✨: install/configure gitea

inventory/host_vars/git1.dmz.mateu.be.yml

@@ -0,0 +1,42 @@
+---
+
+web_hostname:
+  - host: giteu.be
+
+gitea_database_passwd: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          35653363613231623934393565656662643535663762306535316466336137633634373865333262
+          3763633438386533393464623663323732383238376464620a333334383932663630326137613537
+          38633231396538326538316137303839626236643765626663613532383464343533326332616137
+          6430616538336533380a363737663735623938316661313630353839633438346264323031346331
+          64313334303530626537613061616363663131383036393962323962313834643966
+
+gitea_server_lfs_jwt_secret: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          30623739326162373231626165616466613637376435326430356539343132656335663262336232
+          6634313031666461323435643638656338663433303261320a613131613363363236343365643238
+          31363537633266623339393530646165303861653066346566396430623433326436356438653637
+          6533316163386165330a656432393031353234363130663432336562363739633538613062656136
+          66383361666465333439623432373861643735313161613638313063323130663430343162656138
+          6636336637336561626432613532373862316337323036643936
+
+gitea_security_internal_token: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          39323763653762333134316432343664363565366461633661643938623233376232343032616438
+          3039333162313738376636363166646630626365376361630a643538306262653063326239316231
+          35376265386532316166363961613039356365626138623030386264626238643262353534386166
+          3363643837353735320a366563356336643762656231343032646233383038313462376466633364
+          31333938393339643839363939643732613363353062336631636462356438363532393038356536
+          63316537306338343139336364663161343935633431343661643565663236386361326630373461
+          37616638626263376531333633316161336265373163373263636431336161363533613862336163
+          63353536646534366534666165363439626162333731373162326565313762303530393062356336
+          33343561376365633039343638636332393832643930306136326334353531636238
+
+gitea_oauth2_jwt_secret: !vault |
+          $ANSIBLE_VAULT;1.1;AES256
+          64646635613839393736353135373461376635636330343366316165373765373034616466646165
+          3765303066373531373135623138613564383935323036620a393035653439313334656339613062
+          36333731623330353432633762333661336366303063363432353235386537623364306562303637
+          3363343638643839300a623732313163353234666563333134653431333832666665393531356433
+          38313632663531653865653564363430666262353133356464316565386431353365653532323232
+          3738646363633430373736333364396331613931393133323936

inventory/production.yml

@@ -28,6 +28,7 @@ resticservers:
     es1.dmz.mateu.be:
     frederica.dmz.mateu.be:
     garage1.dmz.mateu.be:
+    git1.dmz.mateu.be:
     jabber.dmz.mateu.be:
     mail.dmz.mateu.be:
     masto1.dmz.mateu.be:
@@ -64,6 +65,7 @@ webservers:
   hosts:
     bt.dmz.mateu.be:
     garage1.dmz.mateu.be:
+    git1.dmz.mateu.be:
     jabber.dmz.mateu.be:
     mail.dmz.mateu.be:
     masto1.dmz.mateu.be:
@@ -91,6 +93,11 @@ pgsqlservers:
     masto1.dmz.mateu.be:
     pt1.dmz.mateu.be:
     web1.dmz.mateu.be:
+    git1.dmz.mateu.be:
+
+giteaservers:
+  hosts:
+    git1.dmz.mateu.be:
 
 mastodonservers:
   hosts:

playbooks/gitea.yml

@@ -0,0 +1,7 @@
+---
+
+- name: Install Gitea
+  hosts: giteaservers
+  diff: true
+  roles:
+    - gitea

playbooks/site.yml

@@ -48,3 +48,5 @@
   import_playbook: peertube.yml
 - name: Run elasticsearch playbook
   import_playbook: elasticsearch.yml
+- name: Run gitea playbook
+  import_playbook: gitea.yml

roles/gitea/handlers/main.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Restart Gitea
+  ansible.builtin.systemd:
+    name: gitea
+    enabled: true
+    daemon_reload: true
+    state: restarted

roles/gitea/tasks/main.yml

@@ -0,0 +1,75 @@
+---
+
+- name: Install prerequisites
+  ansible.builtin.package:
+    name: git
+    state: present
+    update_cache: true
+
+- name: Download Gitea executable
+  ansible.builtin.get_url:
+    url: "{{ gitea_url }}"
+    dest: "{{ gitea_bin }}"
+    owner: root
+    group: root
+    mode: "0o755"
+    force: true
+  notify:
+    - Restart Gitea
+
+- name: Create git user
+  ansible.builtin.user:
+    name: git
+    password: '*'
+    comment: "Git Version Control"
+    home: /home/git
+    shell: /bin/bash
+    state: present
+
+- name: Create Gitea base dir
+  ansible.builtin.file:
+    state: directory
+    path: "{{ gitea_path }}"
+    owner: git
+    group: git
+    mode: "0o755"
+
+- name: Create Gitea sub dirs
+  ansible.builtin.file:
+    state: directory
+    path: "{{ gitea_path }}/{{ item }}"
+    owner: git
+    group: git
+    mode: "0o755"
+  loop:
+    - custom
+    - data
+    - log
+
+- name: Create Gitea config dir
+  ansible.builtin.file:
+    state: directory
+    path: "{{ gitea_etc_path }}"
+    owner: root
+    group: git
+    mode: "0o750"
+
+- name: Create Gitea config file
+  ansible.builtin.template:
+    src: app.ini.j2
+    dest: "{{ gitea_etc_path }}/app.ini"
+    owner: root
+    group: git
+    mode: "0o640"
+  notify:
+    - Restart Gitea
+
+- name: Create systemd Gitea file
+  ansible.builtin.template:
+    src: gitea.service.j2
+    dest: /etc/systemd/system/gitea.service
+    owner: root
+    group: root
+    mode: "0o640"
+  notify:
+    - Restart Gitea

roles/gitea/templates/app.ini.j2

@@ -0,0 +1,82 @@
+APP_NAME = Gitea: Git with a cup of tea
+RUN_USER = git
+WORK_PATH = /srv/gitea
+RUN_MODE = prod
+
+[database]
+DB_TYPE = postgres
+HOST = 127.0.0.1:5432
+NAME = giteadb
+USER = gitea
+PASSWD = {{ gitea_database_passwd }}
+SCHEMA = 
+SSL_MODE = disable
+PATH = /srv/gitea/data/gitea.db
+LOG_SQL = false
+
+[repository]
+ROOT = /srv/gitea/data/gitea-repositories
+
+[server]
+SSH_DOMAIN = giteu.be
+DOMAIN = giteu.be
+HTTP_PORT = 3000
+ROOT_URL = https://giteu.be/
+APP_DATA_PATH = /srv/gitea/data
+DISABLE_SSH = false
+SSH_PORT = 22
+LFS_START_SERVER = true
+LFS_JWT_SECRET = {{ gitea_server_lfs_jwt_secret }}
+OFFLINE_MODE = true
+
+[lfs]
+PATH = /srv/gitea/data/lfs
+
+[mailer]
+ENABLED = true
+SMTP_ADDR = smtp.libertus.eu
+SMTP_PORT = 587
+FROM = Gitea <gitea@mateu.be>
+USER = {{ smtprelay_login }}
+PASSWD = {{ smtprelay_pass }}
+
+[service]
+REGISTER_EMAIL_CONFIRM = false
+ENABLE_NOTIFY_MAIL = false
+DISABLE_REGISTRATION = true
+ALLOW_ONLY_EXTERNAL_REGISTRATION = false
+ENABLE_CAPTCHA = false
+REQUIRE_SIGNIN_VIEW = false
+DEFAULT_KEEP_EMAIL_PRIVATE = true
+DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+DEFAULT_ENABLE_TIMETRACKING = true
+NO_REPLY_ADDRESS = noreply.localhost
+
+[openid]
+ENABLE_OPENID_SIGNIN = false
+ENABLE_OPENID_SIGNUP = false
+
+[cron.update_checker]
+ENABLED = false
+
+[session]
+PROVIDER = file
+
+[log]
+MODE = console
+LEVEL = info
+ROOT_PATH = /srv/gitea/log
+
+[repository.pull-request]
+DEFAULT_MERGE_STYLE = merge
+
+[repository.signing]
+DEFAULT_TRUST_MODEL = committer
+
+[security]
+INSTALL_LOCK = true
+INTERNAL_TOKEN = {{ gitea_security_internal_token }}
+PASSWORD_HASH_ALGO = pbkdf2
+
+[oauth2]
+JWT_SECRET = {{ gitea_oauth2_jwt_secret }}

roles/gitea/templates/gitea.service.j2

@@ -0,0 +1,23 @@
+[Unit]
+Description=Gitea (Git with a cup of tea)
+After=network.target
+Wants=postgresql.service
+After=postgresql.service
+
+[Service]
+# Uncomment the next line if you have repos with lots of files and get a HTTP 500 error because of that
+# LimitNOFILE=524288:524288
+RestartSec=2s
+Type=simple
+User=git
+Group=git
+WorkingDirectory={{ gitea_path }}
+# If using Unix socket: tells systemd to create the /run/gitea folder, which will contain the gitea.sock file
+# (manually creating /run/gitea doesn't work, because it would not persist across reboots)
+#RuntimeDirectory=gitea
+ExecStart={{ gitea_bin }} web --config {{ gitea_etc_path }}/app.ini
+Restart=always
+Environment=USER=git HOME=/home/git GITEA_WORK_DIR={{ gitea_path }}
+
+[Install]
+WantedBy=multi-user.target

roles/gitea/vars/main.yml

@@ -0,0 +1,7 @@
+---
+
+gitea_version: "1.23.1"
+gitea_url: "https://dl.gitea.com/gitea/{{ gitea_version }}/gitea-{{ gitea_version }}-linux-amd64"
+gitea_bin: "/usr/local/bin/gitea"
+gitea_path: "/srv/gitea"
+gitea_etc_path: "/etc/gitea"

roles/nginx/templates/vhosts/giteu.be.conf.j2

@@ -0,0 +1,11 @@
+server {
+{% include './templates/header.conf.j2' %}
+	client_max_body_size 10M;
+
+	location / {
+		proxy_pass http://localhost:3000;
+		include proxy_params;
+		proxy_buffering off;
+		tcp_nodelay on;
+	}
+}