diff --git a/inventory/host_vars/git1.dmz.mateu.be.yml b/inventory/host_vars/git1.dmz.mateu.be.yml new file mode 100644 index 0000000..c7f4b66 --- /dev/null +++ b/inventory/host_vars/git1.dmz.mateu.be.yml @@ -0,0 +1,42 @@ +--- + +web_hostname: + - host: giteu.be + +gitea_database_passwd: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 35653363613231623934393565656662643535663762306535316466336137633634373865333262 + 3763633438386533393464623663323732383238376464620a333334383932663630326137613537 + 38633231396538326538316137303839626236643765626663613532383464343533326332616137 + 6430616538336533380a363737663735623938316661313630353839633438346264323031346331 + 64313334303530626537613061616363663131383036393962323962313834643966 + +gitea_server_lfs_jwt_secret: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 30623739326162373231626165616466613637376435326430356539343132656335663262336232 + 6634313031666461323435643638656338663433303261320a613131613363363236343365643238 + 31363537633266623339393530646165303861653066346566396430623433326436356438653637 + 6533316163386165330a656432393031353234363130663432336562363739633538613062656136 + 66383361666465333439623432373861643735313161613638313063323130663430343162656138 + 6636336637336561626432613532373862316337323036643936 + +gitea_security_internal_token: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 39323763653762333134316432343664363565366461633661643938623233376232343032616438 + 3039333162313738376636363166646630626365376361630a643538306262653063326239316231 + 35376265386532316166363961613039356365626138623030386264626238643262353534386166 + 3363643837353735320a366563356336643762656231343032646233383038313462376466633364 + 31333938393339643839363939643732613363353062336631636462356438363532393038356536 + 63316537306338343139336364663161343935633431343661643565663236386361326630373461 + 37616638626263376531333633316161336265373163373263636431336161363533613862336163 + 63353536646534366534666165363439626162333731373162326565313762303530393062356336 + 33343561376365633039343638636332393832643930306136326334353531636238 + +gitea_oauth2_jwt_secret: !vault | + $ANSIBLE_VAULT;1.1;AES256 + 64646635613839393736353135373461376635636330343366316165373765373034616466646165 + 3765303066373531373135623138613564383935323036620a393035653439313334656339613062 + 36333731623330353432633762333661336366303063363432353235386537623364306562303637 + 3363343638643839300a623732313163353234666563333134653431333832666665393531356433 + 38313632663531653865653564363430666262353133356464316565386431353365653532323232 + 3738646363633430373736333364396331613931393133323936 diff --git a/inventory/production.yml b/inventory/production.yml index 10d6b60..22bda5b 100644 --- a/inventory/production.yml +++ b/inventory/production.yml @@ -28,6 +28,7 @@ resticservers: es1.dmz.mateu.be: frederica.dmz.mateu.be: garage1.dmz.mateu.be: + git1.dmz.mateu.be: jabber.dmz.mateu.be: mail.dmz.mateu.be: masto1.dmz.mateu.be: @@ -64,6 +65,7 @@ webservers: hosts: bt.dmz.mateu.be: garage1.dmz.mateu.be: + git1.dmz.mateu.be: jabber.dmz.mateu.be: mail.dmz.mateu.be: masto1.dmz.mateu.be: @@ -91,6 +93,11 @@ pgsqlservers: masto1.dmz.mateu.be: pt1.dmz.mateu.be: web1.dmz.mateu.be: + git1.dmz.mateu.be: + +giteaservers: + hosts: + git1.dmz.mateu.be: mastodonservers: hosts: diff --git a/playbooks/gitea.yml b/playbooks/gitea.yml new file mode 100644 index 0000000..379709d --- /dev/null +++ b/playbooks/gitea.yml @@ -0,0 +1,7 @@ +--- + +- name: Install Gitea + hosts: giteaservers + diff: true + roles: + - gitea diff --git a/playbooks/site.yml b/playbooks/site.yml index 9e86586..432e5d3 100644 --- a/playbooks/site.yml +++ b/playbooks/site.yml @@ -48,3 +48,5 @@ import_playbook: peertube.yml - name: Run elasticsearch playbook import_playbook: elasticsearch.yml +- name: Run gitea playbook + import_playbook: gitea.yml diff --git a/roles/gitea/handlers/main.yml b/roles/gitea/handlers/main.yml new file mode 100644 index 0000000..567d43c --- /dev/null +++ b/roles/gitea/handlers/main.yml @@ -0,0 +1,8 @@ +--- + +- name: Restart Gitea + ansible.builtin.systemd: + name: gitea + enabled: true + daemon_reload: true + state: restarted diff --git a/roles/gitea/tasks/main.yml b/roles/gitea/tasks/main.yml new file mode 100644 index 0000000..5cac424 --- /dev/null +++ b/roles/gitea/tasks/main.yml @@ -0,0 +1,75 @@ +--- + +- name: Install prerequisites + ansible.builtin.package: + name: git + state: present + update_cache: true + +- name: Download Gitea executable + ansible.builtin.get_url: + url: "{{ gitea_url }}" + dest: "{{ gitea_bin }}" + owner: root + group: root + mode: "0o755" + force: true + notify: + - Restart Gitea + +- name: Create git user + ansible.builtin.user: + name: git + password: '*' + comment: "Git Version Control" + home: /home/git + shell: /bin/bash + state: present + +- name: Create Gitea base dir + ansible.builtin.file: + state: directory + path: "{{ gitea_path }}" + owner: git + group: git + mode: "0o755" + +- name: Create Gitea sub dirs + ansible.builtin.file: + state: directory + path: "{{ gitea_path }}/{{ item }}" + owner: git + group: git + mode: "0o755" + loop: + - custom + - data + - log + +- name: Create Gitea config dir + ansible.builtin.file: + state: directory + path: "{{ gitea_etc_path }}" + owner: root + group: git + mode: "0o750" + +- name: Create Gitea config file + ansible.builtin.template: + src: app.ini.j2 + dest: "{{ gitea_etc_path }}/app.ini" + owner: root + group: git + mode: "0o640" + notify: + - Restart Gitea + +- name: Create systemd Gitea file + ansible.builtin.template: + src: gitea.service.j2 + dest: /etc/systemd/system/gitea.service + owner: root + group: root + mode: "0o640" + notify: + - Restart Gitea diff --git a/roles/gitea/templates/app.ini.j2 b/roles/gitea/templates/app.ini.j2 new file mode 100644 index 0000000..9e40876 --- /dev/null +++ b/roles/gitea/templates/app.ini.j2 @@ -0,0 +1,82 @@ +APP_NAME = Gitea: Git with a cup of tea +RUN_USER = git +WORK_PATH = /srv/gitea +RUN_MODE = prod + +[database] +DB_TYPE = postgres +HOST = 127.0.0.1:5432 +NAME = giteadb +USER = gitea +PASSWD = {{ gitea_database_passwd }} +SCHEMA = +SSL_MODE = disable +PATH = /srv/gitea/data/gitea.db +LOG_SQL = false + +[repository] +ROOT = /srv/gitea/data/gitea-repositories + +[server] +SSH_DOMAIN = giteu.be +DOMAIN = giteu.be +HTTP_PORT = 3000 +ROOT_URL = https://giteu.be/ +APP_DATA_PATH = /srv/gitea/data +DISABLE_SSH = false +SSH_PORT = 22 +LFS_START_SERVER = true +LFS_JWT_SECRET = {{ gitea_server_lfs_jwt_secret }} +OFFLINE_MODE = true + +[lfs] +PATH = /srv/gitea/data/lfs + +[mailer] +ENABLED = true +SMTP_ADDR = smtp.libertus.eu +SMTP_PORT = 587 +FROM = Gitea +USER = {{ smtprelay_login }} +PASSWD = {{ smtprelay_pass }} + +[service] +REGISTER_EMAIL_CONFIRM = false +ENABLE_NOTIFY_MAIL = false +DISABLE_REGISTRATION = true +ALLOW_ONLY_EXTERNAL_REGISTRATION = false +ENABLE_CAPTCHA = false +REQUIRE_SIGNIN_VIEW = false +DEFAULT_KEEP_EMAIL_PRIVATE = true +DEFAULT_ALLOW_CREATE_ORGANIZATION = true +DEFAULT_ENABLE_TIMETRACKING = true +NO_REPLY_ADDRESS = noreply.localhost + +[openid] +ENABLE_OPENID_SIGNIN = false +ENABLE_OPENID_SIGNUP = false + +[cron.update_checker] +ENABLED = false + +[session] +PROVIDER = file + +[log] +MODE = console +LEVEL = info +ROOT_PATH = /srv/gitea/log + +[repository.pull-request] +DEFAULT_MERGE_STYLE = merge + +[repository.signing] +DEFAULT_TRUST_MODEL = committer + +[security] +INSTALL_LOCK = true +INTERNAL_TOKEN = {{ gitea_security_internal_token }} +PASSWORD_HASH_ALGO = pbkdf2 + +[oauth2] +JWT_SECRET = {{ gitea_oauth2_jwt_secret }} diff --git a/roles/gitea/templates/gitea.service.j2 b/roles/gitea/templates/gitea.service.j2 new file mode 100644 index 0000000..1c8638d --- /dev/null +++ b/roles/gitea/templates/gitea.service.j2 @@ -0,0 +1,23 @@ +[Unit] +Description=Gitea (Git with a cup of tea) +After=network.target +Wants=postgresql.service +After=postgresql.service + +[Service] +# Uncomment the next line if you have repos with lots of files and get a HTTP 500 error because of that +# LimitNOFILE=524288:524288 +RestartSec=2s +Type=simple +User=git +Group=git +WorkingDirectory={{ gitea_path }} +# If using Unix socket: tells systemd to create the /run/gitea folder, which will contain the gitea.sock file +# (manually creating /run/gitea doesn't work, because it would not persist across reboots) +#RuntimeDirectory=gitea +ExecStart={{ gitea_bin }} web --config {{ gitea_etc_path }}/app.ini +Restart=always +Environment=USER=git HOME=/home/git GITEA_WORK_DIR={{ gitea_path }} + +[Install] +WantedBy=multi-user.target diff --git a/roles/gitea/vars/main.yml b/roles/gitea/vars/main.yml new file mode 100644 index 0000000..6d8d122 --- /dev/null +++ b/roles/gitea/vars/main.yml @@ -0,0 +1,7 @@ +--- + +gitea_version: "1.23.1" +gitea_url: "https://dl.gitea.com/gitea/{{ gitea_version }}/gitea-{{ gitea_version }}-linux-amd64" +gitea_bin: "/usr/local/bin/gitea" +gitea_path: "/srv/gitea" +gitea_etc_path: "/etc/gitea" diff --git a/roles/nginx/templates/vhosts/giteu.be.conf.j2 b/roles/nginx/templates/vhosts/giteu.be.conf.j2 new file mode 100644 index 0000000..a7c5f36 --- /dev/null +++ b/roles/nginx/templates/vhosts/giteu.be.conf.j2 @@ -0,0 +1,11 @@ +server { +{% include './templates/header.conf.j2' %} + client_max_body_size 10M; + + location / { + proxy_pass http://localhost:3000; + include proxy_params; + proxy_buffering off; + tcp_nodelay on; + } +}