diff --git a/group_vars/gitea.yml b/group_vars/gitea.yml index e6cf5ebb..ada7f073 100644 --- a/group_vars/gitea.yml +++ b/group_vars/gitea.yml @@ -38,7 +38,7 @@ protocol: tcp comment: 'munin' from_ip: 192.168.2.144/24 - ### tmaurice.gitea + ### l3d.gitea # config liegt in /etc/gitea/gitea.ini gitea_version: "1.19.1" gitea_app_name: "Gitea" @@ -60,7 +60,6 @@ gitea_force_private: false gitea_oauth2_enabled: true gitea_repo_indexer_enabled: true - gitea_backup_on_upgrade: true gitea_mailer_enabled: true gitea_mailer_skip_verify: false @@ -71,6 +70,8 @@ gitea_mailer_password: "{{ lookup('keepass', 'postfix_absender_passwort', 'password') }}" gitea_mailer_type: smtp + gitea_default_branch: 'master' + gitea_db_type: sqlite3 gitea_db_path: "{{ gitea_home }}/data/gitea.db" # for sqlite3 @@ -95,10 +96,11 @@ gitea_fail2ban_jail_bantime: 600 # wird für drone benötigt, sonst wird der Webhook nicht "gesendet" gitea_extra_config: | - [webhook] - ALLOWED_HOST_LIST = *.grote.lan - [repository] - DEFAULT_BRANCH = master + [webhook] + ALLOWED_HOST_LIST = *.grote.lan + + gitea_backup_on_upgrade: false + gitea_backup_location: "{{ gitea_home }}/backups/" ### mgrote.munin-node munin_node_plugins: diff --git a/playbooks/3_service/gitea.yml b/playbooks/3_service/gitea.yml index a4a79e91..e198ebaf 100644 --- a/playbooks/3_service/gitea.yml +++ b/playbooks/3_service/gitea.yml @@ -2,4 +2,4 @@ - hosts: gitea roles: - { role: mgrote.postfix, tags: "postfix" } - - { role: tmaurice.gitea, tags: "gitea", become: true } + - { role: l3d.gitea, tags: "gitea", become: true } diff --git a/roles/l3d.gitea/.github/FUNDING.yml b/roles/l3d.gitea/.github/FUNDING.yml new file mode 100644 index 00000000..fab51748 --- /dev/null +++ b/roles/l3d.gitea/.github/FUNDING.yml @@ -0,0 +1,5 @@ +--- +# These are supported funding model platforms + +github: [do1jlr] +liberapay: L3D diff --git a/roles/l3d.gitea/.github/galaxy.svg b/roles/l3d.gitea/.github/galaxy.svg new file mode 100644 index 00000000..5e5c1f30 --- /dev/null +++ b/roles/l3d.gitea/.github/galaxy.svg @@ -0,0 +1,85 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/roles/l3d.gitea/.github/license.svg b/roles/l3d.gitea/.github/license.svg new file mode 100644 index 00000000..c711475f --- /dev/null +++ b/roles/l3d.gitea/.github/license.svg @@ -0,0 +1,60 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/roles/l3d.gitea/.github/workflows/ansible-linting-check.yml b/roles/l3d.gitea/.github/workflows/ansible-linting-check.yml new file mode 100644 index 00000000..150e9086 --- /dev/null +++ b/roles/l3d.gitea/.github/workflows/ansible-linting-check.yml @@ -0,0 +1,23 @@ +--- +name: Ansible Lint check + +# yamllint disable-line rule:truthy +on: + push: + branches: '*' + pull_request: + branches: '*' + +jobs: + build: + + runs-on: ubuntu-latest + + steps: + - name: 'checkout git repo' + uses: actions/checkout@v3 + + - name: 'Lint Ansible Playbook' + uses: ansible/ansible-lint-action@v6 + with: + targets: "." diff --git a/roles/l3d.gitea/.github/workflows/galaxy.yml b/roles/l3d.gitea/.github/workflows/galaxy.yml new file mode 100644 index 00000000..adcecbd8 --- /dev/null +++ b/roles/l3d.gitea/.github/workflows/galaxy.yml @@ -0,0 +1,22 @@ +--- +name: Galaxy release + +# yamllint disable-line rule:truthy +on: + push: + branches: ['main'] + release: + types: ['created'] + +jobs: + build: + runs-on: ubuntu-latest + steps: + - name: 'checkout git repo' + uses: actions/checkout@v3 + + - name: 'release on galaxy' + uses: robertdebock/galaxy-action@1.2.0 + with: + galaxy_api_key: ${{ secrets.galaxy_api_key }} + git_branch: 'main' diff --git a/roles/l3d.gitea/.github/workflows/yamllint.yaml b/roles/l3d.gitea/.github/workflows/yamllint.yaml new file mode 100644 index 00000000..d744e9cd --- /dev/null +++ b/roles/l3d.gitea/.github/workflows/yamllint.yaml @@ -0,0 +1,23 @@ +--- +name: 'Yamllint GitHub Actions' + +# yamllint disable-line rule:truthy +on: + push: + branches: '*' + pull_request: + branches: '*' + +jobs: + yamllint: + name: 'Yamllint' + runs-on: ubuntu-latest + steps: + - name: 'checkout git repo' + uses: actions/checkout@v3 + + - name: 'Yamllint' + uses: karancode/yamllint-github-action@v2.0.0 + with: + yamllint_file_or_dir: '.' + yamllint_config_filepath: './.yamllint' diff --git a/roles/tmaurice.gitea/.gitignore b/roles/l3d.gitea/.gitignore similarity index 89% rename from roles/tmaurice.gitea/.gitignore rename to roles/l3d.gitea/.gitignore index 64b554e2..e4c36719 100644 --- a/roles/tmaurice.gitea/.gitignore +++ b/roles/l3d.gitea/.gitignore @@ -1,5 +1,7 @@ *.pyc +.cache + # Environments .env .venv diff --git a/roles/l3d.gitea/.yamllint b/roles/l3d.gitea/.yamllint new file mode 100644 index 00000000..e9713aeb --- /dev/null +++ b/roles/l3d.gitea/.yamllint @@ -0,0 +1,8 @@ +--- +extends: default + +rules: + # 170 chars should be enough, but don't fail if a line is longer + line-length: + max: 170 + level: warning diff --git a/roles/l3d.gitea/LICENSE b/roles/l3d.gitea/LICENSE new file mode 100644 index 00000000..1206eb80 --- /dev/null +++ b/roles/l3d.gitea/LICENSE @@ -0,0 +1,31 @@ +BSD 3-Clause License + +Copyright (c) 2019 - today L3D +Copyright (c) 2019 - 2021 Thomas Maurice + +All rights reserved. + +Redistribution and use in source and binary forms, with or without +modification, are permitted provided that the following conditions are met: + +1. Redistributions of source code must retain the above copyright notice, this + list of conditions and the following disclaimer. + +2. Redistributions in binary form must reproduce the above copyright notice, + this list of conditions and the following disclaimer in the documentation + and/or other materials provided with the distribution. + +3. Neither the name of the copyright holder nor the names of its + contributors may be used to endorse or promote products derived from + this software without specific prior written permission. + +THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" +AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE +IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE +DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE +FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL +DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR +SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER +CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, +OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. diff --git a/roles/l3d.gitea/README.md b/roles/l3d.gitea/README.md new file mode 100644 index 00000000..20488061 --- /dev/null +++ b/roles/l3d.gitea/README.md @@ -0,0 +1,387 @@ +[![Ansible Galaxy](https://ansible.l3d.space/svg/l3d.gitea.svg)](https://galaxy.ansible.com/l3d/gitea) +[![BSD-3 Clause](https://ansible.l3d.space/svg/l3d.gitea_license.svg)](LICENSE) +[![Maintainance](https://ansible.l3d.space/svg/l3d.gitea_maintainance.svg)](https://ansible.l3d.space/#l3d.gitea) + + ansible role gitea/forgejo +============================ + +This role installs and manages [gitea](https://gitea.io) or [forgejo](https://forgejo.org). A painless self-hosted Git service. Gitea is a community managed lightweight code hosting solution written in Go. Forgejo is a fork of it. +[Source code & screenshots gitea](https://github.com/go-gitea/gitea). +[Source code forgejo](https://codeberg.org/forgejo/forgejo). +This role is also Part of the Ansible-Collection [l3d.git](https://galaxy.ansible.com/l3d/git). [![l3d.git](https://ansible.l3d.space/svg/l3d.git_ansible-collection_collection.svg)](https://github.com/roles-ansible/ansible_collection_git.git). + +## Sample Usage in a playbook + +The following code has been tested with the latest Debian Stable, it should work on Ubuntu and RedHat as well. + +```yaml +# ansible-galaxy install l3d.gitea + +- name: "Install gitea" + hosts: git.example.com + roles: + - {role: l3d.gitea, tags: gitea} + vars: + # Here we assume we are behind a reverse proxy that will + # handle https for us, so we bind on localhost:3000 using HTTP + # see https://docs.gitea.io/en-us/reverse-proxies/#nginx + gitea_fqdn: 'git.example.com' + gitea_root_url: 'https://git.example.com' + gitea_protocol: http + gitea_start_ssh: true +``` + + Variables +----------- +Here is a deeper insight into the variables of this gitea role. For the exact function of some variables and the possibility to add more options we recommend a look at this [config cheat sheet](https://docs.gitea.io/en-us/config-cheat-sheet/). + +### Chose between gitea and forgejo +There is a fork of gitea called forgejo. Why? Read the [forgejo FAQ](https://forgejo.org/faq/). +You have the option to choose between [gitea](https://gitea.io) and [forgejo](https://forgejo.org) by modifying the ``gitea_fork`` variable. +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_fork` | `gitea` | optional choose to install forgejo instead of gitea by setting this value to `forgejo`. | + +### gitea update mechanism +To determine which gitea version to install, you can choose between two variants. +Either you define exactly which release you install. Or you use the option ``latest`` to always install the latest release from the [gitea releases](https://github.com/go-gitea/gitea/releases/latest). + +### gitea update +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_version` | `latest` | Define either the exact release to install *(eg. `1.16.0`)* or use ``latest`` *(default)* to install the latest release. | +| `gitea_version_check` | `true` | Check if installed version != `gitea_version` before initiating binary download | +| `gitea_gpg_key` | `7C9E68152594688862D62AF62D9AE806EC1592E2` | the gpg key the gitea binary is signed with | +| `gitea_forgejo_gpg_key` | `EB114F5E6C0DC2BCDD183550A4B61A2DC5923710` | the gpg key the forgejo binary is signed with | +| `gitea_gpg_server` | `hkps://keys.openpgp.org` | A gpg key server where this role can download the gpg key | +| `gitea_backup_on_upgrade` | `false` | Optionally a backup can be created with every update of gitea. | +| `gitea_backup_location` | `{{ gitea_home }}/backups/` | Where to store the gitea backup if one is created with this role. | +| `submodules_versioncheck` | `false` | a simple version check that can prevent you from accidentally running an older version of this role. *(recomended)* | + +### gitea in the linux world +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_group` | `gitea` | Primary UNIX group used by Gitea | +| `gitea_groups` | null | Optionally a list of secondary UNIX groups used by Gitea | +| `gitea_home` | `/var/lib/gitea` | Base directory to work | +| `gitea_user_home` | `{{ gitea_home }}` | home of gitea user | +| `gitea_executable_path` | `/usr/local/bin/gitea` | Path for gitea executable | +| `gitea_forgejo_executable_path` | `/usr/local/bin/forgejo` | Path for forgejo executable | +| `gitea_configuraion_path` | `/etc/gitea` | Where to put the gitea.ini config | +| `gitea_shell` | `/bin/false` | UNIX shell used by gitea. Set it to `/bin/bash` if you don't use the gitea built-in ssh server. | +| `gitea_systemd_cap_net_bind_service` | `false` | Adds `AmbientCapabilities=CAP_NET_BIND_SERVICE` to systemd service file | + +### Overall ([DEFAULT](https://docs.gitea.io/en-us/config-cheat-sheet/#overall-default)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_app_name` | `Gitea` | Displayed application name | +| `gitea_user` | `gitea ` | UNIX user used by Gitea | +| `gitea_run_mode`| `prod`| Application run mode, affects performance and debugging. Either “dev”, “prod” or “test”. | +| `gitea_fqdn` | `localhost` | Base FQDN for the installation, used as default for other variables. Set it to the FQDN where you can reach your gitea server | + +### Repository ([repository](https://docs.gitea.io/en-us/config-cheat-sheet/#repository-repository)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_default_branch` | `main` | Default branch name of all repositories. | +| `gitea_default_private` | `last` | Default private when creating a new repository. [`last`, `private`, `public`] | +| `gitea_default_repo_units` | *(see defaults)* | Comma separated list of default repo units. See official docs for more | +| `gitea_disabled_repo_units` | | Comma separated list of globally disabled repo units. | +| `gitea_disable_http_git` | `false` | Disable the ability to interact with repositories over the HTTP protocol. (true/false) | +| `gitea_disable_stars` | `false` | Disable stars feature. | +| `gitea_enable_push_create_org` | `false` | Allow users to push local repositories to Gitea and have them automatically created for an org. | +| `gitea_enable_push_create_user` | `false` | Allow users to push local repositories to Gitea and have them automatically created for an user. | +| `gitea_force_private` | `false` | Force every new repository to be private. | +| `gitea_user_repo_limit` | `-1` | Limit how many repos a user can have *(`-1` for unlimited)* | +| `gitea_repository_root` | `{{ gitea_home }}/repos` | Root path for storing all repository data. It must be an absolute path. | +| `gitea_repository_extra_config` | | you can use this variable to pass additional config parameters in the `[repository]` section of the config. | +| `gitea_repository_upload_extra_config` | | you can use this variable to pass additional config parameters in the `[repository.upload]` section of the config. | + +### Repository - Signing ([repository.signing](https://docs.gitea.io/en-us/config-cheat-sheet/#repository---signing-repositorysigning)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_enable_repo_signing_options` | `false` | Allow to configure repo signing options | +| `gitea_repo_signing_key` | `default` | Key to sign with. | +| `gitea_repo_signing_name` | | if a KEYID is provided as the `gitea_repo_signing_key`, use these as the Name and Email address of the signer. | +| `gitea_repo_signing_email` | | if a KEYID is provided as the `gitea_repo_signing_key`, use these as the Name and Email address of the signer. | +| `gitea_repo_initial_commit` | `always` | Sign initial commit. | +| `gitea_repo_default_trust_model` | `collaborator` | The default trust model used for verifying commits. | +| `gitea_repo_wiki` | `never` | Sign commits to wiki. | +| `gitea_repo_crud_actions` | *(see defaults)* | Sign CRUD actions. | +| `gitea_repo_merges` | *(see defaults)* | Sign merges. | +| `gitea_enable_repo_signing_extra` | | you can use this variable to pass additional config parameters in the `[repository.signing]` section of the config. | + +### CORS ([cors](https://docs.gitea.io/en-us/config-cheat-sheet/#cors-cors)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_enable_cors` | `false` | enable cors headers (disabled by default) | +| `gitea_cors_scheme` | `http` | scheme of allowed requests | +| `gitea_cors_allow_domain` | `*` | list of requesting domains that are allowed | +| `gitea_cors_allow_subdomain` | `false` |allow subdomains of headers listed above to request | +| `gitea_cors_methods` | *(see defaults)* | list of methods allowed to request | +| `gitea_cors_max_age` | `10m` | max time to cache response | +| `gitea_cors_allow_credentials` | `false` | allow request with credentials | +| `gitea_cors_headers` | `Content-Type,User-Agent` | additional headers that are permitted in requests | +| `gitea_cors_x_frame_options` | `SAMEORIGIN` | Set the `X-Frame-Options` header value. | +| `gitea_cors_extra` | | you can use this variable to pass additional config parameters in the `[cors]` section of the config. | + +### UI ([ui](https://docs.gitea.io/en-us/config-cheat-sheet/#ui-ui)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_show_user_email` | `false` | Do you want to display email addresses ? (true/false) | +| `gitea_theme_default` | `auto` | Default theme | +| `gitea_themes` | `auto,gitea,arc-green` | List of enabled themes | +| `gitea_ui_extra_config` | | you can use this variable to pass additional config parameters in the `[ui]` section of the config. | + +### UI - Meta ([ui.meta](https://docs.gitea.io/en-us/config-cheat-sheet/#ui---metadata-uimeta)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_ui_author` | *(see defaults)* | Author meta tag of the homepage. | +| `gitea_ui_description` | *(see defaults)* | Description meta tag of the homepage. | +| `gitea_ui_keywords` | *(see defaults)* | Keywords meta tag of the homepage | +| `gitea_ui_meta_extra_config` | | you can use this variable to pass additional config parameters in the `[ui.meta]` section of the config. | + +### Server ([server](https://docs.gitea.io/en-us/config-cheat-sheet/#server-server)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_protocol`| `http` | Listening protocol [http, https, fcgi, unix, fcgi+unix] | +| `gitea_http_domain` | `{{ gitea_fqdn }}` which is `localhost` | Domain name of this server. | +| `gitea_root_url` | `http://{{ gitea_fqdn }}:3000` | Root URL used to access your web app (full URL) | +| `gitea_http_listen` | `127.0.0.1` | HTTP listen address | +| `gitea_http_port` | `3000` | Bind port *(redirect from `80` will be activated if value is `443`)* | +| `gitea_start_ssh` | `true` | When enabled, use the built-in SSH server. | +| `gitea_ssh_domain` | `{{ gitea_fqdn }} ` | Domain name of this server, used for displayed clone URL | +| `gitea_ssh_port` | `2222` | SSH port displayed in clone URL. | +| `gitea_ssh_listen` | `0.0.0.0` | Listen address for the built-in SSH server. | +| `gitea_offline_mode` | `true` | Disables use of CDN for static files and Gravatar for profile pictures. (true/false) | +| `gitea_landing_page` | `home` | Landing page for unauthenticated users | +| `gitea_lfs_server_enabled` | `false` | Enable GIT-LFS Support *(git large file storage: [git-lfs](https://git-lfs.github.com/))*. | +| `gitea_lfs_jwt_secret` | | LFS authentication secret. Can be generated with ``gitea generate secret JWT_SECRET``. Will be autogenerated if not defined | +| `gitea_redirect_other_port` | `false` | If true and `gitea_protocol` is https, allows redirecting http requests on `gitea_port_to_redirect` to the https port Gitea listens on. | +| `gitea_port_to_redirect` | `80` | Port for the http redirection service to listen on, if enabled | +| `gitea_enable_tls_certs` | `false` | Write TLS Cert and Key Path to config file | +| `gitea_tls_cert_file` | `https/cert.pem` | Cert file path used for HTTPS. | +| `gitea_tls_key_file` | `https/key.pem` | Key file path used for HTTPS. | +| `gitea_enable_acme` | `false` | Flag to enable automatic certificate management via an ACME capable CA Server. *(default is letsencrypt)* | +| `gitea_acme_url` | | The CA’s ACME directory URL | +| `gitea_acme_accepttos` | `false` | This is an explicit check that you accept the terms of service of the ACME provider. | +| `gitea_acme_directory` | `https` | Directory that the certificate manager will use to cache information such as certs and private keys. | +| `gitea_acme_email` | | Email used for the ACME registration | +| `gitea_acme_ca_root` | | The CA’s root certificate. If left empty, it defaults to using the system’s trust chain. | +| `gitea_server_extra_config` | | you can use this variable to pass additional config parameters in the `[server]` section of the config. | + +### Database ([database](https://docs.gitea.io/en-us/config-cheat-sheet/#database-database)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_db_type` | `sqlite3` | The database type in use `[mysql, postgres, mssql, sqlite3]`. | +| `gitea_db_host` | `127.0.0.0:3306` | Database host address and port or absolute path for unix socket [mysql, postgres] (ex: `/var/run/mysqld/mysqld.sock`). | +| `gitea_db_name` | `root` | Database name | +| `gitea_db_user` | `gitea` | Database username | +| `gitea_db_password` | `lel` | Database password. **PLEASE CHANGE** | +| `gitea_db_ssl` | `disable` | Configure SSL only if your database type supports it. Have a look into the [config-cheat-sheet](https://docs.gitea.io/en-us/config-cheat-sheet/#database-database) for more detailed information | +| `gitea_db_path` | `{{ gitea_home }}/data/gitea.db` | DB path, if you use `sqlite3`. | +| `gitea_db_log_sql` | `false` | Log the executed SQL. | +| `gitea_database_extra_config` | | you can use this variable to pass additional config parameters in the `[database]` section of the config. | + +### Indexer ([indexer](https://docs.gitea.io/en-us/config-cheat-sheet/#indexer-indexer)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_repo_indexer_enabled` | `false` | Enables code search *(uses a lot of disk space, about 6 times more than the repository size).* | +| `gitea_repo_indexer_include` | |Glob patterns to include in the index *(comma-separated list)*. An empty list means include all files. | +| `gitea_repo_indexer_exclude` | | Glob patterns to exclude from the index (comma-separated list). | +| `gitea_repo_exclude_vendored` | `true` | Exclude vendored files from index. | +| `gitea_repo_indexer_max_file_size` | `1048576` | Maximum size in bytes of files to be indexed. | +| `gitea_indexer_extra_config` | | you can use this variable to pass additional config parameters in the `[indexer]` section of the config. | +| `gitea_queue_issue_indexer_extra_config` | | | you can use this variable to pass additional config parameters in the `[queue.issue_indexer]` section of the config. | + +### Security ([security](https://docs.gitea.io/en-us/config-cheat-sheet/#security-security)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_secret_key` | | Global secret key. Will be autogenerated if not defined. Should be unique. | +| `gitea_disable_git_hooks` | `true` | Set to false to enable users with git hook privilege to create custom git hooks. Can be dangerous. | +| `gitea_disable_webhooks` | `false` | Set to true to disable webhooks feature. | +| `gitea_internal_token` | | Internal API token. Will be autogenerated if not defined. Should be unique. | +| `gitea_password_check_pwn` | `false` | Check [HaveIBeenPwned](https://haveibeenpwned.com/Passwords) to see if a password has been exposed. | +| `gitea_security_extra_config` | | you can use this variable to pass additional config parameters in the `[security]` section of the config. | + +### Service ([service](https://docs.gitea.io/en-us/config-cheat-sheet/#service-service)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_disable_registration` | `false` | Do you want to disable user registration? (true/false) | +| `gitea_register_email_confirm` | `false` | Enable this to ask for mail confirmation of registration. Requires `gitea_mailer_enabled` to be enabled. | +| `gitea_require_signin` | `true` | Do you require a signin to see repo's (even public ones)? (true/false)| +| `gitea_default_keep_mail_private` | `true` | By default set users to keep their email address privat | +| `gitea_enable_captcha` | `true` | Do you want to enable captcha's ? (true/false)| +| `gitea_show_registration_button` | `true` | Here you can hide the registration button. This will not disable registration! (true/false)| +| `gitea_only_allow_external_registration` | `false` | Set to true to force registration only using third-party services (true/false) | +| `gitea_enable_notify_mail` | `false` | Enable this to send e-mail to watchers of a repository when something happens, like creating issues (true/false) | +| `gitea_auto_watch_new_repos` | `true` | Enable this to let all organisation users watch new repos when they are created (true/false) | +| `gitea_service_extra_config` | | you can use this variable to pass additional config parameters in the `[service]` section of the config. | + +### Mailer ([mailer](https://docs.gitea.io/en-us/config-cheat-sheet/#mailer-mailer)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_mailer_enabled` | `false` | Whether to enable the mailer. | +| `gitea_mailer_protocol` | `dummy` |Mail server protocol. One of “smtp”, “smtps”, “smtp+starttls”, “smtp+unix”, “sendmail”, “dummy”.| +| `gitea_mailer_smtp_addr` | | Mail server address. e.g. smtp.gmail.com. For smtp+unix, this should be a path to a unix socket instead. | +| `gitea_mailer_smtp_port` | | Mail server port | +| `gitea_mailer_use_client_cert` | `false` | Use client certificate for TLS/SSL. | +| `gitea_mailer_client_cert_file` | | Client certificate file. | +| `gitea_mailer_client_key_file` | | Client key file. | +| `gitea_mailer_force_trust_server_cert` | `false` | completely ignores server certificate validation errors. This option is unsafe. Consider adding the certificate to the system trust store instead. | +| `gitea_mailer_user` | | Username of mailing user (usually the sender’s e-mail address). | +| `gitea_mailer_password ` | |Password of mailing user. Use `your password` for quoting if you use special characters in the password. | +| `gitea_mailer_enable_helo` | `true` |Enable HELO operation. | +| `gitea_mailer_from` | `noreply@{{ gitea_http_domain }}` | Mail from address, RFC 5322. | +| `gitea_subject_prefix` | |Prefix to be placed before e-mail subject lines. | +| `gitea_mailer_send_as_plaintext` | `false` | Send mails only in plain text, without HTML alternative. | +| `gitea_mailer_extra_config` | | you can use this variable to pass additional config parameters in the `[mailer]` section of the config. | + +### Session ([session](https://docs.gitea.io/en-us/config-cheat-sheet/#session-session)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_session_provider` | `file` | Session engine provider | +| `gitea_session_extra_config` | | you can use this variable to pass additional config parameters in the `[session]` section of the config. | + +### Picture ([picture](https://docs.gitea.io/en-us/config-cheat-sheet/#picture-picture)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_picture_extra_config` | | you can use this variable to pass additional config parameters in the `[picture]` section of the config. | + +### Issue and pull request attachments ([attachment](https://docs.gitea.io/en-us/config-cheat-sheet/#issue-and-pull-request-attachments-attachment)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `attachment_enabled` | `true` | Whether issue and pull request attachments are enabled. | +| `gitea_attachment_extra_config` | | you can use this variable to pass additional config parameters in the `[attachment]` section of the config. | + +### Log ([log](https://docs.gitea.io/en-us/config-cheat-sheet/#log-log)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_log_systemd` | `false` | Disable logging into `file`, use systemd-journald | +| `gitea_log_level` | `Warn` | General log level. `[Trace, Debug, Info, Warn, Error, Critical, Fatal, None]` | +| `gitea_log_extra_config` | | you can use this variable to pass additional config parameters in the `[log]` section of the config. | + +### Metrics ([metrics](https://docs.gitea.io/en-us/config-cheat-sheet/#metrics-metrics)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_metrics_enabled`| `false` | Enable the metrics endpoint | +| `gitea_metrics_token`| | Bearer token for the Prometheus scrape job | +| `gitea_metrics_extra` | | you can use this variable to pass additional config parameters in the `[metrics]` section of the config. | + +### OAuth2 ([oauth2](https://docs.gitea.io/en-us/config-cheat-sheet/#oauth2-oauth2)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_oauth2_enabled` | `true` | Enable the Oauth2 provider (true/false) | +| `gitea_oauth2_jwt_secret` | | Oauth2 JWT secret. Can be generated with ``gitea generate secret JWT_SECRET``. Will be autogenerated if not defined. | +| `gitea_oauth2_extra_config` | | you can use this variable to pass additional config parameters in the `[oauth2]` section of the config. | + +### Federation ([federation](https://docs.gitea.io/en-us/config-cheat-sheet/#federation-federation)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_federation_enabled` | `false` | Enable/Disable federation capabilities | +| `gitea_federation_share_user_stats` | `false` | Enable/Disable user statistics for nodeinfo if federation is enabled | +| `gitea_federation_extra` | | you can use this variable to pass additional config parameters in the `[federation]` section of the config. | + +### Packages ([packages](https://docs.gitea.io/en-us/config-cheat-sheet/#packages-packages)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_packages_enabled` | `true` | Enable/Disable package registry capabilities | +| `gitea_packages_extra` | |you can use this variable to pass additional config parameters in the `[packages]` section of the config. | + +### LFS ([lfs](https://docs.gitea.io/en-us/config-cheat-sheet/#lfs-lfs)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_lfs_storage_type` | `local` | Storage type for lfs | +| `gitea_lfs_serve_direct` | `false` | Allows the storage driver to redirect to authenticated URLs to serve files directly. *(only Minio/S3)* | +| `gitea_lfs_content_path` | `{{ gitea_home }}/data/lfs` | Where to store LFS files | +| `gitea_lfs_extra` ||you can use this variable to pass additional config parameters in the `[lfs]` section of the config. | + +### Other ([other](https://docs.gitea.io/en-us/config-cheat-sheet/#other-other)) +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_other_show_footer_branding` | `false` | Show Gitea branding in the footer. | +| `gitea_other_show_footer_version` | `true` | Show Gitea and Go version information in the footer. | +| `gitea_other_show_footer_template_load_time` | `true` | Show time of template execution in the footer. | +| `gitea_other_enable_sitemap` | `true` | Generate sitemap. | +| `gitea_other_enable_feed` | `true` | Enable/Disable RSS/Atom feed. | + +### additional gitea config +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_extra_config` | | Additional gitea configuration. Have a look at the [config-cheat-sheet](https://docs.gitea.io/en-us/config-cheat-sheet/) before using it! | + +### Fail2Ban configuration + +If enabled, this will deploy a fail2ban filter and jail config for Gitea as described in the [Gitea Documentation](https://docs.gitea.io/en-us/fail2ban-setup/). + +As this will only deploy config files, fail2ban already has to be installed or otherwise the role will fail. + +| variable name | default value | description | +| ------------- | ------------- | ----------- | +| `gitea_fail2ban_enabled` | `false` | Whether to deploy the fail2ban config or not | +| `gitea_fail2ban_jail_maxretry` | `10` | fail2ban jail `maxretry` setting. | +| `gitea_fail2ban_jail_findtime` | `3600` | fail2ban jail `findtime` setting. | +| `gitea_fail2ban_jail_bantime` | `900` | fail2ban jail `bantime` setting. | +| `gitea_fail2ban_jail_action` | `iptables-allports` | fail2ban jail `action` setting. | + +### optional customisation +You can optionally customize your gitea using this ansible role. We got our information about customisation from [docs.gitea.io/en-us/customizing-gitea](https://docs.gitea.io/en-us/customizing-gitea/). +To deploy multiple files we created the ``gitea_custom_search`` variable, that can point to the path where you put the custom gitea files *( default ``"files/host_files/{{ inventory_hostname }}/gitea"``)*. + ++ **LOGO**: + - Set ``gitea_customize_logo`` to ``true`` + - We search for: + * ``logo.svg`` - Used for favicon, site icon, app icon + * ``logo.png`` - Used for Open Graph + * ``favicon.png`` - Used as fallback for browsers that don’t support SVG favicons + * ``apple-touch-icon.png`` - Used on iOS devices for bookmarks + - We search in *(using [first_found](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/first_found_lookup.html))*: + * ``{{ gitea_custom_search }}/gitea_logo/`` + * ``files/{{ inventory_hostname }}/gitea_logo/`` + * ``files/{{ gitea_http_domain }}/gitea_logo/`` + * ``files/gitea_logo/`` ++ **FOOTER**: + - Set ``gitea_customize_footer`` to ``true`` + - We Search using first_found in: + * "{{ gitea_custom_search }}/gitea_footer/extra_links_footer.tmpl" + * "files/{{ inventory_hostname }}/gitea_footer/extra_links_footer.tmpl" + * "files/{{ gitea_http_domain }}/gitea_footer/extra_links_footer.tmpl" + * 'files/gitea_footer/extra_links_footer.tmpl' + * 'files/extra_links_footer.tmpl' ++ **CUSTOM FILES**: + - Set ``gitea_customize_files`` to ``true`` + - Create a directory with the files you want to deploy. + - Point ``gitea_customize_files_path`` to this directory. *(Default ``{{ gitea_custom_search }}/gitea_files/``)* + +## Requirements +This role uses the ``ansible.builtin`` and ``community.general`` ansible Collections. To download the latest forgejo/gitea release we use json_query. This requires ``jmespath`` to be available. + +### Python packages ++ jmespath + +### Galaxy Collections ++ community.general + + +### Example requirements Installation +``` +ansible-galaxy install community.general +pip3 install jmespath +``` + +## Contribute +Don't hesitate to create a pull request, and if in doubt you can reach me at +Mastodon [@l3d@chaos.social](https://chaos.social/@l3d). + +I'll be happy to fix any issues you raise, or even better, review your pull requests :) + +## Testing +There are some tests that will validate the linting. A good test CI pipeline that works with the systemd commands used is still needed. + +| test status | Github Marketplace | +| :--------- | :---------------- | +| [![Galaxy release](https://github.com/roles-ansible/ansible_role_gitea/actions/workflows/galaxy.yml/badge.svg)](https://github.com/roles-ansible/ansible_role_gitea/actions/workflows/galaxy.yml) | [publish-ansible-role-to-galaxy](https://github.com/marketplace/actions/publish-ansible-role-to-galaxy) | +| [![Yamllint GitHub Actions](https://github.com/roles-ansible/ansible_role_gitea/actions/workflows/yamllint.yaml/badge.svg)](https://github.com/roles-ansible/ansible_role_gitea/actions/workflows/yamllint.yaml) | [yamllint-github-action](https://github.com/marketplace/actions/yamllint-github-action) | +| [![Ansible Lint check](https://github.com/roles-ansible/ansible_role_gitea/actions/workflows/ansible-linting-check.yml/badge.svg)](https://github.com/roles-ansible/ansible_role_gitea/actions/workflows/ansible-linting-check.yml) | [ansible-lint action](https://github.com/marketplace/actions/ansible-lint) + +## History of this role +this ansible role was originally developed on [github.com/thomas-maurice/ansible-role-gitea](https://github.com/thomas-maurice/ansible-role-gitea.git). Since the role there has some problems like default values for the location of the gitea repositories and the merging of pull requests usually takes several months, a fork of the role was created that offers the same. Only tidier and with the claim to react faster to issues and pull requests. It is now Part of the [l3d.git](https://galaxy.ansible.com/l3d/git) Collection too. diff --git a/roles/l3d.gitea/defaults/main.yml b/roles/l3d.gitea/defaults/main.yml new file mode 100644 index 00000000..37e8bd84 --- /dev/null +++ b/roles/l3d.gitea/defaults/main.yml @@ -0,0 +1,254 @@ +--- +# Choose between https://forgejo.org/ and https://gitea.io/ +gitea_fork: 'gitea' # 'gitea' and 'forgejo' are valid options + +# gitea version +# Use 'latest' to auto-update; upgrading past role version may lead to errors. +gitea_version: 'latest' +gitea_version_check: true +gitea_gpg_key: '7C9E68152594688862D62AF62D9AE806EC1592E2' +gitea_forgejo_gpg_key: 'EB114F5E6C0DC2BCDD183550A4B61A2DC5923710' +gitea_gpg_server: 'hkps://keys.openpgp.org' +gitea_backup_on_upgrade: false +gitea_backup_location: "{{ gitea_home }}/backups/" +submodules_versioncheck: false + +# gitea in the linux world +gitea_group: 'gitea' +# gitea_groups: [] # Optional a list of groups user gitea will be added to +gitea_home: '/var/lib/gitea' +gitea_user_home: '{{ gitea_home }}' +gitea_executable_path: '/usr/local/bin/gitea' +gitea_forgejo_executable_path: '/usr/local/bin/forgejo' +gitea_configuraion_path: '/etc/gitea' +gitea_shell: '/bin/false' +gitea_systemd_cap_net_bind_service: false + +# Overall (DEFAULT) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#overall-default +gitea_app_name: 'Gitea' +gitea_user: 'gitea' +gitea_run_mode: 'prod' +gitea_fqdn: 'localhost' + +# Repository (repository) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#repository-repository +gitea_default_branch: 'main' +gitea_default_private: 'last' +gitea_default_repo_units: 'repo.code,repo.releases,repo.issues,repo.pulls,repo.wiki,repo.projects' +gitea_disabled_repo_units: '' +gitea_disable_http_git: false +gitea_disable_stars: false +gitea_enable_push_create_org: false +gitea_enable_push_create_user: false +gitea_force_private: false +gitea_user_repo_limit: '-1' +gitea_repository_root: "{{ gitea_home }}/repos" +gitea_repository_extra_config: '' +gitea_repository_upload_extra_config: '' + +# Repository - Signing (repository.signing) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#repository---signing-repositorysigning +gitea_enable_repo_signing_options: false +gitea_repo_signing_key: 'default' +gitea_repo_signing_name: '' +gitea_repo_signing_email: '' +gitea_repo_initial_commit: 'always' +gitea_repo_default_trust_model: 'collaborator' +gitea_repo_wiki: 'never' +gitea_repo_crud_actions: 'pubkey, twofa, parentsigned' +gitea_repo_merges: ' pubkey, twofa, basesigned, commitssigned' +gitea_enable_repo_signing_extra: '' + +# CORS (cors) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#cors-cors +gitea_enable_cors: false +gitea_cors_scheme: 'http' +gitea_cors_allow_domain: '*' +gitea_cors_allow_subdomain: false +gitea_cors_methods: 'GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS' +gitea_cors_max_age: '10m' +gitea_cors_allow_credentials: false +gitea_cors_headers: 'Content-Type,User-Agent' +gitea_cors_x_frame_options: 'SAMEORIGIN' +gitea_cors_extra: '' + +# UI (ui) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#ui-ui +gitea_show_user_email: false +gitea_theme_default: 'auto' +gitea_themes: 'auto,gitea,arc-green' +gitea_ui_extra_config: '' + +# UI - Metadata (ui.meta) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#ui---metadata-uimeta +gitea_ui_author: 'Gitea - Git with a cup of tea' +gitea_ui_description: 'Gitea (Git with a cup of tea) is a painless self-hosted Git service written in Go:' +gitea_ui_keywords: 'go,git,self-hosted,gitea,forgejo' +gitea_ui_meta_extra_config: '' + +# Server (server) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#server-server +gitea_protocol: 'http' +gitea_http_domain: "{{ gitea_fqdn }}" +gitea_root_url: "http://{{ gitea_fqdn }}:3000" +gitea_http_listen: '127.0.0.1' +gitea_http_port: '3000' +gitea_start_ssh: true +gitea_ssh_domain: "{{ gitea_fqdn }}" +gitea_ssh_port: '2222' +gitea_ssh_listen: '0.0.0.0' +gitea_offline_mode: true +gitea_landing_page: 'home' +gitea_lfs_server_enabled: false +gitea_lfs_jwt_secret: '' +gitea_redirect_other_port: false +gitea_port_to_redirect: '80' +gitea_enable_tls_certs: false +gitea_tls_cert_file: 'https/cert.pem' +gitea_tls_key_file: 'https/key.pem' +gitea_enable_acme: false +gitea_acme_url: '' +gitea_acme_accepttos: false +gitea_acme_directory: 'https' +gitea_acme_email: '' +gitea_acme_ca_root: '' +gitea_server_extra_config: '' + +# Database (database) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#database-database +gitea_db_type: 'sqlite3' +gitea_db_host: '127.0.0.0:3306' +gitea_db_name: 'root' +gitea_db_user: 'gitea' +gitea_db_password: 'lel' +gitea_db_ssl: 'disable' +gitea_db_path: "{{ gitea_home }}/data/gitea.db" +gitea_db_log_sql: false +gitea_database_extra_config: '' + +# Indexer (indexer) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#indexer-indexer +gitea_repo_indexer_enabled: false +gitea_repo_indexer_include: '' +gitea_repo_indexer_exclude: '' +gitea_repo_exclude_vendored: true +gitea_repo_indexer_max_file_size: '1048576' +gitea_indexer_extra_config: '' +gitea_queue_issue_indexer_extra_config: '' + +# Security (security) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#security-security +gitea_secret_key: '' +gitea_disable_git_hooks: true +gitea_disable_webhooks: false +gitea_internal_token: '' +gitea_password_check_pwn: false +gitea_security_extra_config: '' + +# Service (service) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#service-service +gitea_disable_registration: false +gitea_register_email_confirm: false +gitea_require_signin: true +gitea_default_keep_mail_private: true +gitea_enable_captcha: true +gitea_show_registration_button: true +gitea_only_allow_external_registration: false +gitea_enable_notify_mail: false +gitea_auto_watch_new_repos: true +gitea_service_extra_config: '' + +# Mailer [mailer] +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#mailer-mailer +gitea_mailer_enabled: false +gitea_mailer_protocol: 'dummy' +gitea_mailer_smtp_addr: '' +gitea_mailer_smtp_port: '' +gitea_mailer_use_client_cert: false +gitea_mailer_client_cert_file: '' +gitea_mailer_client_key_file: '' +gitea_mailer_force_trust_server_cert: false +gitea_mailer_user: '' +gitea_mailer_password: '' +gitea_mailer_enable_helo: true +gitea_mailer_from: "noreply@{{ gitea_http_domain }}" +gitea_subject_prefix: '' +gitea_mailer_send_as_plaintext: false +gitea_mailer_extra_config: '' + +# Session (session) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#session-session +gitea_session_provider: 'file' +gitea_session_extra_config: '' + +# Picture (picture) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#picture-picture +gitea_picture_extra_config: '' + +# Issue and pull request attachments (attachment) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#issue-and-pull-request-attachments-attachment +gitea_attachment_enabled: true +gitea_attachment_extra_config: '' + +# Log (log) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#log-log +gitea_log_systemd: false +gitea_log_level: 'Warn' +gitea_log_extra_config: '' + +# Metrics (metrics) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#metrics-metrics +gitea_metrics_enabled: false +gitea_metrics_token: '' +gitea_metrics_extra: '' + +# OAuth2 (oauth2) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#oauth2-oauth2 +gitea_oauth2_enabled: true +gitea_oauth2_jwt_secret: '' +gitea_oauth2_extra_config: '' + +# Federation (federation) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#federation-federation +gitea_federation_enabled: false +gitea_federation_share_user_stats: false +gitea_federation_extra: '' + +# Packages (packages) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#packages-packages +gitea_packages_enabled: true +gitea_packages_extra: '' + +# LFS (lfs) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#lfs-lfs +gitea_lfs_storage_type: 'local' +gitea_lfs_serve_direct: false +gitea_lfs_content_path: "{{ gitea_home }}/data/lfs" +gitea_lfs_extra: '' + +# Other (other) +# -> https://docs.gitea.io/en-us/config-cheat-sheet/#other-other +gitea_other_show_footer_branding: false +gitea_other_show_footer_version: true +gitea_other_show_footer_template_load_time: true +gitea_other_enable_sitemap: true +gitea_other_enable_feed: true + +# additional gitea config +gitea_extra_config: "" + +# fail2ban +gitea_fail2ban_enabled: false +gitea_fail2ban_jail_maxretry: '10' +gitea_fail2ban_jail_findtime: '3600' +gitea_fail2ban_jail_bantime: '900' +gitea_fail2ban_jail_action: 'iptables-allports' + +# gitea customisation +gitea_custom_search: "files/host_files/{{ inventory_hostname }}/gitea" +gitea_customize_logo: false +gitea_custom: "{{ gitea_home }}/custom" +gitea_customize_footer: false +gitea_customize_files: false +gitea_customize_files_path: "{{ gitea_custom_search }}/gitea_files" diff --git a/roles/l3d.gitea/files/extra_links_footer.tmpl b/roles/l3d.gitea/files/extra_links_footer.tmpl new file mode 100644 index 00000000..ac1a2cbd --- /dev/null +++ b/roles/l3d.gitea/files/extra_links_footer.tmpl @@ -0,0 +1,2 @@ +Datenschutz +Impressum diff --git a/roles/tmaurice.gitea/handlers/main.yml b/roles/l3d.gitea/handlers/main.yml similarity index 75% rename from roles/tmaurice.gitea/handlers/main.yml rename to roles/l3d.gitea/handlers/main.yml index 7ca4bd84..ebc17160 100644 --- a/roles/tmaurice.gitea/handlers/main.yml +++ b/roles/l3d.gitea/handlers/main.yml @@ -1,17 +1,20 @@ --- - name: "Restart gitea" + become: true ansible.builtin.service: name: gitea state: restarted when: ansible_service_mgr == "systemd" - name: "Reload systemd" + become: true ansible.builtin.systemd: daemon_reload: true when: ansible_service_mgr == "systemd" -- name: "Restart fail2ban" - ansible.builtin.service: +- name: "Systemctl restart fail2ban" + become: true + ansible.builtin.systemd: name: fail2ban state: restarted when: ansible_service_mgr == "systemd" diff --git a/roles/l3d.gitea/meta/main.yml b/roles/l3d.gitea/meta/main.yml new file mode 100644 index 00000000..ad117d76 --- /dev/null +++ b/roles/l3d.gitea/meta/main.yml @@ -0,0 +1,32 @@ +--- +galaxy_info: + role_name: gitea + author: l3d + description: Ansible role to configure and deploy gitea and forgejo, a painless self-hosted Git service. + license: "BSD-3-Clause" + min_ansible_version: "2.11" + platforms: + - name: Debian + versions: + - all + - name: Ubuntu + versions: + - all + - name: Fedora + versions: + - all + - name: EL + versions: + - all + galaxy_tags: + - gitea + - forgejo + - git + - system + - development + - sourcecontrol + - selfhosted + - gitserver + - gogs + - linux +dependencies: [] diff --git a/roles/l3d.gitea/tasks/backup.yml b/roles/l3d.gitea/tasks/backup.yml new file mode 100644 index 00000000..9699fcad --- /dev/null +++ b/roles/l3d.gitea/tasks/backup.yml @@ -0,0 +1,45 @@ +--- +- name: Get service facts + ansible.builtin.service_facts: + +- name: Backup block + when: + - ansible_facts.services["gitea.service"] is defined + - ansible_facts.services["gitea.service"].state == "running" + - gitea_active_version.stdout != gitea_version_target + block: + - name: Stopping gitea before upgrade + become: true + ansible.builtin.systemd: + name: gitea + state: stopped + when: ansible_service_mgr == "systemd" + + - name: "Create backup directory" + become: true + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + mode: 'u=rwx,g=rx,o=' + with_items: + - "{{ gitea_backup_location }}" + + - name: Backing up gitea before upgrade + become: true + ansible.builtin.command: + cmd: "sudo -u {{ gitea_user }} {{ gitea_full_executable_path }} dump -c {{ gitea_configuraion_path }}/gitea.ini" + chdir: "{{ gitea_backup_location }}" + changed_when: true + rescue: + - name: Starting gitea because backup failed + become: true + ansible.builtin.systemd: + name: gitea + state: stopped + when: ansible_service_mgr == "systemd" + + - name: Print updateing error + ansible.builtin.debug: + msg: "failed to backup gitea" diff --git a/roles/l3d.gitea/tasks/configure.yml b/roles/l3d.gitea/tasks/configure.yml new file mode 100644 index 00000000..cf57dcfa --- /dev/null +++ b/roles/l3d.gitea/tasks/configure.yml @@ -0,0 +1,18 @@ +--- +- name: "Configure gitea" + become: true + ansible.builtin.template: + src: gitea.ini.j2 + dest: "{{ gitea_configuraion_path }}/gitea.ini" + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + mode: 0600 + notify: "Restart gitea" + +- name: "Service gitea" + become: true + ansible.builtin.systemd: + name: gitea + state: started + enabled: true + when: ansible_service_mgr == "systemd" diff --git a/roles/l3d.gitea/tasks/create_user.yml b/roles/l3d.gitea/tasks/create_user.yml new file mode 100644 index 00000000..3f2aa388 --- /dev/null +++ b/roles/l3d.gitea/tasks/create_user.yml @@ -0,0 +1,23 @@ +--- +- name: "Create Gitea Group" + become: true + ansible.builtin.group: + name: "{{ gitea_group }}" + system: true + state: "present" + +- name: Switch shell when not using the builtin ssh server + ansible.builtin.set_fact: + gitea_shell: "/bin/bash" + when: "not gitea_start_ssh and gitea_shell == '/bin/false'" + +- name: "Create Gitea user" + become: true + ansible.builtin.user: + name: "{{ gitea_user }}" + comment: "Gitea user" + group: "{{ gitea_group }}" + groups: "{{ gitea_groups | default(omit) }}" + home: "{{ gitea_user_home }}" + shell: "{{ gitea_shell }}" + system: true diff --git a/roles/l3d.gitea/tasks/customize_footer.yml b/roles/l3d.gitea/tasks/customize_footer.yml new file mode 100644 index 00000000..f7f89314 --- /dev/null +++ b/roles/l3d.gitea/tasks/customize_footer.yml @@ -0,0 +1,24 @@ +--- +- name: Create directory for custom footer + become: true + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + mode: 'u=rwX,g=rX,o=' + with_items: + - "{{ gitea_custom }}/templates" + - "{{ gitea_custom }}/templates/custom" + +- name: Transfer custom footer template + become: true + ansible.builtin.copy: + src: "{{ lookup('first_found', transfer_custom_footer) }}" + dest: "{{ gitea_custom }}/templates/custom/extra_links_footer.tmpl" + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + mode: '0644' + ignore_errors: true + tags: skip_ansible_lint + notify: "Restart gitea" diff --git a/roles/l3d.gitea/tasks/customize_logo.yml b/roles/l3d.gitea/tasks/customize_logo.yml new file mode 100644 index 00000000..4d4d6091 --- /dev/null +++ b/roles/l3d.gitea/tasks/customize_logo.yml @@ -0,0 +1,56 @@ +--- +- name: Create directory for custom logos + become: true + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + mode: 'u=rwX,g=rX,o=' + with_items: + - "{{ gitea_custom }}/public" + - "{{ gitea_custom }}/public/img" + +- name: Transfer custom logo.svg + become: true + ansible.builtin.copy: + src: "{{ lookup('first_found', transfer_custom_logo_logosvg) }}" + dest: "{{ gitea_custom }}/public/img/logo.svg" + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + mode: '0644' + tags: skip_ansible_lint + ignore_errors: true + +- name: Transfer custom logo.png + become: true + ansible.builtin.copy: + src: "{{ lookup('first_found', transfer_custom_logo_logopng) }}" + dest: "{{ gitea_custom }}/public/img/logo.png" + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + mode: '0644' + tags: skip_ansible_lint + ignore_errors: true + +- name: Transfer custom favicon.png + become: true + ansible.builtin.copy: + src: "{{ lookup('first_found', transfer_custom_logo_faviconpng) }}" + dest: "{{ gitea_custom }}/public/img/favicon.png" + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + mode: '0644' + tags: skip_ansible_lint + ignore_errors: true + +- name: Transfer custom apple-touch-icon.png + become: true + ansible.builtin.copy: + src: "{{ lookup('first_found', transfer_custom_logo_appletouchiconpng) }}" + dest: "{{ gitea_custom }}/public/img/apple-touch-icon.png" + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + mode: '0644' + tags: skip_ansible_lint + ignore_errors: true diff --git a/roles/l3d.gitea/tasks/customize_public_files.yml b/roles/l3d.gitea/tasks/customize_public_files.yml new file mode 100644 index 00000000..9c14c9a4 --- /dev/null +++ b/roles/l3d.gitea/tasks/customize_public_files.yml @@ -0,0 +1,24 @@ +--- +- name: Create public directory for custom public web files + become: true + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + mode: 'u=rwX,g=rX,o=' + with_items: + - "{{ gitea_custom }}/public" + +- name: Transfer custom public web data + become: true + ansible.builtin.copy: + src: "{{ gitea_customize_files_path }}" + dest: "{{ gitea_custom }}/public/" + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + directory_mode: true + mode: 'u=rwX,g=rX,o=' + ignore_errors: true + tags: skip_ansible_lint + notify: "Restart gitea" diff --git a/roles/l3d.gitea/tasks/directory.yml b/roles/l3d.gitea/tasks/directory.yml new file mode 100644 index 00000000..f89f70d0 --- /dev/null +++ b/roles/l3d.gitea/tasks/directory.yml @@ -0,0 +1,20 @@ +--- +- name: "Create config and data directory" + become: true + ansible.builtin.file: + path: "{{ item }}" + state: directory + owner: "{{ gitea_user }}" + group: "{{ gitea_group }}" + mode: 'u=rwX,g=rX,o=' + with_items: + - "{{ gitea_configuraion_path }}" + - "{{ gitea_user_home }}" + - "{{ gitea_home }}" + - "{{ gitea_home }}/data" + - "{{ gitea_custom }}" + - "{{ gitea_custom }}/https" + - "{{ gitea_custom }}/mailer" + - "{{ gitea_home }}/indexers" + - "{{ gitea_home }}/log" + - "{{ gitea_repository_root }}" diff --git a/roles/tmaurice.gitea/tasks/fail2ban.yml b/roles/l3d.gitea/tasks/fail2ban.yml similarity index 77% rename from roles/tmaurice.gitea/tasks/fail2ban.yml rename to roles/l3d.gitea/tasks/fail2ban.yml index ce7025c9..aa41bdea 100644 --- a/roles/tmaurice.gitea/tasks/fail2ban.yml +++ b/roles/l3d.gitea/tasks/fail2ban.yml @@ -1,26 +1,29 @@ --- - name: Install fail2ban filter + become: true ansible.builtin.template: src: fail2ban/filter.conf.j2 dest: /etc/fail2ban/filter.d/gitea.conf owner: root group: root mode: 0444 - notify: Restart fail2ban + notify: "Systemctl restart fail2ban" when: "'fail2ban' in ansible_facts.packages" - name: Install fail2ban jail + become: true ansible.builtin.template: src: fail2ban/jail.conf.j2 dest: /etc/fail2ban/jail.d/gitea.conf owner: root group: root mode: 0444 - notify: Restart fail2ban + notify: "Systemctl restart fail2ban" when: "'fail2ban' in ansible_facts.packages" -- name: warn if fail2ban is not installed +- name: Warn if fail2ban is not installed ansible.builtin.fail: msg: "the package fail2ban is not installed. no fail2ban filters deployed." when: "'fail2ban' not in ansible_facts.packages" ignore_errors: true + tags: skip_ansible_lint_ignore-errors diff --git a/roles/l3d.gitea/tasks/gitea_secrets.yml b/roles/l3d.gitea/tasks/gitea_secrets.yml new file mode 100644 index 00000000..c5b1e209 --- /dev/null +++ b/roles/l3d.gitea/tasks/gitea_secrets.yml @@ -0,0 +1,38 @@ +--- +- name: Generate gitea SECRET_KEY if not provided + become: true + ansible.builtin.shell: 'umask 077; {{ gitea_full_executable_path }} generate secret SECRET_KEY > {{ gitea_configuraion_path }}/gitea_secret_key' + args: + creates: '{{ gitea_configuraion_path }}/gitea_secret_key' + when: gitea_secret_key | string | length == 0 + +- name: Read gitea SECRET_KEY from file + become: true + ansible.builtin.slurp: + src: '{{ gitea_configuraion_path }}/gitea_secret_key' + register: remote_secret_key + when: gitea_secret_key | string | length == 0 + +- name: Set fact gitea_secret_key + ansible.builtin.set_fact: + gitea_secret_key: "{{ remote_secret_key['content'] | b64decode }}" + when: gitea_secret_key | string | length == 0 + +- name: Generate gitea INTERNAL_TOKEN if not provided + become: true + ansible.builtin.shell: 'umask 077; {{ gitea_full_executable_path }} generate secret INTERNAL_TOKEN > {{ gitea_configuraion_path }}/gitea_internal_token' + args: + creates: '{{ gitea_configuraion_path }}/gitea_internal_token' + when: gitea_internal_token | string | length == 0 + +- name: Read gitea INTERNAL_TOKEN from file + become: true + ansible.builtin.slurp: + src: '{{ gitea_configuraion_path }}/gitea_internal_token' + register: remote_internal_token + when: gitea_internal_token | string | length == 0 + +- name: Set fact gitea_internal_token + ansible.builtin.set_fact: + gitea_internal_token: "{{ remote_internal_token['content'] | b64decode }}" + when: gitea_internal_token | string | length == 0 diff --git a/roles/l3d.gitea/tasks/install_forgejo.yml b/roles/l3d.gitea/tasks/install_forgejo.yml new file mode 100644 index 00000000..e3f3112e --- /dev/null +++ b/roles/l3d.gitea/tasks/install_forgejo.yml @@ -0,0 +1,82 @@ +--- +- name: Dependency block + block: + - name: Update apt cache + become: true + ansible.builtin.apt: + cache_valid_time: 3600 + update_cache: true + register: _pre_update_apt_cache + until: _pre_update_apt_cache is succeeded + when: + - ansible_pkg_mgr == "apt" + + - name: Install dependencies + become: true + ansible.builtin.package: + name: "{{ gitea_dependencies }}" + state: present + register: _install_dep_packages + until: _install_dep_packages is succeeded + retries: 5 + delay: 2 + +- name: Install forgejo block + when: (not gitea_version_check | bool) or (not ansible_check_mode and (gitea_active_version.stdout != gitea_version_target)) + block: + - name: Download forgejo archive + ansible.builtin.get_url: + url: "{{ gitea_forgejo_dl_url | first }}" + dest: "/tmp/{{ gitea_filename }}" + checksum: "sha256:{{ gitea_forgejo_checksum }}" + mode: 0640 + register: _download_archive + become: false + until: _download_archive is succeeded + retries: 5 + delay: 2 + + - name: Download forgejo asc file + ansible.builtin.get_url: + url: "{{ gitea_forgejo_signed_url | first }}" + dest: "/tmp/{{ gitea_filename }}.asc" + mode: 0640 + register: _download_asc + become: false + until: _download_asc is succeeded + retries: 5 + delay: 2 + + - name: Check forgejo gpg key + ansible.builtin.command: "gpg --list-keys 0x{{ gitea_forgejo_gpg_key }}" + register: _gitea_gpg_key_status + changed_when: false + failed_when: _gitea_gpg_key_status.rc not in (0, 2) + + - name: Print gpg key staus on verbosity + ansible.builtin.debug: + msg: "{{ _gitea_gpg_key_status.stdout }}" + verbosity: 1 + + - name: Import forgejo gpg key + ansible.builtin.command: "gpg --keyserver {{ gitea_gpg_server }} --recv {{ gitea_forgejo_gpg_key }}" + register: _gitea_import_key + become: false + changed_when: '"imported: 1" in _gitea_import_key.stderr' + when: '_gitea_gpg_key_status.rc != 0 or "expired" in _gitea_gpg_key_status.stdout' + + - name: Check archive signature + become: false + ansible.builtin.command: "gpg --verify /tmp/{{ gitea_filename }}.asc /tmp/{{ gitea_filename }}" + changed_when: false + + - name: Propagate gitea binary + become: true + ansible.builtin.copy: + src: "/tmp/{{ gitea_filename }}" + remote_src: true + dest: "{{ gitea_full_executable_path }}" + mode: 0755 + owner: root + group: root + notify: "Restart gitea" diff --git a/roles/tmaurice.gitea/tasks/install.yml b/roles/l3d.gitea/tasks/install_gitea.yml similarity index 51% rename from roles/tmaurice.gitea/tasks/install.yml rename to roles/l3d.gitea/tasks/install_gitea.yml index 474df904..bf166e8f 100644 --- a/roles/tmaurice.gitea/tasks/install.yml +++ b/roles/l3d.gitea/tasks/install_gitea.yml @@ -1,7 +1,9 @@ --- -- block: +- name: Dependency block + block: - name: Update apt cache - apt: + become: true + ansible.builtin.apt: cache_valid_time: 3600 update_cache: true register: _pre_update_apt_cache @@ -10,7 +12,8 @@ - ansible_pkg_mgr == "apt" - name: Install dependencies - package: + become: true + ansible.builtin.package: name: "{{ gitea_dependencies }}" state: present register: _install_dep_packages @@ -18,54 +21,66 @@ retries: 5 delay: 2 -- block: +- name: Install gitea block + when: (not gitea_version_check | bool) or (not ansible_check_mode and (gitea_active_version.stdout != gitea_version_target)) + block: - name: Download gitea archive - get_url: + ansible.builtin.get_url: url: "{{ gitea_dl_url }}.xz" - dest: "/tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}.xz" + dest: "/tmp/{{ gitea_filename }}.xz" checksum: "sha256:{{ gitea_dl_url }}.xz.sha256" + mode: 0640 register: _download_archive + become: false until: _download_archive is succeeded retries: 5 delay: 2 - name: Download gitea asc file - get_url: + ansible.builtin.get_url: url: "{{ gitea_dl_url }}.xz.asc" - dest: "/tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}.xz.asc" + dest: "/tmp/{{ gitea_filename }}.xz.asc" + mode: 0640 register: _download_asc + become: false until: _download_asc is succeeded retries: 5 delay: 2 - name: Check gitea gpg key - command: "gpg --list-keys 0x{{ gitea_gpg_key }}" + ansible.builtin.command: "gpg --list-keys 0x{{ gitea_gpg_key }}" register: _gitea_gpg_key_status changed_when: false failed_when: _gitea_gpg_key_status.rc not in (0, 2) + - name: Print gpg key staus on verbosity + ansible.builtin.debug: + msg: "{{ _gitea_gpg_key_status.stdout }}" + verbosity: 1 + - name: Import gitea gpg key - command: "gpg --keyserver {{ gitea_gpg_server }} --recv {{ gitea_gpg_key }}" + ansible.builtin.command: "gpg --keyserver {{ gitea_gpg_server }} --recv {{ gitea_gpg_key }}" register: _gitea_import_key + become: false changed_when: '"imported: 1" in _gitea_import_key.stderr' - when: _gitea_gpg_key_status.rc != 0 + when: '_gitea_gpg_key_status.rc != 0 or "expired" in _gitea_gpg_key_status.stdout' - name: Check archive signature - command: "gpg --verify /tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}.xz.asc /tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}.xz" + ansible.builtin.command: "gpg --verify /tmp/{{ gitea_filename }}.xz.asc /tmp/{{ gitea_filename }}.xz" changed_when: false - name: Unpack gitea binary - command: - cmd: "xz -k -d /tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}.xz" - creates: "/tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}" + ansible.builtin.command: + cmd: "xz -k -d /tmp/{{ gitea_filename }}.xz" + creates: "/tmp/{{ gitea_filename }}" - name: Propagate gitea binary - copy: - src: "/tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}" + become: true + ansible.builtin.copy: + src: "/tmp/{{ gitea_filename }}" remote_src: true - dest: "/usr/local/bin/gitea" + dest: "{{ gitea_full_executable_path }}" mode: 0755 owner: root group: root notify: "Restart gitea" - when: (not gitea_version_check|bool) or (not ansible_check_mode and (gitea_active_version.stdout != gitea_version)) diff --git a/roles/tmaurice.gitea/tasks/install_systemd.yml b/roles/l3d.gitea/tasks/install_systemd.yml similarity index 72% rename from roles/tmaurice.gitea/tasks/install_systemd.yml rename to roles/l3d.gitea/tasks/install_systemd.yml index a058d6f6..78173a98 100644 --- a/roles/tmaurice.gitea/tasks/install_systemd.yml +++ b/roles/l3d.gitea/tasks/install_systemd.yml @@ -1,5 +1,6 @@ --- - name: "Setup systemd service" + become: true ansible.builtin.template: src: gitea.service.j2 dest: /lib/systemd/system/gitea.service @@ -10,8 +11,7 @@ - "Reload systemd" - "Restart gitea" -# systemd to be reloaded the first time because -# it is the only way Systemd is going to be aware of the new unit file. - name: "Reload systemd" + become: true ansible.builtin.systemd: daemon_reload: true diff --git a/roles/l3d.gitea/tasks/jwt_secrets.yml b/roles/l3d.gitea/tasks/jwt_secrets.yml new file mode 100644 index 00000000..f56abf03 --- /dev/null +++ b/roles/l3d.gitea/tasks/jwt_secrets.yml @@ -0,0 +1,38 @@ +--- +- name: Generate OAuth2 JWT_SECRET if not provided + become: true + ansible.builtin.shell: 'umask 077; {{ gitea_full_executable_path }} generate secret JWT_SECRET > {{ gitea_configuraion_path }}/gitea_oauth_jwt_secret' + args: + creates: '{{ gitea_configuraion_path }}/gitea_oauth_jwt_secret' + when: gitea_oauth2_jwt_secret | length == 0 + +- name: Read OAuth2 JWT_SECRET from file + become: true + ansible.builtin.slurp: + src: '{{ gitea_configuraion_path }}/gitea_oauth_jwt_secret' + register: oauth_jwt_secret + when: gitea_oauth2_jwt_secret | length == 0 + +- name: Set fact gitea_oauth2_jwt_secret + ansible.builtin.set_fact: + gitea_oauth2_jwt_secret: "{{ oauth_jwt_secret['content'] | b64decode }}" + when: gitea_oauth2_jwt_secret | length == 0 + +- name: Generate LFS JWT_SECRET if not provided + become: true + ansible.builtin.shell: 'umask 077; {{ gitea_full_executable_path }} generate secret JWT_SECRET > {{ gitea_configuraion_path }}/gitea_lfs_jwt_secret' + args: + creates: '{{ gitea_configuraion_path }}/gitea_lfs_jwt_secret' + when: gitea_lfs_jwt_secret | length == 0 + +- name: Read LFS JWT_SECRET from file + become: true + ansible.builtin.slurp: + src: '{{ gitea_configuraion_path }}/gitea_lfs_jwt_secret' + register: lfs_jwt_secret + when: gitea_lfs_jwt_secret | length == 0 + +- name: Set fact gitea_lfs_jwt_secret + ansible.builtin.set_fact: + gitea_lfs_jwt_secret: "{{ lfs_jwt_secret['content'] | b64decode }}" + when: gitea_lfs_jwt_secret | length == 0 diff --git a/roles/l3d.gitea/tasks/main.yml b/roles/l3d.gitea/tasks/main.yml new file mode 100644 index 00000000..7fe73318 --- /dev/null +++ b/roles/l3d.gitea/tasks/main.yml @@ -0,0 +1,65 @@ +--- +- name: Perform optional versionscheck + ansible.builtin.include_tasks: versioncheck.yml + when: submodules_versioncheck|bool + +- name: Gather installed packages for checks later on + ansible.builtin.package_facts: + manager: auto + +- name: Prepare gitea/forgejo variable import + block: + - name: Gather variables for gitea or forgejo + ansible.builtin.include_vars: "{{ lookup('first_found', gitea_fork_variables) }}" + rescue: + - name: Gitea/Forejo import info + ansible.builtin.fail: + msg: "Currently only {{ gitea_supported_forks }} are supported." + +- name: Gather variables for each operating system + ansible.builtin.include_vars: "{{ lookup('first_found', gitea_variables) }}" + +- name: Gather versioning information + ansible.builtin.include_tasks: "set_{{ gitea_fork | lower }}_version.yml" + +- name: Backup gitea before update + ansible.builtin.include_tasks: backup.yml + when: gitea_backup_on_upgrade|bool + +- name: Create gitea user and role + ansible.builtin.include_tasks: create_user.yml + +- name: "Install or update {{ gitea_fork }}" + ansible.builtin.include_tasks: "install_{{ gitea_fork | lower }}.yml" + +- name: Create directories + ansible.builtin.include_tasks: directory.yml + +- name: Setup gitea systemd service + ansible.builtin.include_tasks: install_systemd.yml + when: ansible_service_mgr == "systemd" + +- name: Generate JWT Secrets if undefined + ansible.builtin.include_tasks: jwt_secrets.yml + +- name: Generate gitea secrets if undefined + ansible.builtin.include_tasks: gitea_secrets.yml + +- name: Configure gitea + ansible.builtin.include_tasks: configure.yml + +- name: Deploy optional fail2ban rules + ansible.builtin.include_tasks: fail2ban.yml + when: gitea_fail2ban_enabled|bool + +- name: Optionally customize gitea + ansible.builtin.include_tasks: customize_logo.yml + when: gitea_customize_logo|bool + +- name: Optionally customize footer + ansible.builtin.include_tasks: customize_footer.yml + when: gitea_customize_footer|bool + +- name: Optionally deploy public files + ansible.builtin.include_tasks: customize_public_files.yml + when: gitea_customize_files|bool diff --git a/roles/l3d.gitea/tasks/set_forgejo_version.yml b/roles/l3d.gitea/tasks/set_forgejo_version.yml new file mode 100644 index 00000000..f44218f7 --- /dev/null +++ b/roles/l3d.gitea/tasks/set_forgejo_version.yml @@ -0,0 +1,101 @@ +--- +- name: "Check forgejo installed version" + ansible.builtin.shell: "set -eo pipefail; {{ gitea_full_executable_path }} -v | cut -d' ' -f 3" + args: + executable: /bin/bash + register: gitea_active_version + changed_when: false + failed_when: false + +- name: "Determine 'latest' version release" + when: gitea_version == "latest" + block: + - name: "Get latest forgejo release metadata" + ansible.builtin.uri: + url: 'https://codeberg.org/api/v1/repos/forgejo/forgejo/releases?limit=1' + return_content: true + register: gitea_forgejo_remote_metadata + become: false + when: not ansible_check_mode + + - name: "Fail if running in check mode without versions set." + ansible.builtin.fail: + msg: | + "You are running this playbook in check mode: + Please set the Gitea version with the variable 'gitea_version', because the URI module cannot detect the latest version in this mode." + when: ansible_check_mode and (gitea_version == 'latest' or gitea_version == 'present') + + - name: "Set fact latest forgejo release" + ansible.builtin.set_fact: + gitea_remote_version: "{{ gitea_forgejo_remote_metadata.json.0.tag_name[1:] }}" + when: not ansible_check_mode + + - name: "Set forgejo version target (latest)" + ansible.builtin.set_fact: + gitea_version_target: "{{ gitea_remote_version }}" + when: not ansible_check_mode + +- name: "Set gitea version target {{ gitea_version }}" + ansible.builtin.set_fact: + gitea_version_target: "{{ gitea_version }}" + when: gitea_version != "latest" + +- name: "Get specific forgejo release metadata" + ansible.builtin.uri: + url: 'https://codeberg.org/api/v1/repos/forgejo/forgejo/releases/tags/v{{ gitea_version_target }}' + return_content: true + register: gitea_forgejo_remote_tags_metadata + become: false + when: not ansible_check_mode + +- name: "Generate forgejo download url" + ansible.builtin.set_fact: + gitea_forgejo_dl_url: "{{ gitea_forgejo_remote_tags_metadata.json | community.general.json_query(gitea_forgejo_query_download) }}" + when: not ansible_check_mode + +- name: "Generate forgejo download checksum url" + ansible.builtin.set_fact: + gitea_forgejo_checksum_url: "{{ gitea_forgejo_remote_tags_metadata.json | community.general.json_query(gitea_forgejo_query_checksum) }}" + when: not ansible_check_mode + +- name: Get forgejo checksum + ansible.builtin.uri: + url: "{{ gitea_forgejo_checksum_url | first }}" + return_content: true + register: _gitea_forgejo_dl_checksum + become: false + when: not ansible_check_mode + +- name: Set forjeo checksum + ansible.builtin.set_fact: + gitea_forgejo_checksum: "{{ _gitea_forgejo_dl_checksum.content.split(' ')[0] }}" + when: not ansible_check_mode + +- name: "Generate forgejo download signed url" + ansible.builtin.set_fact: + gitea_forgejo_signed_url: "{{ gitea_forgejo_remote_tags_metadata.json | community.general.json_query(gitea_forgejo_query_signed) }}" + when: not ansible_check_mode + +- name: "Set a example forgejo download link if in check mode" + ansible.builtin.set_fact: + gitea_forgejo_dl_url: ['https://codeberg.org/attachments/a00333ad-250a-4d30-a764-9a37fb24f419'] + when: ansible_check_mode + +- name: "Set a example forgejo checksum link if in check mode" + ansible.builtin.set_fact: + gitea_forgejo_checksum: 'f8c71464d1b250bf022eaa3df270c810950904ceb71da5cefc7ec24a034a4c87' + when: ansible_check_mode + +- name: "Set a example forgejo checksum link if in check mode" + ansible.builtin.set_fact: + gitea_forgejo_signed_url: ['https://codeberg.org/attachments/ae5e50c6-e86e-4202-b95f-f142e8138e2f'] + when: ansible_check_mode + +- name: Show Download URLs + ansible.builtin.debug: + msg: "{{ item }}" + verbosity: 1 + with_items: + - "gitea_forgejo_dl_url: {{ gitea_forgejo_dl_url | first }}" + - "gitea_forgejo_checksum: {{ gitea_forgejo_checksum }}" + - "gitea_forgejo_signed_url: {{ gitea_forgejo_signed_url | first }}" diff --git a/roles/l3d.gitea/tasks/set_gitea_version.yml b/roles/l3d.gitea/tasks/set_gitea_version.yml new file mode 100644 index 00000000..c01a6746 --- /dev/null +++ b/roles/l3d.gitea/tasks/set_gitea_version.yml @@ -0,0 +1,45 @@ +--- +- name: "Check gitea installed version" + ansible.builtin.shell: "set -eo pipefail; {{ gitea_full_executable_path }} -v | cut -d' ' -f 3" + args: + executable: /bin/bash + register: gitea_active_version + changed_when: false + failed_when: false + +- name: "Determine 'latest' version release" + when: gitea_version == "latest" + block: + - name: "Get latest gitea release metadata" + ansible.builtin.uri: + url: https://api.github.com/repos/go-gitea/gitea/releases/latest + return_content: true + register: gitea_remote_metadata + become: false + when: not ansible_check_mode + + - name: "Fail if running in check mode without versions set." + ansible.builtin.fail: + msg: | + "You are running this playbook in check mode: + Please set the Gitea version with the variable 'gitea_version', because the URI module cannot detect the latest version in this mode." + when: ansible_check_mode and (gitea_version == 'latest' or gitea_version == 'present') + + - name: "Set fact latest gitea release" + ansible.builtin.set_fact: + gitea_remote_version: "{{ gitea_remote_metadata.json.tag_name[1:] }}" + when: not ansible_check_mode + + - name: "Set gitea version target (latest)" + ansible.builtin.set_fact: + gitea_version_target: "{{ gitea_remote_version }}" + when: not ansible_check_mode + +- name: "Set gitea version target {{ gitea_version }}" + ansible.builtin.set_fact: + gitea_version_target: "{{ gitea_version }}" + when: gitea_version != "latest" + +- name: "Generate gitea download URL" + ansible.builtin.set_fact: + gitea_dl_url: "https://github.com/go-gitea/gitea/releases/download/v{{ gitea_version_target }}/gitea-{{ gitea_version_target }}-linux-{{ gitea_arch }}" diff --git a/roles/l3d.gitea/tasks/versioncheck.yml b/roles/l3d.gitea/tasks/versioncheck.yml new file mode 100644 index 00000000..dd22a1a1 --- /dev/null +++ b/roles/l3d.gitea/tasks/versioncheck.yml @@ -0,0 +1,45 @@ +--- +# Copyright (c) 2021 L3D +# this file is released with the MIT license. +# License: https://github.com/roles-ansible/ansible_role_template/blob/main/LICENSE +- name: Create directory for versionscheck + become: true + ansible.builtin.file: + path: '/etc/.ansible-version' + state: directory + mode: 0755 + when: submodules_versioncheck | bool + +- name: Check playbook version + become: true + ansible.builtin.slurp: + src: "/etc/.ansible-version/{{ playbook_version_path }}" + register: playbook_version + when: submodules_versioncheck | bool + ignore_errors: true + failed_when: false + +- name: Print remote role version + ansible.builtin.debug: + msg: "Remote role version: {{ playbook_version.content | default('Y3VycmVudGx5IG5vdCBkZXBsb3llZAo=') | b64decode | string }}" + when: submodules_versioncheck | bool + +- name: Print locale role version + ansible.builtin.debug: + msg: "Local role version: '{{ playbook_version_number | string }}'." + when: submodules_versioncheck | bool + +- name: Check if your version is outdated + ansible.builtin.fail: + msg: "Your ansible module has the version '{{ playbook_version_number }}' and is outdated. You need to update it!" + when: + - playbook_version.content|default("Mgo=")|b64decode|int - 1 >= playbook_version_number|int and submodules_versioncheck | bool + +- name: Write new version to remote disk + become: true + ansible.builtin.copy: + content: "{{ playbook_version_number }}" + dest: "/etc/.ansible-version/{{ playbook_version_path }}" + mode: '0644' + when: submodules_versioncheck | bool + tags: skip_ansible_lint_template-instead-of-copy diff --git a/roles/l3d.gitea/templates/fail2ban/filter.conf.j2 b/roles/l3d.gitea/templates/fail2ban/filter.conf.j2 new file mode 100644 index 00000000..b6b408e4 --- /dev/null +++ b/roles/l3d.gitea/templates/fail2ban/filter.conf.j2 @@ -0,0 +1,4 @@ +# Managed by Ansible +[Definition] +failregex = .*(Failed authentication attempt|invalid credentials|Attempted access of unknown user).* from +ignoreregex = diff --git a/roles/tmaurice.gitea/templates/fail2ban/jail.conf.j2 b/roles/l3d.gitea/templates/fail2ban/jail.conf.j2 similarity index 100% rename from roles/tmaurice.gitea/templates/fail2ban/jail.conf.j2 rename to roles/l3d.gitea/templates/fail2ban/jail.conf.j2 diff --git a/roles/l3d.gitea/templates/gitea.ini.j2 b/roles/l3d.gitea/templates/gitea.ini.j2 new file mode 100644 index 00000000..eed51a13 --- /dev/null +++ b/roles/l3d.gitea/templates/gitea.ini.j2 @@ -0,0 +1,286 @@ +; this file is the configuration of your local gitea instance +; {{ ansible_managed }} +; +; This file overwrites the default values from gitea. +; undefined variables will use the default value from gitea. +; Cheat Sheet: https://docs.gitea.io/en-us/config-cheat-sheet/ +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#overall-default +APP_NAME = {{ gitea_app_name }} +RUN_USER = {{ gitea_user }} +RUN_MODE = {{ gitea_run_mode }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#repository-repository +[repository] +DEFAULT_BRANCH = {{ gitea_default_branch }} +DEFAULT_PRIVATE = {{ gitea_default_private }} +DEFAULT_REPO_UNITS = {{ gitea_default_repo_units }} +DISABLED_REPO_UNITS = {{ gitea_disabled_repo_units }} +DISABLE_HTTP_GIT = {{ gitea_disable_http_git | ternary('true', 'false') }} +DISABLE_STARS = {{ gitea_disable_stars | ternary('true', 'false') }} +ENABLE_PUSH_CREATE_ORG = {{ gitea_enable_push_create_org | ternary('true', 'false') }} +ENABLE_PUSH_CREATE_USER = {{ gitea_enable_push_create_user | ternary('true', 'false') }} +FORCE_PRIVATE = {{ gitea_force_private | ternary('true', 'false') }} +MAX_CREATION_LIMIT = {{ gitea_user_repo_limit }} +ROOT = {{ gitea_repository_root }} +{{ gitea_repository_extra_config }} +; +; +[repository.upload] +TEMP_PATH = {{ gitea_home }}/data/tmp/uploads +{{ gitea_repository_upload_extra_config }} +; +; +{% if gitea_enable_repo_signing_options | bool %} +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#repository---signing-repositorysigning +[repository.signing] +SIGNING_KEY = {{ gitea_repo_signing_key }} +SIGNING_NAME = {{ gitea_repo_signing_name }} +SIGNING_EMAIL = {{ gitea_repo_signing_email }} +INITIAL_COMMIT = {{ gitea_repo_initial_commit }} +DEFAULT_TRUST_MODEL = {{ gitea_repo_default_trust_model }} +WIKI = {{ gitea_repo_wiki }} +CRUD_ACTIONS = {{ gitea_repo_crud_actions }} +MERGES = {{ gitea_repo_merges }} +{{ gitea_enable_repo_signing_extra }} +; +{% endif %} +; +{% if gitea_enable_cors | bool %} +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#cors-cors +[cors] +ENABLED = {{ gitea_enable_cors | ternary('true', 'false') }} +SCHEME = {{ gitea_cors_scheme }} +ALLOW_DOMAIN = {{ gitea_cors_allow_domain }} +ALLOW_SUBDOMAIN = {{ gitea_cors_allow_subdomain | ternary('true', 'false') }} +METHODS = {{ gitea_cors_methods }} +MAX_AGE = {{ gitea_cors_max_age }} +ALLOW_CREDENTIALS = {{ gitea_cors_allow_credentials | ternary('true', 'false') }} +HEADERS = {{ gitea_cors_headers }} +X_FRAME_OPTIONS = {{ gitea_cors_x_frame_options }} +{{ gitea_cors_extra }} +; +{% endif %} +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#ui-ui +[ui] +SHOW_USER_EMAIL = {{ gitea_show_user_email | ternary('true', 'false') }} +DEFAULT_THEME = {{ gitea_theme_default }} +THEMES = {{ gitea_themes }} +{{ gitea_ui_extra_config }} +; +; +; +[ui.meta] +AUTHOR = {{ gitea_ui_author }} +DESCRIPTION = {{ gitea_ui_description }} +KEYWORDS = {{ gitea_ui_keywords }} +{{ gitea_ui_meta_extra_config }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#server-server +[server] +PROTOCOL = {{ gitea_protocol }} +DOMAIN = {{ gitea_http_domain }} +ROOT_URL = {{ gitea_root_url }} +HTTP_ADDR = {{ gitea_http_listen }} +HTTP_PORT = {{ gitea_http_port }} +START_SSH_SERVER = {{ gitea_start_ssh | ternary('true', 'false') }} +SSH_DOMAIN = {{ gitea_ssh_domain }} +SSH_PORT = {{ gitea_ssh_port }} +SSH_LISTEN_HOST = {{ gitea_ssh_listen }} +OFFLINE_MODE = {{ gitea_offline_mode | ternary('true', 'false') }} +APP_DATA_PATH = {{ gitea_home }}/data +LANDING_PAGE = {{ gitea_landing_page }} +{% if gitea_lfs_server_enabled | bool -%} +LFS_START_SERVER = true +LFS_JWT_SECRET = {{ gitea_lfs_jwt_secret }} +{% endif %} +REDIRECT_OTHER_PORT = {{ gitea_redirect_other_port | ternary('true', 'false') }} +PORT_TO_REDIRECT = {{ gitea_port_to_redirect }} +{% if gitea_enable_tls_certs | bool %} +CERT_FILE = {{ gitea_tls_cert_file }} +KEY_FILE = {{ gitea_tls_key_file }} +{% endif %} +ENABLE_ACME = {{ gitea_enable_acme | ternary('true', 'false') }} +{% if gitea_enable_acme | bool %} +{% if gitea_acme_url != '' %} +ACME_URL = {{ gitea_acme_url }} +{% endif %} +ACME_ACCEPTTOS = {{ gitea_acme_accepttos | ternary('true', 'false') }} +ACME_DIRECTORY = {{ gitea_acme_directory }} +ACME_EMAIL = {{ gitea_acme_email }} +ACME_CA_ROOT = {{ gitea_acme_ca_root }} +{% endif %} +{{ gitea_server_extra_config }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#database-database +[database] +DB_TYPE = {{ gitea_db_type }} +HOST = {{ gitea_db_host }} +NAME = {{ gitea_db_name }} +USER = {{ gitea_db_user }} +PASSWD = {{ gitea_db_password }} +SSL_MODE = {{ gitea_db_ssl }} +PATH = {{ gitea_db_path }} +LOG_SQL = {{ gitea_db_log_sql | ternary('true', 'false') }} +{{ gitea_database_extra_config }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#indexer-indexer +[indexer] +ISSUE_INDEXER_PATH = {{ gitea_home }}/indexers/issues.bleve +REPO_INDEXER_ENABLED = {{ gitea_repo_indexer_enabled | ternary('true', 'false') }} +REPO_INDEXER_PATH = {{ gitea_home }}/indexers/repos.bleve +REPO_INDEXER_INCLUDE = {{ gitea_repo_indexer_include }} +REPO_INDEXER_EXCLUDE = {{ gitea_repo_indexer_exclude }} +REPO_INDEXER_EXCLUDE_VENDORED = {{ gitea_repo_exclude_vendored | ternary('true', 'false') }} +MAX_FILE_SIZE = {{ gitea_repo_indexer_max_file_size }} +{{ gitea_indexer_extra_config }} +; +; +; Queue (queue and queue.*) +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#queue-queue-and-queue +[queue.issue_indexer] +DATADIR = {{ gitea_home }}/indexers/issues.queue +{{ gitea_queue_issue_indexer_extra_config }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#security-security +[security] +INSTALL_LOCK = true +SECRET_KEY = {{ gitea_secret_key }} +DISABLE_GIT_HOOKS = {{ gitea_disable_git_hooks | ternary('true', 'false') }} +DISABLE_WEBHOOKS = {{ gitea_disable_webhooks | ternary('true', 'false') }} +INTERNAL_TOKEN = {{ gitea_internal_token }} +PASSWORD_CHECK_PWN = {{ gitea_password_check_pwn | ternary('true', 'false') }} +{{ gitea_security_extra_config }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#service-service +[service] +DISABLE_REGISTRATION = {{ gitea_disable_registration | ternary('true', 'false') }} +REGISTER_EMAIL_CONFIRM = {{ gitea_register_email_confirm | ternary('true', 'false') }} +REQUIRE_SIGNIN_VIEW = {{ gitea_require_signin | ternary('true', 'false') }} +DEFAULT_KEEP_EMAIL_PRIVATE = {{ gitea_default_keep_mail_private | ternary('true', 'false') }} +ENABLE_CAPTCHA = {{ gitea_enable_captcha | ternary('true', 'false') }} +SHOW_REGISTRATION_BUTTON = {{ gitea_show_registration_button | ternary('true', 'false') }} +ALLOW_ONLY_EXTERNAL_REGISTRATION = {{ gitea_only_allow_external_registration | ternary('true', 'false') }} +ENABLE_NOTIFY_MAIL = {{ gitea_enable_notify_mail | ternary('true', 'false') }} +AUTO_WATCH_NEW_REPOS = {{ gitea_auto_watch_new_repos | ternary('true', 'false') }} +{{ gitea_service_extra_config }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#mailer-mailer +[mailer] +ENABLED = {{ gitea_mailer_enabled | ternary('true', 'false') }} +{% if gitea_mailer_enabled | bool %} +PROTOCOL = {{ gitea_mailer_protocol }} +SMTP_ADDR = {{ gitea_mailer_smtp_addr }} +SMTP_PORT = {{ gitea_mailer_smtp_port }} +USE_CLIENT_CERT = {{ gitea_mailer_use_client_cert | ternary('true', 'false') }} +{% if gitea_mailer_use_client_cert | bool %} +CLIENT_CERT_FILE = {{ gitea_mailer_client_cert_file }} +CLIENT_KEY_FILE = {{ gitea_mailer_client_key_file }} +{% endif %} +FORCE_TRUST_SERVER_CERT = {{ gitea_mailer_force_trust_server_cert | ternary('true', 'false') }} +USER = {{ gitea_mailer_user }} +PASSWD = `{{ gitea_mailer_password }}` +ENABLE_HELO = {{ gitea_mailer_enable_helo | ternary('true', 'false') }} +FROM = {{ gitea_mailer_from }} +SUBJECT_PREFIX = {{ gitea_subject_prefix }} +SEND_AS_PLAIN_TEXT = {{ gitea_mailer_send_as_plaintext | ternary('true', 'false') }} +{{ gitea_mailer_extra_config }} +; +{% endif %} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#session-session +[session] +PROVIDER = {{ gitea_session_provider }} +PROVIDER_CONFIG = {{ gitea_home }}/data/sessions +{{ gitea_session_extra_config }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#picture-picture +[picture] +AVATAR_UPLOAD_PATH = {{ gitea_home }}/data/avatars +{{ gitea_picture_extra_config }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#issue-and-pull-request-attachments-attachment +[attachment] +ENABLED = {{ gitea_attachment_enabled | ternary('true', 'false') }} +PATH = {{ gitea_home }}/data/attachments +{{ gitea_attachment_extra_config }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#log-log +[log] +ROOT_PATH = {{ gitea_home }}/log +{% if gitea_log_systemd %} +MODE = console +{% else %} +MODE = file +{% endif %} +LEVEL = {{ gitea_log_level }} +{{ gitea_log_extra_config }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#metrics-metrics +[metrics] +ENABLED = {{ gitea_metrics_enabled | ternary('true', 'false') }} +TOKEN = {{ gitea_metrics_token }} +{{ gitea_metrics_extra }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#oauth2-oauth2 +[oauth2] +ENABLE = {{ gitea_oauth2_enabled | ternary('true', 'false') }} +JWT_SECRET = {{ gitea_oauth2_jwt_secret }} +{{ gitea_oauth2_extra_config }} +; +; +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#federation-federation +[federation] +ENABLED = {{ gitea_federation_enabled | ternary('true', 'false') }} +SHARE_USER_STATISTICS = {{ gitea_federation_share_user_stats | ternary('true', 'false') }} +{{ gitea_federation_extra }} +; +; +; Packages (packages) +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#packages-packages +[packages] +ENABLED = {{ gitea_packages_enabled | ternary('true', 'false') }} +{% if gitea_packages_enabled | bool %} +CHUNKED_UPLOAD_PATH = {{ gitea_home }}/data/tmp/package-upload +{{ gitea_packages_extra }} +{% endif %} +; +; +{% if gitea_lfs_server_enabled | bool %} +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#lfs-lfs +[lfs] +STORAGE_TYPE = {{ gitea_lfs_storage_type }} +SERVE_DIRECT = {{ gitea_lfs_serve_direct | ternary('true', 'false') }} +PATH = {{ gitea_lfs_content_path }} +{{ gitea_lfs_extra }} +{% endif %} +; +; +; Other (other) +; -> https://docs.gitea.io/en-us/config-cheat-sheet/#other-other +[other] +SHOW_FOOTER_BRANDING = {{ gitea_other_show_footer_branding | ternary('true', 'false') }} +SHOW_FOOTER_VERSION = {{ gitea_other_show_footer_version | ternary('true', 'false') }} +SHOW_FOOTER_TEMPLATE_LOAD_TIME = {{ gitea_other_show_footer_template_load_time | ternary('true', 'false') }} +ENABLE_SITEMAP = {{ gitea_other_enable_sitemap | ternary('true', 'false') }} +ENABLE_FEED = {{ gitea_other_enable_feed | ternary('true', 'false') }} +; +; +; +; Optional additional config +{{ gitea_extra_config }} diff --git a/roles/tmaurice.gitea/templates/gitea.service.j2 b/roles/l3d.gitea/templates/gitea.service.j2 similarity index 62% rename from roles/tmaurice.gitea/templates/gitea.service.j2 rename to roles/l3d.gitea/templates/gitea.service.j2 index 0dd69a50..1db7f852 100644 --- a/roles/tmaurice.gitea/templates/gitea.service.j2 +++ b/roles/l3d.gitea/templates/gitea.service.j2 @@ -1,11 +1,11 @@ [Unit] -Description=Gitea git server +Description={{ gitea_fork }} git server After=network.target [Service] User={{ gitea_user }} Group={{ gitea_group }} -ExecStart=/usr/local/bin/gitea web -c /etc/gitea/gitea.ini +ExecStart={{ gitea_full_executable_path }} web -c {{ gitea_configuraion_path }}/gitea.ini --custom-path {{ gitea_custom }}/ Restart=on-failure WorkingDirectory={{ gitea_home }} {% if gitea_systemd_cap_net_bind_service %} diff --git a/roles/tmaurice.gitea/vars/debian.yml b/roles/l3d.gitea/vars/debian.yml similarity index 100% rename from roles/tmaurice.gitea/vars/debian.yml rename to roles/l3d.gitea/vars/debian.yml diff --git a/roles/l3d.gitea/vars/fork_forgejo.yml b/roles/l3d.gitea/vars/fork_forgejo.yml new file mode 100644 index 00000000..2ac68039 --- /dev/null +++ b/roles/l3d.gitea/vars/fork_forgejo.yml @@ -0,0 +1,7 @@ +--- +# set filenames for forgejo +gitea_full_executable_path: "{{ gitea_forgejo_executable_path }}" +gitea_filename: "forgejo-{{ gitea_version_target }}-linux-{{ gitea_arch }}" +gitea_forgejo_query_download: "assets[?name==`{{ gitea_filename }}`].browser_download_url" +gitea_forgejo_query_checksum: "assets[?name==`{{ gitea_filename }}.sha256`].browser_download_url" +gitea_forgejo_query_signed: "assets[?name==`{{ gitea_filename }}.asc`].browser_download_url" diff --git a/roles/l3d.gitea/vars/fork_gitea.yml b/roles/l3d.gitea/vars/fork_gitea.yml new file mode 100644 index 00000000..607bfd8e --- /dev/null +++ b/roles/l3d.gitea/vars/fork_gitea.yml @@ -0,0 +1,4 @@ +--- +# set filenames for gitea +gitea_full_executable_path: "{{ gitea_executable_path }}" +gitea_filename: "gitea-{{ gitea_version_target }}.linux-{{ gitea_arch }}" diff --git a/roles/l3d.gitea/vars/main.yml b/roles/l3d.gitea/vars/main.yml new file mode 100644 index 00000000..a73b6536 --- /dev/null +++ b/roles/l3d.gitea/vars/main.yml @@ -0,0 +1,66 @@ +--- +gitea_go_arch_map: + i386: '386' + x86_64: 'amd64' + aarch64: 'arm64' + armv7l: 'arm-6' + armv6l: 'arm-6' + armv5l: 'arm-5' + +gitea_arch: "{{ gitea_go_arch_map[ansible_architecture] | default(ansible_architecture) }}" +gitea_supported_forks: 'gitea and forgejo' + +gitea_fork_variables: + files: + - "fork_{{ gitea_fork | lower }}.yml" + paths: + - 'vars' + +gitea_variables: + files: + - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yml" + - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yml" + - "{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yml" + - "{{ ansible_distribution | lower }}.yml" + - "{{ ansible_os_family | lower }}.yml" + paths: + - 'vars' + +transfer_custom_logo_logosvg: + files: + - "{{ gitea_custom_search }}/gitea_logo/logo.svg" + - "files/{{ inventory_hostname }}/gitea_logo/logo.svg" + - "files/{{ gitea_http_domain }}/gitea_logo/logo.svg" + - 'files/gitea_logo/logo.svg' + +transfer_custom_logo_logopng: + files: + - "{{ gitea_custom_search }}/gitea_logo/logo.png" + - "files/{{ inventory_hostname }}/gitea_logo/logo.png" + - "files/{{ gitea_http_domain }}/gitea_logo/logo.png" + - 'files/gitea_logo/logo.png' + +transfer_custom_logo_faviconpng: + files: + - "{{ gitea_custom_search }}/gitea_logo/favicon.png" + - "files/{{ inventory_hostname }}/gitea_logo/favicon.png" + - "files/{{ gitea_http_domain }}/gitea_logo/favicon.png" + - 'files/gitea_logo/favicon.png' + +transfer_custom_logo_appletouchiconpng: + files: + - "{{ gitea_custom_search }}/gitea_logo/apple-touch-icon.png" + - "files/{{ inventory_hostname }}/gitea_logo/apple-touch-icon.png" + - "files/{{ gitea_http_domain }}/gitea_logo/apple-touch-icon.png" + - 'files/gitea_logo/apple-touch-icon.png' + +transfer_custom_footer: + files: + - "{{ gitea_custom_search }}/gitea_footer/extra_links_footer.tmpl" + - "files/{{ inventory_hostname }}/gitea_footer/extra_links_footer.tmpl" + - "files/{{ gitea_http_domain }}/gitea_footer/extra_links_footer.tmpl" + - 'files/gitea_footer/extra_links_footer.tmpl' + - 'files/extra_links_footer.tmpl' + +playbook_version_number: 44 # should be int +playbook_version_path: 'do1jlr.gitea.version' diff --git a/roles/tmaurice.gitea/vars/redhat.yml b/roles/l3d.gitea/vars/redhat.yml similarity index 100% rename from roles/tmaurice.gitea/vars/redhat.yml rename to roles/l3d.gitea/vars/redhat.yml diff --git a/roles/tmaurice.gitea/.ansible-lint b/roles/tmaurice.gitea/.ansible-lint deleted file mode 100644 index a48e52d5..00000000 --- a/roles/tmaurice.gitea/.ansible-lint +++ /dev/null @@ -1,9 +0,0 @@ -use_default_rules: true - -exclude_paths: - - venv/ - - molecule/default/ - - tests/ - -#skip_list: -# - '301' diff --git a/roles/tmaurice.gitea/.github/workflows/ansible-linting-check.yml b/roles/tmaurice.gitea/.github/workflows/ansible-linting-check.yml deleted file mode 100644 index 41dcb97c..00000000 --- a/roles/tmaurice.gitea/.github/workflows/ansible-linting-check.yml +++ /dev/null @@ -1,22 +0,0 @@ ---- -name: Ansible Lint check - -# yamllint disable-line rule:truthy -on: [push, pull_request] - -jobs: - build: - - runs-on: ubuntu-latest - - steps: - - uses: actions/checkout@v2 - - - name: Lint Ansible Playbook - uses: ansible/ansible-lint-action@master - with: - targets: "." - # [required] - # Paths to ansible files (i.e., playbooks, tasks, handlers etc..) - args: "" - # [optional] diff --git a/roles/tmaurice.gitea/.travis.yml b/roles/tmaurice.gitea/.travis.yml deleted file mode 100644 index 62da97ca..00000000 --- a/roles/tmaurice.gitea/.travis.yml +++ /dev/null @@ -1,27 +0,0 @@ ---- -language: python -python: - - "3.7" - -env: - matrix: - - MOLECULE_DISTRO: centos8 - - MOLECULE_DISTRO: centos7 - - MOLECULE_DISTRO: ubuntu2004 - - MOLECULE_DISTRO: ubuntu1804 - - MOLECULE_DISTRO: ubuntu1604 - - MOLECULE_DISTRO: debian10 - - MOLECULE_DISTRO: debian9 - - MOLECULE_DISTRO: fedora33 - -services: - - docker - -install: - - python -m pip -q install -r requirements-travis.txt - -script: - - molecule test - -notifications: - webhooks: https://galaxy.ansible.com/api/v1/notifications/ diff --git a/roles/tmaurice.gitea/.yamllint b/roles/tmaurice.gitea/.yamllint deleted file mode 100644 index 16fff787..00000000 --- a/roles/tmaurice.gitea/.yamllint +++ /dev/null @@ -1,12 +0,0 @@ ---- -extends: default - -rules: - line-length: - max: 100 - level: warning - -ignore: | - /venv/ - /env/ - /molecule/ diff --git a/roles/tmaurice.gitea/LICENSE b/roles/tmaurice.gitea/LICENSE deleted file mode 100644 index 195ba202..00000000 --- a/roles/tmaurice.gitea/LICENSE +++ /dev/null @@ -1,11 +0,0 @@ -Copyright 2019-present Thomas Maurice - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - -1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - -2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - -3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. \ No newline at end of file diff --git a/roles/tmaurice.gitea/README.md b/roles/tmaurice.gitea/README.md deleted file mode 100644 index d28a54ef..00000000 --- a/roles/tmaurice.gitea/README.md +++ /dev/null @@ -1,207 +0,0 @@ -# Ansible role gitea - Install a gitea server -[![Build Status](https://travis-ci.org/thomas-maurice/ansible-role-gitea.svg?branch=master)](https://travis-ci.org/thomas-maurice/ansible-role-gitea) -![Ansible Role](https://img.shields.io/ansible/role/38779) -![Ansible Role](https://img.shields.io/ansible/role/d/38779) -![Ansible Quality Score](https://img.shields.io/ansible/quality/38779) - -This role installs and manages a [gitea](https://gitea.io) server - -[Source code & screenshots](https://github.com/go-gitea/gitea). - -Gitea is a Golang Git repository webapp, having the same look and feel as GitHub. - -## Sample example of use in a playbook - -The following code has been tested with Debian 8, it should work on Ubuntu as well. - -```yaml -- name: "Install gitea" - hosts: all - vars: - gitea_user: "gitea" - gitea_home: "/var/lib/gitea" - # To limit your users to 30 repos - gitea_user_repo_limit: 30 - # Don't use a public CDN for frontend assets - gitea_offline_mode: true - - # Some 'rendering' options for your URLs - gitea_http_domain: git.yourdomain.fr - gitea_root_url: https://git.yourdomain.fr - - # Here we assume we are behind a reverse proxy that will - # handle https for us, so we bind on localhost:3000 using HTTP - gitea_protocol: http - gitea_http_listen: 127.0.0.1 - gitea_http_port: 3000 - - # SSH server configuration - gitea_ssh_listen: 0.0.0.0 - gitea_ssh_port: 2222 - # For URLs rendering again - gitea_ssh_domain: git.yourdomain.fr - gitea_start_ssh: true - - gitea_secret_key: 3sp00ky5me - gitea_disable_gravatar: true - # To make at least your first user register - gitea_disable_registration: false - gitea_require_signin: true - gitea_enable_captcha: true - - gitea_show_user_email: false - roles: - - gitea -``` - -## More detailed options -### General - -* `gitea_version_check`: Check if installed version != `gitea_version` before initiating binary download -* `gitea_user`: UNIX user used by Gitea -* `gitea_group`: UNIX group used by Gitea -* `gitea_home`: Base directory to work -* `gitea_dl_url`: The URL, the compiled gitea-binary will be downloaded from -* `gitea_systemd_cap_net_bind_service`: Adds `AmbientCapabilities=CAP_NET_BIND_SERVICE` to systemd service file -* `gitea_extra_config`: Additional configuration - -### Look and feel - -* `gitea_app_name`: Displayed application name -* `gitea_show_user_email`: Do you want to display email addresses ? (true/false) -* `gitea_disable_gravatar`: Do you want to disable Gravatar ? (privacy and so on) (true/false) -* `gitea_offline_mode`: Same but for disabling CDNs for frontend assets (true/false) -* `gitea_disable_registration`: Do you want to disable user registration ? (true/false) -* `gitea_only_allow_external_registration`: Do you want to force registration only using third-party services ? (true/false) -* `gitea_show_registration_button`: Do you want to show the registration button? (true/false) -* `gitea_require_signin`: Do you require a signin to see repo's (even public ones) ? (true/false) -* `gitea_enable_captcha`: Do you want to enable captcha's ? (true/false) -* `gitea_themes`: List of enabled themes -* `gitea_theme_default`: Default theme - -### Security -* `gitea_secret_key`: Cookie secret key -* `gitea_internal_token`: Internal API token -* `gitea_disable_git_hooks`: Do you want to disable the interface to add git hooks? If enabled it could be a security bug as it can be used for RCE. Defaults to true (true/false) - -### Limits - -* `gitea_user_repo_limit`: Limit how many repos a user can have (-1 for unlimited) - -### HTTP configuration - -* `gitea_http_domain`: HTTP domain (displayed in your clone URLs, just the domain like git.foo.fr) -* `gitea_root_url`: Root URL used to access your web app (full URL) -* `gitea_protocol`: Listening protocol (http/https) -* `gitea_http_listen`: Bind address -* `gitea_http_port`: Bind port -* `gitea_disable_http_git`: Disable the use of Git over HTTP ? (true/false) - -### SSH configuration - -* `gitea_ssh_listen`: Bind address for the SSH server -* `gitea_ssh_domain`: SSH domain (displayed in your clone URLs) -* `gitea_start_ssh`: Do you want to start a built-in SSH server ? (true/false) -* `gitea_ssh_port`: SSH bind port - -### Database configuration - -* `gitea_db_type`: Database type, can be `mysql`, `postgres` or `sqlite3` -* `gitea_db_host`: Database host string `host:port` or `/run/postgresql/` when connectiong to postgres via local unix socket (peer authentication) -* `gitea_db_name`: Database name -* `gitea_db_user`: Database username -* `gitea_db_password`: Database password -* `gitea_db_ssl`: Use SSL ? (postgres only!). Can be `require`, `disable`, `verify-ca` or `verify-full` -* `gitea_db_path`: DB path, if you use `sqlite3`. The default is good enough to work though. - -### Mailer configuration - -* `gitea_mailer_enabled`: Whether to enable the mailer. Default: `false` -* `gitea_mailer_skip_verify`: Skip SMTP TLS certificate verification (true/false) -* `gitea_mailer_tls_enabled`: Enable TLS for SMTP connections (true/false) -* `gitea_mailer_host`: SMTP server hostname and port -* `gitea_mailer_user`: SMTP server username -* `gitea_mailer_password`: SMTP server password -* `gitea_mailer_from`: Sender mail address -* `gitea_enable_notify_mail`: Whether e-mail should be send to watchers of a repository when something happens. Default: `false` -* `gitea_mail_default`: Default configuration for email notifications for users (user configurable). Options: enabled, onmention, disable (Default: `onmention` ) -* `gitea_autowatch_new_repo`: Enable this to let all organisation users watch new repos when they are created (Default: `false`) -* `gitea_autowatch_on_change`: Enable this to make users watch a repository after their first commit to it (Default: `true`) -* `gitea_show_mailstones_dashboard`: Enable this to show the milestones dashboard page - a view of all the user’s milestones (Default: `true`) - -### Fail2Ban configuration - -If enabled, this will deploy a fail2ban filter and jail config for Gitea as described in the [Gitea Documentation](https://docs.gitea.io/en-us/fail2ban-setup/). - -As this will only deploy config files, fail2ban already has to be installed or otherwise the role will fail. - -* `gitea_fail2ban_enabled`: Whether to deploy the fail2ban config or not -* `gitea_fail2ban_jail_maxretry`: fail2ban jail `maxretry` setting. Default: `10` -* `gitea_fail2ban_jail_findtime`: fail2ban jail `findtime` setting. Default: `3600` -* `gitea_fail2ban_jail_bantime`: fail2ban jail `bantime` setting. Default: `900` -* `gitea_fail2ban_jail_action`: fail2ban jail `action` setting. Default: `iptables-allports` - -### Oauth2 provider configuration - -* `gitea_oauth2_enabled`: Enable the Oauth2 provider (true/false) -* `gitea_oauth2_jwt_secret`: Oauth2 JWT secret. Can be generated with ``gitea generate secret JWT_SECRET`` - -### GIT LFS configuration -* `gitea_lfs_enabled`: Enable GIT LFS (large filesystem) -* `gitea_lfs_mode`: should lfs be in offline mode (true/false) -* `gitea_lfs_secret`: JWT secret for remote LFS usage - -### Metrics endpoint configuration - -* `gitea_metrics_enabled`: Enable the metrics endpoint -* `gitea_metrics_token`: Bearer token for the Prometheus scrape job - -### Repository Indexer configuration - -* `gitea_repo_indexer_enabled`: Whether to enable the repository indexer (code search). Default: `false` -* `gitea_repo_indexer_include`: Glob patterns to include in the index (comma-separated list). Default: `""` (all files) -* `gitea_repo_indexer_exclude`: Glob patterns to exclude from the index (comma-separated list). Default: `""` (no files) -* `gitea_repo_exclude_vendored`: Exclude vendored files from the index. Default: `true` -* `gitea_repo_indexer_max_file_size`: Maximum size of files to be indexed (in bytes). Default: `1048576` (1 MB) - -### backup on upgrade -* `gitea_backup_on_upgrade`: Optionally a backup can be created with every update of gitea. Default: `false` -* `gitea_backup_location`: Where to store the gitea backup if one is created with this role. Default: `{{ gitea_home }}/backups/` - -## Contributing -Don't hesitate to create a pull request, and when in doubt you can reach me on -Twitter [@thomas_maurice](https://twitter.com/thomas_maurice). - -I'm happy to fix any issue that's been opened, or even better, review your pull requests :) - -## Testing -Testing uses [molecule](https://molecule.readthedocs.io/en/stable-1.22/usage.html). To start the -tests, install the dependencies first. I would recommend you use [a virtual env](https://virtualenv.pypa.io/en/latest/) for that but who am I to tell you what to do. - -``` -pip install pew # install pew to manage the venvs -pew new ansible # create the venv -pip install -r requirements-travis.txt # install the requirements -molecule test # Run the actual tests -``` - -Note: you need Docker installed - -### Known testing limitations -Currently it's mainly validating that the playbook runs, the lint is ok, and that kind of things. -Since it runs in Docker, we currently have no way to check if the service is actually launched by systemd -and so on. This has to be worked on. - -## License -``` -Copyright 2019-present Thomas Maurice - -Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: - -1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. - -2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. - -3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. - -THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. -``` diff --git a/roles/tmaurice.gitea/defaults/main.yml b/roles/tmaurice.gitea/defaults/main.yml deleted file mode 100644 index 4a1e0361..00000000 --- a/roles/tmaurice.gitea/defaults/main.yml +++ /dev/null @@ -1,99 +0,0 @@ ---- -gitea_version: "1.13.7" -gitea_version_check: true -gitea_dl_url: "https://github.com/go-gitea/gitea/releases/download/v{{ gitea_version }}/gitea-{{ gitea_version }}-linux-{{ gitea_arch }}" -gitea_gpg_key: "7C9E68152594688862D62AF62D9AE806EC1592E2" -gitea_gpg_server: "hkps://keys.openpgp.org" - -gitea_app_name: "Gitea" -gitea_user: "gitea" -gitea_group: "gitea" -gitea_home: "/var/lib/gitea" -gitea_shell: "/bin/false" -gitea_systemd_cap_net_bind_service: false - -gitea_repository_root: "{{ gitea_home }}" -gitea_user_repo_limit: -1 - -gitea_http_domain: localhost -gitea_root_url: http://localhost:3000 -gitea_protocol: http -gitea_http_listen: 127.0.0.1 -gitea_http_port: 3000 -gitea_disable_http_git: false -gitea_offline_mode: true - -gitea_lfs_server_enabled: false -gitea_lfs_content_path: "{{ gitea_home }}/data/lfs" -gitea_lfs_jwt_secret: '' -gitea_lfs_secret: SomethingVeryLong -gitea_lfs_mode: true - -gitea_db_type: sqlite3 -gitea_db_host: 127.0.0.0:3306 -gitea_db_name: root -gitea_db_user: gitea -gitea_db_password: lel -gitea_db_ssl: disable -gitea_db_path: "{{ gitea_home }}/data/gitea.db" - -gitea_ssh_listen: 0.0.0.0 -gitea_ssh_domain: localhost -gitea_start_ssh: true -gitea_ssh_port: 2222 - -gitea_secret_key: T0pS3cr31 -gitea_internal_token: SomethingVeryLong -gitea_disable_git_hooks: true - -gitea_show_user_email: false -gitea_disable_gravatar: true -gitea_disable_registration: false -gitea_show_registration_button: true -gitea_require_signin: true -gitea_enable_captcha: true -gitea_only_allow_external_registration: false -gitea_enable_notify_mail: false -gitea_mail_default: onmention -gitea_autowatch_new_repo: false -gitea_autowatch_on_change: true -gitea_show_mailstones_dashboard: true - -gitea_force_private: false - -gitea_mailer_enabled: false -gitea_mailer_skip_verify: false -gitea_mailer_tls_enabled: true -gitea_mailer_host: localhost:25 -gitea_mailer_from: noreply@your.domain -gitea_mailer_user: "" -gitea_mailer_password: "" -gitea_mailer_type: smtp - -gitea_fail2ban_enabled: false -gitea_fail2ban_jail_maxretry: 10 -gitea_fail2ban_jail_findtime: 3600 -gitea_fail2ban_jail_bantime: 900 -gitea_fail2ban_jail_action: iptables-allports - -gitea_oauth2_enabled: true -gitea_oauth2_jwt_secret: '' - -gitea_metrics_enabled: false -gitea_metrics_token: ~ - -gitea_themes: gitea,arc-green -gitea_theme_default: gitea - -gitea_repo_indexer_enabled: false -gitea_repo_indexer_include: "" -gitea_repo_indexer_exclude: "" -gitea_repo_exclude_vendored: true -gitea_repo_indexer_max_file_size: 1048576 - -gitea_log_level: Info - -gitea_extra_config: "" - -gitea_backup_on_upgrade: false -gitea_backup_location: "{{ gitea_home }}/backups/" diff --git a/roles/tmaurice.gitea/meta/main.yml b/roles/tmaurice.gitea/meta/main.yml deleted file mode 100644 index efe1a1ee..00000000 --- a/roles/tmaurice.gitea/meta/main.yml +++ /dev/null @@ -1,32 +0,0 @@ ---- -galaxy_info: - author: Thomas Maurice - description: Ansible Role - Gitea - min_ansible_version: 2.10 - license: BSD-3-Clause - galaxy_tags: - - git - - gitea - - system - - development - - sourcecontrol - - selfhosted - - gitserver - - gogs - platforms: - - name: Debian - versions: - - stretch - - buster - - name: Ubuntu - versions: - - xenial - - bionic - - focal - - name: CentOS - versions: - - 7 - - 8 - - name: Fedora - versions: - - 33 diff --git a/roles/tmaurice.gitea/molecule/default/converge.yml b/roles/tmaurice.gitea/molecule/default/converge.yml deleted file mode 100644 index 828005f3..00000000 --- a/roles/tmaurice.gitea/molecule/default/converge.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -- name: Converge - hosts: all - become: true - roles: - - ansible-role-gitea - vars: - gitea_http_domain: localhost - gitea_root_url: http://localhost diff --git a/roles/tmaurice.gitea/molecule/default/molecule.yml b/roles/tmaurice.gitea/molecule/default/molecule.yml deleted file mode 100644 index c72fc04b..00000000 --- a/roles/tmaurice.gitea/molecule/default/molecule.yml +++ /dev/null @@ -1,43 +0,0 @@ ---- -dependency: - name: galaxy - -driver: - name: docker - -lint: | - set -e - yamllint . - ansible-lint - -platforms: - - name: instance - image: geerlingguy/docker-${MOLECULE_DISTRO:-ubuntu1804}-ansible:latest - pre_build_image: true - command: ${MOLECULE_DOCKER_COMMAND:-""} - volumes: - - /sys/fs/cgroup:/sys/fs/cgroup:ro - privileged: true - - -provisioner: - name: ansible - playbooks: - prepare: prepare.yml - converge: converge.yml - -scenario: - test_sequence: - - lint - - destroy - - syntax - - create - - prepare - - converge - - verify - - destroy - -verifier: - name: testinfra - lint: - name: flake8 diff --git a/roles/tmaurice.gitea/molecule/default/prepare.yml b/roles/tmaurice.gitea/molecule/default/prepare.yml deleted file mode 100644 index 4c3c05aa..00000000 --- a/roles/tmaurice.gitea/molecule/default/prepare.yml +++ /dev/null @@ -1,27 +0,0 @@ ---- -- name: Prepare - hosts: all - become: true - tasks: - - name: install dependencies for gitea (RedHat based systems) - yum: - name: "{{ redhat_packages }}" - state: present - update_cache: true - when: ansible_os_family == "RedHat" - - name: install dependencies for gitea (Debian based systems) - apt: - name: "{{ debian_packages }}" - state: present - update_cache: true - when: ansible_os_family == "Debian" - - vars: - debian_packages: - - git - - curl - - xz-utils - redhat_packages: - - git - - curl - - xz diff --git a/roles/tmaurice.gitea/molecule/default/tests/test_default.py b/roles/tmaurice.gitea/molecule/default/tests/test_default.py deleted file mode 100644 index bc93aa15..00000000 --- a/roles/tmaurice.gitea/molecule/default/tests/test_default.py +++ /dev/null @@ -1,25 +0,0 @@ -import os -import testinfra.utils.ansible_runner - -testinfra_hosts = testinfra.utils.ansible_runner.AnsibleRunner( - os.environ['MOLECULE_INVENTORY_FILE']).get_hosts('all') - - -def test_gitea_binary(host): - gitea_bin = host.file('/usr/local/bin/gitea') - assert gitea_bin.exists - assert gitea_bin.user == 'root' - assert gitea_bin.group == 'root' - -def test_gitea_config_file(host): - gitea_config = host.file('/etc/gitea/gitea.ini') - assert gitea_config.exists - assert gitea_config.mode == 0o600 - -def test_gitea_service_running(host): - gitea = host.service('gitea') - assert gitea.is_running - -def test_gitea_reachable(host): - gitea_http = host.run('curl http://localhost:3000') - assert gitea_http.rc == 0 diff --git a/roles/tmaurice.gitea/requirements-travis.txt b/roles/tmaurice.gitea/requirements-travis.txt deleted file mode 100644 index ec56812e..00000000 --- a/roles/tmaurice.gitea/requirements-travis.txt +++ /dev/null @@ -1,66 +0,0 @@ -ansible==2.10.7 -ansible-lint==4.2.0 -anyconfig==0.9.7 -arrow==0.15.5 -asn1crypto==0.24.0 -binaryornot==0.4.4 -Cerberus==1.3.2 -certifi==2020.12.5 -cffi==1.14.4 -chardet==4.0.0 -click==7.1.2 -click-completion==0.5.2 -click-help-colors==0.9 -colorama==0.4.4 -cookiecutter==1.7.2 -cryptography==3.3.1 -cryptography==3.3.2 -docker==4.4.1 -docker-pycreds==0.4.0 -entrypoints==0.3 -fasteners==0.15 -flake8==3.7.7 -future==0.18.2 -git-url-parse==1.2.1 -idna==2.9 -importlib-metadata==1.6.0 -Jinja2==2.11.3 -jinja2-time==0.2.0 -MarkupSafe==1.1.1 -mccabe==0.6.1 -molecule==3.0.3 -monotonic==1.5 -more-itertools==8.6.0 -paramiko==2.7.2 -pathspec==0.8.1 -pbr==5.5.1 -pexpect==4.8.0 -pi==0.1.2 -pluggy==0.13.1 -poyo==0.5.0 -psutil==5.6.6 -ptyprocess==0.6.0 -py==1.10.0 -pyasn1==0.4.5 -pycodestyle==2.5.0 -pycparser==2.20 -pyflakes==2.1.1 -PyNaCl==1.3.0 -pytest==4.3.1 -python-dateutil==2.8.1 -python-gilt==1.2.3 -PyYAML==5.4 -requests==2.23.0 -ruamel.yaml==0.16.10 -ruamel.yaml.clib==0.2.0 -sh==1.12.14 -shellingham==1.3.2 -six==1.14.0 -tabulate==0.8.7 -testinfra==6.0.0 -tree-format==0.1.2 -urllib3==1.26.5 -websocket-client==0.57.0 -whichcraft==0.6.1 -yamllint==1.26.0 -zipp==3.4.0 diff --git a/roles/tmaurice.gitea/tasks/backup.yml b/roles/tmaurice.gitea/tasks/backup.yml deleted file mode 100644 index fa8e9abc..00000000 --- a/roles/tmaurice.gitea/tasks/backup.yml +++ /dev/null @@ -1,30 +0,0 @@ ---- -- name: Get service facts - service_facts: - -- block: - - name: Stopping gitea before upgrade - service: - name: gitea - state: stopped - - - name: "Create backup directory" - file: - path: "{{ item }}" - state: directory - owner: "{{ gitea_user }}" - group: "{{ gitea_group }}" - mode: 'u=rwx,g=rx,o=' - with_items: - - "{{ gitea_backup_location }}" - - - name: Backing up gitea before upgrade - command: - cmd: "/usr/local/bin/gitea dump -c /etc/gitea/gitea.ini" - chdir: "{{ gitea_backup_location }}" - become: true - become_user: "{{ gitea_user }}" - when: - - ansible_facts.services["gitea.service"] is defined - - ansible_facts.services["gitea.service"].state == "running" - - gitea_active_version.stdout != gitea_version diff --git a/roles/tmaurice.gitea/tasks/create_user.yml b/roles/tmaurice.gitea/tasks/create_user.yml deleted file mode 100644 index f962229d..00000000 --- a/roles/tmaurice.gitea/tasks/create_user.yml +++ /dev/null @@ -1,14 +0,0 @@ ---- -- name: "Create Gitea Group" - group: - name: "{{ gitea_group }}" - system: true - state: "present" - -- name: "Create Gitea user" - ansible.builtin.user: - name: "{{ gitea_user }}" - comment: "Gitea user" - home: "{{ gitea_home }}" - shell: "{{ gitea_shell }}" - system: true diff --git a/roles/tmaurice.gitea/tasks/jwt_secrets.yml b/roles/tmaurice.gitea/tasks/jwt_secrets.yml deleted file mode 100644 index ca334c73..00000000 --- a/roles/tmaurice.gitea/tasks/jwt_secrets.yml +++ /dev/null @@ -1,38 +0,0 @@ ---- -- name: generate OAuth2 JWT_SECRET if not provided - become: true - shell: 'umask 077; /usr/local/bin/gitea generate secret JWT_SECRET > /etc/gitea/gitea_oauth_jwt_secret' - args: - creates: '/etc/gitea/gitea_oauth_jwt_secret' - when: gitea_oauth2_jwt_secret | length == 0 - -- name: read OAuth2 JWT_SECRET from file - become: true - slurp: - src: '/etc/gitea/gitea_oauth_jwt_secret' - register: oauth_jwt_secret - when: gitea_oauth2_jwt_secret | length == 0 - -- name: set fact gitea_oauth2_jwt_secret - set_fact: - gitea_oauth2_jwt_secret: "{{ oauth_jwt_secret['content'] | b64decode }}" - when: gitea_oauth2_jwt_secret | length == 0 - -- name: generate LFS JWT_SECRET if not provided - become: true - shell: 'umask 077; /usr/local/bin/gitea generate secret JWT_SECRET > /etc/gitea/gitea_lfs_jwt_secret' - args: - creates: '/etc/gitea/gitea_lfs_jwt_secret' - when: gitea_lfs_jwt_secret | length == 0 - -- name: read LFS JWT_SECRET from file - become: true - slurp: - src: '/etc/gitea/gitea_lfs_jwt_secret' - register: lfs_jwt_secret - when: gitea_lfs_jwt_secret | length == 0 - -- name: set fact gitea_lfs_jwt_secret - set_fact: - gitea_lfs_jwt_secret: "{{ lfs_jwt_secret['content'] | b64decode }}" - when: gitea_lfs_jwt_secret | length == 0 diff --git a/roles/tmaurice.gitea/tasks/main.yml b/roles/tmaurice.gitea/tasks/main.yml deleted file mode 100644 index ad36b7d9..00000000 --- a/roles/tmaurice.gitea/tasks/main.yml +++ /dev/null @@ -1,96 +0,0 @@ ---- -- name: Gather variables for each operating system - include_vars: "{{ item }}" - with_first_found: - - "{{ ansible_distribution | lower }}-{{ ansible_distribution_version | lower }}.yml" - - "{{ ansible_distribution | lower }}-{{ ansible_distribution_major_version | lower }}.yml" - - "{{ ansible_os_family | lower }}-{{ ansible_distribution_major_version | lower }}.yml" - - "{{ ansible_distribution | lower }}.yml" - - "{{ ansible_os_family | lower }}.yml" - -- name: Gather installed packages for checks in the role (fail2ban) - ansible.builtin.package_facts: - manager: auto - -- name: "Check gitea version" - ansible.builtin.shell: "set -eo pipefail; /usr/local/bin/gitea -v | cut -d' ' -f 3" - args: - executable: /bin/bash - register: gitea_active_version - changed_when: false - failed_when: false - when: gitea_version_check|bool - -- name: "Download the binary" - ansible.builtin.get_url: - url: "{{ gitea_dl_url }}" - dest: /usr/local/bin/gitea - owner: root - group: root - mode: 0755 - force: true - notify: "Restart gitea" - when: (not gitea_version_check|bool) or (not ansible_check_mode and (gitea_active_version.stdout != gitea_version)) - -- include_tasks: - file: create_user.yml - -- name: "Create config and data directory" - ansible.builtin.file: - path: "{{ item }}" - state: directory - owner: "{{ gitea_user }}" - group: "{{ gitea_group }}" - mode: '0755' - with_items: - - "/etc/gitea" - -- name: "Create data directory" - file: - path: "{{ item }}" - state: directory - owner: "{{ gitea_user }}" - group: "{{ gitea_group }}" - mode: 'u=rwX,g=rX,o=' - recurse: true - with_items: - - "{{ gitea_home }}" - - "{{ gitea_home }}/data" - - "{{ gitea_home }}/custom" - - "{{ gitea_home }}/custom/https" - - "{{ gitea_home }}/custom/mailer" - - "{{ gitea_home }}/indexers" - - "{{ gitea_home }}/log" - - "{{ gitea_repository_root }}" - -- include_tasks: - file: install_systemd.yml - when: ansible_service_mgr == "systemd" - -- include_tasks: - file: jwt_secrets.yml - -- name: 'Install git' - ansible.builtin.package: - name: 'git' - state: 'present' - -- name: "Configure gitea" - ansible.builtin.template: - src: gitea.ini.j2 - dest: /etc/gitea/gitea.ini - owner: "{{ gitea_user }}" - group: "{{ gitea_group }}" - mode: 0600 - notify: "Restart gitea" - -- name: "Service gitea" - ansible.builtin.service: - name: gitea - state: started - enabled: true - when: ansible_service_mgr == "systemd" - -- include_tasks: - file: fail2ban.yml - when: gitea_fail2ban_enabled|bool diff --git a/roles/tmaurice.gitea/templates/fail2ban/filter.conf.j2 b/roles/tmaurice.gitea/templates/fail2ban/filter.conf.j2 deleted file mode 100644 index 6fd9eee9..00000000 --- a/roles/tmaurice.gitea/templates/fail2ban/filter.conf.j2 +++ /dev/null @@ -1,4 +0,0 @@ -# Managed by Ansible -[Definition] -failregex = .*Failed authentication attempt for .* from -ignoreregex = diff --git a/roles/tmaurice.gitea/templates/gitea.ini.j2 b/roles/tmaurice.gitea/templates/gitea.ini.j2 deleted file mode 100644 index 11e06c03..00000000 --- a/roles/tmaurice.gitea/templates/gitea.ini.j2 +++ /dev/null @@ -1,198 +0,0 @@ -; this file is the configuration of your local gitea instance -; {{ ansible_managed }} -; -; This file overwrites the default values from gitea. -; undefined variables will use the default value from gitea. -; Cheat Sheet: https://docs.gitea.io/en-us/config-cheat-sheet/ -; -; App name that shows on every page title -APP_NAME = {{ gitea_app_name }} -; Change it if you run locally -RUN_USER = {{ gitea_user }} -; Either "dev", "prod" or "test", default is "dev" -RUN_MODE = prod - -[repository] -ROOT = {{ gitea_repository_root }} -; Force every new repository to be private -FORCE_PRIVATE = {{ gitea_force_private | ternary('true', 'false') }} -; Global limit of repositories per user, applied at creation time. -1 means no limit -MAX_CREATION_LIMIT = {{ gitea_user_repo_limit }} -; Mirror sync queue length, increase if mirror syncing starts hanging -MIRROR_QUEUE_LENGTH = 1000 -; Disable the ability to interact with repositories using the HTTP protocol -DISABLE_HTTP_GIT = {{ gitea_disable_http_git | ternary('true', 'false') }} - -[ui] -; Whether the email of the user should be shown in the Explore Users page -SHOW_USER_EMAIL = {{ gitea_show_user_email | ternary('true', 'false') }} -THEMES = {{ gitea_themes }} -DEFAULT_THEME = {{ gitea_theme_default }} - -[server] -; The protocol the server listens on. One of 'http', 'https', 'unix' or 'fcgi'. -PROTOCOL = {{ gitea_protocol }} -DOMAIN = {{ gitea_http_domain }} -ROOT_URL = {{ gitea_root_url }} -; The address to listen on. Either a IPv4/IPv6 address or the path to a unix socket. -HTTP_ADDR = {{ gitea_http_listen }} -HTTP_PORT = {{ gitea_http_port }} -; Disable SSH feature when not available -DISABLE_SSH = false -; Whether to use the builtin SSH server or not. -START_SSH_SERVER = {{ gitea_start_ssh | ternary('true', 'false') }} -; Domain name to be exposed in clone URL -SSH_DOMAIN = {{ gitea_ssh_domain }} -; The network interface the builtin SSH server should listen on -SSH_LISTEN_HOST = {{ gitea_ssh_listen }} -; Port number to be exposed in clone URL -SSH_PORT = {{ gitea_ssh_port }} -; The port number the builtin SSH server should listen on -SSH_LISTEN_PORT = %(SSH_PORT)s -; Disable CDN even in "prod" mode -OFFLINE_MODE = {{ gitea_offline_mode | ternary('true', 'false') }} -; Default path for App data -APP_DATA_PATH = {{ gitea_home }}/data -{% if gitea_lfs_server_enabled | bool -%} -;Enables git-lfs support. -LFS_START_SERVER = true -; Where to store LFS files. -LFS_CONTENT_PATH = {{ gitea_lfs_content_path }} -; LFS authentication secret -LFS_JWT_SECRET = {{ gitea_lfs_jwt_secret }} -LFS_CONTENT_PATH = {{ gitea_lfs_content_path }} -; if the LFS sotre is not offline/local -LFS_JWT_SECRET = {{ gitea_lfs_secret }} -OFFLINE_MODE = {{ gitea_lfs_mode }} -{% endif %} -[database] -; Either "mysql", "postgres", "mssql" or "sqlite3", it's your choice -DB_TYPE = {{ gitea_db_type }} -HOST = {{ gitea_db_host }} -NAME = {{ gitea_db_name }} -USER = {{ gitea_db_user }} -; Use PASSWD = `your password` for quoting if you use special characters in the password. -PASSWD = {{ gitea_db_password }} -; For Postgres, either "disable" (default), "require", "verify-ca" or "verify-full" -; For MySQL, either "false" (default), "true", or "skip-verify" -SSL_MODE = {{ gitea_db_ssl }} -; For "sqlite3" and "tidb", use an absolute path when you start gitea as service -PATH = {{ gitea_db_path }} - -[indexer] -; Issue indexer storage path, available when ISSUE_INDEXER_TYPE is bleve -ISSUE_INDEXER_PATH = {{ gitea_home }}/indexers/issues.bleve -; Issue indexer queue, currently support: channel or levelqueue, default is levelqueue -ISSUE_INDEXER_QUEUE_TYPE = levelqueue -; When ISSUE_INDEXER_QUEUE_TYPE is levelqueue, this will be the queue will be saved path, -; default is indexers/issues.queue -ISSUE_INDEXER_QUEUE_DIR = {{ gitea_home }}/indexers/issues.queue -; repo indexer by default disabled, since it uses a lot of disk space -REPO_INDEXER_ENABLED = {{ gitea_repo_indexer_enabled }} -REPO_INDEXER_PATH = {{ gitea_home }}/indexers/repos.bleve -REPO_INDEXER_INCLUDE = {{ gitea_repo_indexer_include }} -REPO_INDEXER_EXCLUDE = {{ gitea_repo_indexer_exclude }} -REPO_INDEXER_EXCLUDE_VENDORED = {{ gitea_repo_exclude_vendored }} -MAX_FILE_SIZE = {{ gitea_repo_indexer_max_file_size }} - -[security] -; Whether the installer is disabled -INSTALL_LOCK = true -; !!CHANGE THIS TO KEEP YOUR USER DATA SAFE!! -SECRET_KEY = {{ gitea_secret_key }} -INTERNAL_TOKEN = {{ gitea_internal_token }} -; How long to remember that an user is logged in before requiring relogin (in days) -LOGIN_REMEMBER_DAYS = 7 -DISABLE_GIT_HOOKS = {{ gitea_disable_git_hooks | ternary('true', 'false') }} - -[service] -; Disallow registration, only allow admins to create accounts. -DISABLE_REGISTRATION = {{ gitea_disable_registration }} -; User must sign in to view anything. -REQUIRE_SIGNIN_VIEW = {{ gitea_require_signin | ternary('true', 'false') }} -; Enable captcha validation for registration -ENABLE_CAPTCHA = {{ gitea_enable_captcha | ternary('true', 'false') }} -; Type of captcha you want to use. Options: image, recaptcha -CAPTCHA_TYPE = image -; Enable recaptcha to use Google's recaptcha service -; Go to https://www.google.com/recaptcha/admin to sign up for a key -RECAPTCHA_SECRET = -RECAPTCHA_SITEKEY = -; Show Registration button -SHOW_REGISTRATION_BUTTON = {{ gitea_show_registration_button }} -ALLOW_ONLY_EXTERNAL_REGISTRATION = {{ gitea_only_allow_external_registration }} -ENABLE_NOTIFY_MAIL = {{ gitea_enable_notify_mail }} -DEFAULT_EMAIL_NOTIFICATIONS = {{ gitea_mail_default }} -AUTO_WATCH_NEW_REPOS = {{ gitea_autowatch_new_repo }} -AUTO_WATCH_ON_CHANGES = {{ gitea_autowatch_on_change }} -SHOW_MILESTONES_DASHBOARD_PAGE = {{ gitea_show_mailstones_dashboard }} - -[mailer] -ENABLED = {{ gitea_mailer_enabled | ternary('true', 'false') }} -; Mail server -; Gmail: smtp.gmail.com:587 -; QQ: smtp.qq.com:465 -; Note, if the port ends with "465", SMTPS will be used. Using STARTTLS on port 587 is recommended per RFC 6409. If the server supports STARTTLS it will always be used. -HOST = {{ gitea_mailer_host }} -; Do not verify the certificate of the server. Only use this for self-signed certificates -SKIP_VERIFY = {{ gitea_mailer_skip_verify }} -; Use client certificate -USE_CERTIFICATE = false -CERT_FILE = {{ gitea_home }}/custom/mailer/cert.pem -KEY_FILE = {{ gitea_home }}/custom/mailer/key.pem -; Should SMTP connection use TLS -IS_TLS_ENABLED = {{ gitea_mailer_tls_enabled | ternary('true', 'false') }} -; Mail from address, RFC 5322. This can be just an email address, or the `"Name" ` format -FROM = {{ gitea_mailer_from }} -; Mailer user name and password -USER = {{ gitea_mailer_user }} -; Use PASSWD = `your password` for quoting if you use special characters in the password. -PASSWD = {{ gitea_mailer_password }} -; Send mails as plain text -SEND_AS_PLAIN_TEXT = false -; Set Mailer Type (either SMTP, sendmail or dummy to just send to the log) -MAILER_TYPE = {{ gitea_mailer_type }} -; Specify an alternative sendmail binary -SENDMAIL_PATH = sendmail - -[session] -; Either "memory", "file", or "redis", default is "memory" -PROVIDER = file -; Provider config options -; memory: doesn't have any config yet -; file: session file path, e.g. `data/sessions` -; redis: network=tcp,addr=:6379,password=macaron,db=0,pool_size=100,idle_timeout=180 -; mysql: go-sql-driver/mysql dsn config string, e.g. `root:password@/session_table` -PROVIDER_CONFIG = {{ gitea_home }}/data/sessions - -[picture] -AVATAR_UPLOAD_PATH = {{ gitea_home }}/data/avatars -; This value will always be true in offline mode. -DISABLE_GRAVATAR = {{ gitea_disable_gravatar | ternary('true', 'false') }} - -[attachment] -; Whether attachments are enabled. Defaults to `true` -ENABLED = true -; Path for attachments. Defaults to `data/attachments` -PATH = {{ gitea_home }}/data/attachments - -[log] -ROOT_PATH = {{ gitea_home }}/log -; Either "console", "file", "conn", "smtp" or "database", default is "console" -; Use comma to separate multiple modes, e.g. "console, file" -MODE = file -; Buffer length of the channel, keep it as it is if you don't know what it is. -BUFFER_LEN = 10000 -; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "Trace" -LEVEL = {{ gitea_log_level }} -REDIRECT_MACARON_LOG = false - -[oauth2] -ENABLE = {{ gitea_oauth2_enabled }} -JWT_SECRET = {{ gitea_oauth2_jwt_secret }} - -[metrics] -ENABLED = {{ gitea_metrics_enabled }} -TOKEN = {{ gitea_metrics_token }} - -{{ gitea_extra_config }} diff --git a/roles/tmaurice.gitea/vars/main.yml b/roles/tmaurice.gitea/vars/main.yml deleted file mode 100644 index b473a405..00000000 --- a/roles/tmaurice.gitea/vars/main.yml +++ /dev/null @@ -1,10 +0,0 @@ ---- -gitea_go_arch_map: - i386: '386' - x86_64: 'amd64' - aarch64: 'arm64' - armv7l: 'arm-6' - armv6l: 'arm-6' - armv5l: 'arm-5' - -gitea_arch: "{{ gitea_go_arch_map[ansible_architecture] | default(ansible_architecture) }}"