitea (RedHat based systems)
yum:
name: "{{ packages }}"
state: present
update_cache: true
when: ansible_os_family == "RedHat"
- name: install dependencies for gitea (Debian based systems)
apt:
name: "{{ packages }}"
state: present
update_cache: true
when: ansible_os_family == "Debian"
vars:
packages:
- git
- curl

View File

@ -0,0 +1,25 @@
import os
import testinfra.utils.ansible_runner
testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner(
os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all')
def test_gitea_binary(host):
gitea_bin = host.file('/usr/local/bin/gitea')
assert gitea_bin.exists
assert gitea_bin.user == 'root'
assert gitea_bin.group == 'root'
def test_gitea_config_file(host):
gitea_config = host.file('/etc/gitea/gitea.ini')
assert gitea_config.exists
assert gitea_config.mode == 0o600
def test_gitea_service_running(host):
gitea = host.service('gitea')
assert gitea.is_running
def test_gitea_reachable(host):
gitea_http = host.run('curl http://localhost:3000')
assert gitea_http.rc == 0

View File

@ -0,0 +1,69 @@
ansible==2.9.6
ansible-lint==4.2.0
anyconfig==0.9.7
arrow==0.15.5
asn1crypto==0.24.0
atomicwrites==1.3.0
attrs==19.1.0
autopep8==1.5.1
bcrypt==3.1.7
binaryornot==0.4.4
Cerberus==1.3.2
certifi==2020.4.5.1
cffi==1.14.0
chardet==3.0.4
click==7.1.1
click-completion==0.5.2
click-help-colors==0.8
colorama==0.4.3
cookiecutter==1.7.0
cryptography==2.9
docker==4.2.0
docker-pycreds==0.4.0
entrypoints==0.3
fasteners==0.15
flake8==3.7.7
future==0.18.2
git-url-parse==1.2.1
idna==2.9
importlib-metadata==1.6.0
Jinja2==2.11.2
jinja2-time==0.2.0
MarkupSafe==1.1.1
mccabe==0.6.1
molecule==3.0.3
monotonic==1.5
more-itertools==6.0.0
paramiko==2.7.1
pathspec==0.8.0
pbr==5.1.1
pexpect==4.8.0
pi==0.1.2
pluggy==0.13.1
poyo==0.5.0
psutil==5.6.6
ptyprocess==0.6.0
py==1.8.0
pyasn1==0.4.5
pycodestyle==2.5.0
pycparser==2.20
pyflakes==2.1.1
PyNaCl==1.3.0
pytest==4.3.1
python-dateutil==2.8.1
python-gilt==1.2.3
PyYAML==5.3.1
requests==2.23.0
ruamel.yaml==0.16.10
ruamel.yaml.clib==0.2.0
sh==1.12.14
shellingham==1.3.2
six==1.14.0
tabulate==0.8.7
testinfra==5.0.0
tree-format==0.1.2
urllib3==1.25.8
websocket-client==0.57.0
whichcraft==0.6.1
yamllint==1.22.1
zipp==3.1.0

View File

@ -0,0 +1,7 @@
---
- name: run checks to ensure set variables do not crash gitea
block:
- name: "check token length"
fail:
msg: 'gitea_oauth2_jwt_secret cannot be longer than 32 characters.'
when: gitea_oauth2_jwt_secret | length > 32

View File

@ -0,0 +1,7 @@
---
- name: "Create Gitea user"
user:
name: "{{ gitea_user }}"
comment: "Gitea user"
home: "{{ gitea_home }}"
shell: "{{ gitea_shell }}"

View File

@ -0,0 +1,18 @@
---
- name: Install fail2ban filter
template:
src: fail2ban/filter.conf.j2
dest: /etc/fail2ban/filter.d/gitea.conf
owner: root
group: root
mode: 0444
notify: Restart fail2ban
- name: Install fail2ban jail
template:
src: fail2ban/jail.conf.j2
dest: /etc/fail2ban/jail.d/gitea.conf
owner: root
group: root
mode: 0444
notify: Restart fail2ban

View File

@ -0,0 +1,16 @@
---
- name: "Setup systemd service"
template:
src: gitea.service.j2
dest: /lib/systemd/system/gitea.service
owner: root
group: root
mode: 0644
notify:
- "Reload systemd"
- "Restart gitea"
# systemd to be reloaded the first time because it is the only way Systemd is going to be aware of the new unit file.
- name: "Reload systemd"
systemd:
daemon_reload: true

View File

@ -0,0 +1,67 @@
---
- include: check-variables.yml
- name: "Check gitea version"
shell: "set -eo pipefail; /usr/local/bin/gitea -v | cut -d' ' -f 3"
args:
executable: /bin/bash
register: gitea_active_version
changed_when: false
failed_when: false
when: gitea_version_check|bool
- name: "Download the binary"
get_url:
url: "{{ gitea_dl_url }}"
dest: /usr/local/bin/gitea
owner: root
group: root
mode: 0755
force: true
notify: "Restart gitea"
when: (not gitea_version_check|bool) or (not ansible_check_mode and (gitea_active_version.stdout != gitea_version))
- include: create_user.yml
- name: "Create config and data directory"
file:
path: "{{ item }}"
state: directory
owner: "{{ gitea_user }}"
recurse: True
with_items:
- "/etc/gitea"
- "{{ gitea_home }}"
- "{{ gitea_home }}/data"
- "{{ gitea_home }}/custom"
- "{{ gitea_home }}/custom/https"
- "{{ gitea_home }}/custom/mailer"
- "{{ gitea_home }}/indexers"
- "{{ gitea_home }}/log"
- include: install_systemd.yml
when: ansible_service_mgr == "systemd"
- name: 'Install git'
package:
name: 'git'
state: 'present'
- name: "Configure gitea"
template:
src: gitea.ini.j2
dest: /etc/gitea/gitea.ini
owner: "{{ gitea_user }}"
mode: 0600
notify: "Restart gitea"
- name: "Service gitea"
service:
name: gitea
state: started
enabled: true
when: ansible_service_mgr == "systemd"
- include: fail2ban.yml
when: gitea_fail2ban_enabled|bool

View File

@ -0,0 +1,4 @@
# Managed by Ansible
[Definition]
failregex = .*Failed authentication attempt for .* from <HOST>
ignoreregex =

View File

@ -0,0 +1,9 @@
[gitea]
enabled = true
port = http,https
filter = gitea
logpath = {{ gitea_home }}/log/gitea.log
maxretry = {{ gitea_fail2ban_jail_maxretry }}
findtime = {{ gitea_fail2ban_jail_findtime }}
bantime = {{ gitea_fail2ban_jail_bantime }}
action = {{ gitea_fail2ban_jail_action }}

View File

@ -0,0 +1,195 @@
; this file is the configuration of your local gitea instance
; {{ ansible_managed }}
;
; This file overwrites the default values from gitea.
; undefined variables will use the default value from gitea.
; Cheat Sheet: https://docs.gitea.io/en-us/config-cheat-sheet/
;
; App name that shows on every page title
APP_NAME = {{ gitea_app_name }}
; Change it if you run locally
RUN_USER = {{ gitea_user }}
; Either "dev", "prod" or "test", default is "dev"
RUN_MODE = prod
[repository]
ROOT = {{ gitea_repository_root }}
; Force every new repository to be private
FORCE_PRIVATE = {{ gitea_force_private }}
; Global limit of repositories per user, applied at creation time. -1 means no limit
MAX_CREATION_LIMIT = {{ gitea_user_repo_limit }}
; Mirror sync queue length, increase if mirror syncing starts hanging
MIRROR_QUEUE_LENGTH = 1000
; Disable the ability to interact with repositories using the HTTP protocol
DISABLE_HTTP_GIT = {{ gitea_disable_http_git }}
[ui]
; Whether the email of the user should be shown in the Explore Users page
SHOW_USER_EMAIL = {{ gitea_show_user_email }}
THEMES = {{ gitea_themes }}
DEFAULT_THEME = {{ gitea_theme_default }}
[server]
; The protocol the server listens on. One of 'http', 'https', 'unix' or 'fcgi'.
PROTOCOL = {{ gitea_protocol }}
DOMAIN = {{ gitea_http_domain }}
ROOT_URL = {{ gitea_root_url }}
; The address to listen on. Either a IPv4/IPv6 address or the path to a unix socket.
HTTP_ADDR = {{ gitea_http_listen }}
HTTP_PORT = {{ gitea_http_port }}
; Disable SSH feature when not available
DISABLE_SSH = false
; Whether to use the builtin SSH server or not.
START_SSH_SERVER = {{ gitea_start_ssh }}
; Domain name to be exposed in clone URL
SSH_DOMAIN = {{ gitea_ssh_domain }}
; The network interface the builtin SSH server should listen on
SSH_LISTEN_HOST = {{ gitea_ssh_listen }}
; Port number to be exposed in clone URL
SSH_PORT = {{ gitea_ssh_port }}
; The port number the builtin SSH server should listen on
SSH_LISTEN_PORT = %(SSH_PORT)s
; Disable CDN even in "prod" mode
OFFLINE_MODE = {{ gitea_offline_mode }}
; Default path for App data
APP_DATA_PATH = {{ gitea_home }}/data
{%- if gitea_lfs_server_enabled | bool %}
;Enables git-lfs support.
LFS_START_SERVER = true
; Where to store LFS files.
LFS_CONTENT_PATH = {{ gitea_lfs_content_path }}
{%- endif %}
[database]
; Either "mysql", "postgres", "mssql" or "sqlite3", it's your choice
DB_TYPE = {{ gitea_db_type }}
HOST = {{ gitea_db_host }}
NAME = {{ gitea_db_name }}
USER = {{ gitea_db_user }}
; Use PASSWD = `your password` for quoting if you use special characters in the password.
PASSWD = {{ gitea_db_password }}
; For Postgres, either "disable" (default), "require", or "verify-full"
; For MySQL, either "false" (default), "true", or "skip-verify"
SSL_MODE = {{ gitea_db_ssl }}
; For "sqlite3" and "tidb", use an absolute path when you start gitea as service
PATH = {{ gitea_db_path }}
[indexer]
; Issue indexer storage path, available when ISSUE_INDEXER_TYPE is bleve
ISSUE_INDEXER_PATH = {{ gitea_home }}/indexers/issues.bleve
; Issue indexer queue, currently support: channel or levelqueue, default is levelqueue
ISSUE_INDEXER_QUEUE_TYPE = levelqueue
; When ISSUE_INDEXER_QUEUE_TYPE is levelqueue, this will be the queue will be saved path,
; default is indexers/issues.queue
ISSUE_INDEXER_QUEUE_DIR = {{ gitea_home }}/indexers/issues.queue
; repo indexer by default disabled, since it uses a lot of disk space
REPO_INDEXER_ENABLED = {{ gitea_repo_indexer_enabled }}
REPO_INDEXER_PATH = {{ gitea_home }}/indexers/repos.bleve
REPO_INDEXER_INCLUDE = {{ gitea_repo_indexer_include }}
REPO_INDEXER_EXCLUDE = {{ gitea_repo_indexer_exclude }}
REPO_INDEXER_EXCLUDE_VENDORED = {{ gitea_repo_exclude_vendored }}
MAX_FILE_SIZE = {{ gitea_repo_indexer_max_file_size }}
[security]
; Whether the installer is disabled
INSTALL_LOCK = true
; !!CHANGE THIS TO KEEP YOUR USER DATA SAFE!!
SECRET_KEY = {{ gitea_secret_key }}
INTERNAL_TOKEN = {{ gitea_internal_token }}
; How long to remember that an user is logged in before requiring relogin (in days)
LOGIN_REMEMBER_DAYS = 7
[service]
; Disallow registration, only allow admins to create accounts.
DISABLE_REGISTRATION = {{ gitea_disable_registration }}
; User must sign in to view anything.
REQUIRE_SIGNIN_VIEW = {{ gitea_require_signin }}
; Enable captcha validation for registration
ENABLE_CAPTCHA = {{ gitea_enable_captcha }}
; Type of captcha you want to use. Options: image, recaptcha
CAPTCHA_TYPE = image
; Enable recaptcha to use Google's recaptcha service
; Go to https://www.google.com/recaptcha/admin to sign up for a key
RECAPTCHA_SECRET =
RECAPTCHA_SITEKEY =
; Show Registration button
SHOW_REGISTRATION_BUTTON = {{ gitea_show_registration_button }}
ALLOW_ONLY_EXTERNAL_REGISTRATION = {{ gitea_only_allow_external_registration }}
ENABLE_NOTIFY_MAIL = {{ gitea_enable_notify_mail }}
[mailer]
ENABLED = {{ gitea_mailer_enabled }}
; Mail server
; Gmail: smtp.gmail.com:587
; QQ: smtp.qq.com:465
; Note, if the port ends with "465", SMTPS will be used. Using STARTTLS on port 587 is recommended per RFC 6409. If the server supports STARTTLS it will always be used.
HOST = {{ gitea_mailer_host }}
; Disable HELO operation when hostnames are different.
DISABLE_HELO =
; Custom hostname for HELO operation, if no value is provided, one is retrieved from system.
HELO_HOSTNAME =
; Do not verify the certificate of the server. Only use this for self-signed certificates
SKIP_VERIFY = {{ gitea_mailer_skip_verify }}
; Use client certificate
USE_CERTIFICATE = false
CERT_FILE = {{ gitea_home }}/custom/mailer/cert.pem
KEY_FILE = {{ gitea_home }}/custom/mailer/key.pem
; Should SMTP connection use TLS
IS_TLS_ENABLED = {{ gitea_mailer_tls_enabled }}
; Mail from address, RFC 5322. This can be just an email address, or the `"Name" <email@example.com>` format
FROM = {{ gitea_mailer_from }}
; Mailer user name and password
USER = {{ gitea_mailer_user }}
; Use PASSWD = `your password` for quoting if you use special characters in the password.
PASSWD = `{{ gitea_mailer_password }}`
; Send mails as plain text
SEND_AS_PLAIN_TEXT = false
; Set Mailer Type (either SMTP, sendmail or dummy to just send to the log)
MAILER_TYPE = {{ gitea_mailer_type }}
; Specify an alternative sendmail binary
SENDMAIL_PATH = sendmail
; Specify any extra sendmail arguments
SENDMAIL_ARGS =
[session]
; Either "memory", "file", or "redis", default is "memory"
PROVIDER = file
; Provider config options
; memory: doesn't have any config yet
; file: session file path, e.g. `data/sessions`
; redis: network=tcp,addr=:6379,password=macaron,db=0,pool_size=100,idle_timeout=180
; mysql: go-sql-driver/mysql dsn config string, e.g. `root:password@/session_table`
PROVIDER_CONFIG = {{ gitea_home }}/data/sessions
[picture]
AVATAR_UPLOAD_PATH = {{ gitea_home }}/data/avatars
; This value will always be true in offline mode.
DISABLE_GRAVATAR = {{ gitea_disable_gravatar }}
[attachment]
; Whether attachments are enabled. Defaults to `true`
ENABLED = true
; Path for attachments. Defaults to `data/attachments`
PATH = {{ gitea_home }}/data/attachments
[log]
ROOT_PATH = {{ gitea_home }}/log
; Either "console", "file", "conn", "smtp" or "database", default is "console"
; Use comma to separate multiple modes, e.g. "console, file"
MODE = file
; Buffer length of the channel, keep it as it is if you don't know what it is.
BUFFER_LEN = 10000
; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "Trace"
LEVEL = Info
REDIRECT_MACARON_LOG = false
[oauth2]
ENABLE = {{ gitea_oauth2_enabled }}
JWT_SECRET = {{ gitea_oauth2_jwt_secret }}
[metrics]
ENABLED = {{ gitea_metrics_enabled }}
TOKEN = {{ gitea_metrics_token }}

View File

@ -0,0 +1,15 @@
[Unit]
Description=Gitea git server
After=network.target
[Service]
User={{ gitea_user }}
ExecStart=/usr/local/bin/gitea web -c /etc/gitea/gitea.ini
Restart=on-failure
WorkingDirectory={{ gitea_home }}
{% if gitea_systemd_cap_net_bind_service %}
AmbientCapabilities=CAP_NET_BIND_SERVICE
{% endif %}
[Install]
WantedBy=multi-user.target

View File

@ -0,0 +1,2 @@
---
gitea_arch: "{{ 'amd64' if ansible_architecture == 'x86_64' else ansible_architecture }}"

View File

@ -17,3 +17,9 @@
# Docs: https://github.com/geerlingguy/ansible-role-php # Docs: https://github.com/geerlingguy/ansible-role-php
- src: geerlingguy.php - src: geerlingguy.php
version: 4.5.1 version: 4.5.1
# Web applications
# Docs: https://github.com/thomas-maurice/ansible-role-gitea
- src: thomas_maurice.ansible_role_gitea
version: master
name: gitea

View File

@ -13,18 +13,58 @@
roles: roles:
- role: geerlingguy.postgresql - role: geerlingguy.postgresql
vars: vars:
postgresql_global_config_options:
- option: listen_addresses
value: "*"
postgresql_hba_entries: postgresql_hba_entries:
- { type: local, database: all, user: postgres, auth_method: peer }
- { type: local, database: all, user: all, auth_method: peer }
- { type: host, database: all, user: all, address: '127.0.0.1/32', auth_method: md5 }
- { type: host, database: all, user: all, address: '::1/128', auth_method: md5 }
# Just allow all access on this block. # Just allow all access on this block.
# When rolling out to our new env, I'll allow by particular IP alone # When rolling out to our new env, I'll allow by particular IP alone
- { type: host, database: all, user: all, address: '192.168.0.0/16', auth_method: md5 } - { type: host, database: all, user: all, address: '192.168.0.0/16', auth_method: md5 }
postgresql_users:
- name: gitea
password: "{{ secret_gitea_db_pass }}"
postgresql_databases:
- name: gitea
owner: gitea
become: yes become: yes
tags: [ db, psql ] tags: [ db, psql ]
# Webservers # Webservers
- hosts: web1.test.desu.ltd - hosts: web1.test.desu.ltd
roles: roles:
- role: geerlingguy.apache - role: geerlingguy.apache
vars:
apache_mods_enabled:
- proxy.load
- proxy_http.load
apache_vhosts:
- servername: git.test.desu.ltd
extra_parameters: |
ProxyPreserveHost On
ProxyRequests Off
ProxyPass / http://127.0.0.1:3000/ nocanon retry=1
become: yes become: yes
tags: [ web, apache ] tags: [ web, apache ]
- role: geerlingguy.php - role: geerlingguy.php
become: yes become: yes
tags: [ web, php ] tags: [ web, php ]
- role: gitea
vars:
gitea_db_type: postgres
gitea_db_host: 192.168.122.169:5432
gitea_db_name: gitea
gitea_db_user: gitea
gitea_db_password: "{{ secret_gitea_db_pass }}"
gitea_http_domain: git.test.desu.ltd
gitea_oauth2_enabled: no
gitea_root_url: http://git.test.desu.ltd
gitea_shell: "/bin/bash"
gitea_ssh_domain: git.test.desu.ltd
gitea_ssh_port: 22
gitea_start_ssh: no
gitea_user: git
become: yes
tags: [ web, gitea ]