Ubuntu
3 years ago
parent
fcd2565b47
commit
083a1f3762
@ -0,0 +1,69 @@
|
||||
# gitea requires ssh access from the host machine, which needs special setup
|
||||
# In order to create the git user and auth keys, you need to run:
|
||||
#
|
||||
# sudo gitea/setup.sh
|
||||
#
|
||||
version: "3"
|
||||
|
||||
services:
|
||||
gitea:
|
||||
image: gitea/gitea:1.17.3
|
||||
container_name: gitea
|
||||
env_file:
|
||||
- ./env.production
|
||||
environment:
|
||||
- USER_UID=2222 # must match git user on host system
|
||||
- USER_GID=2222
|
||||
- GITEA_CLIENT_SECRET=${GITEA_CLIENT_SECRET}
|
||||
- GITEA_ADMIN_PASSWORD=${GITEA_ADMIN_PASSWORD}
|
||||
- GITEA__database__DB_TYPE=postgres
|
||||
- GITEA__database__HOST=gitea-db:5432
|
||||
- GITEA__database__NAME=gitea
|
||||
- GITEA__database__USER=gitea
|
||||
- GITEA__database__PASSWD=gitea
|
||||
- GITEA__oauth2_client__ENABLE_AUTO_REGISTRATION=true
|
||||
- GITEA__openid__ENABLE_OPENID_SIGNIN=true
|
||||
- GITEA__openid__ENABLE_OPENID_SIGNUP=false
|
||||
- GITEA__service__DISABLE_REGISTRATION=true
|
||||
- GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=true
|
||||
- GITEA__repository__DEFAULT_BRANCH=main
|
||||
- GITEA__server__ROOT_URL=https://${GITEA_HOSTNAME}.${DOMAIN_NAME}/
|
||||
- GITEA__server__SSH_DOMAIN=${GITEA_HOSTNAME}.${DOMAIN_NAME}
|
||||
- GITEA__security__SECRET_KEY=${GITEA_SESSION_SECRET}
|
||||
- GITEA__security__INSTALL_LOCK=true
|
||||
entrypoint: ["/setup.sh"]
|
||||
volumes:
|
||||
- ./gitea/setup.sh:/setup.sh:ro
|
||||
- ./data/gitea:/data
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
- /home/git/.ssh/:/data/git/.ssh
|
||||
ports:
|
||||
# - "3030:3000"
|
||||
- "2222:22" # route host port 2222 to container port 22 for inbound ssh
|
||||
restart: always
|
||||
depends_on:
|
||||
- gitea-db
|
||||
|
||||
gitea-db:
|
||||
image: postgres:13.4-alpine
|
||||
container_name: gitea-db
|
||||
restart: always
|
||||
environment:
|
||||
- POSTGRES_USER=gitea
|
||||
- POSTGRES_PASSWORD=gitea
|
||||
- POSTGRES_DB=gitea
|
||||
volumes:
|
||||
- ./data/gitea/postgres:/var/lib/postgresql/data
|
||||
|
||||
# add the gitea nginx configuration into the nginx volume
|
||||
nginx:
|
||||
volumes:
|
||||
- ./gitea/nginx.conf:/etc/nginx/templates/gitea.conf.template:ro
|
||||
|
||||
# add the gitea client secrets to the keycloak-setup volume
|
||||
keycloak-setup:
|
||||
env_file:
|
||||
- data/gitea/secrets
|
||||
volumes:
|
||||
- ./gitea/keycloak.sh:/keycloak-setup/gitea.sh:ro
|
||||
@ -1,3 +1,6 @@
|
||||
# gitea
|
||||
|
||||
OIDC setup is now automated
|
||||
There is still a sudo step that has to happen on the host.
|
||||
|
||||
OIDC setup is now automated in the container.
|
||||
|
||||
|
||||
@ -1,46 +0,0 @@
|
||||
version: "3"
|
||||
|
||||
networks:
|
||||
gitea:
|
||||
external: false
|
||||
|
||||
services:
|
||||
gitea:
|
||||
image: gitea/gitea:1.16.6
|
||||
env_file:
|
||||
- ../env.production
|
||||
- env.production
|
||||
- ../data/gitea/env.secrets
|
||||
environment:
|
||||
- USER_UID=2222 # must match git user on host system
|
||||
- USER_GID=2222
|
||||
- GITEA__database__DB_TYPE=postgres
|
||||
- GITEA__database__HOST=db:5432
|
||||
- GITEA__database__NAME=gitea
|
||||
- GITEA__database__USER=gitea
|
||||
- GITEA__database__PASSWD=gitea
|
||||
networks:
|
||||
- gitea
|
||||
volumes:
|
||||
- ../data/gitea:/data
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
- /home/git/.ssh/:/data/git/.ssh
|
||||
ports:
|
||||
- "3030:3000"
|
||||
- "2222:22"
|
||||
restart: always
|
||||
depends_on:
|
||||
- db
|
||||
|
||||
db:
|
||||
image: postgres:13.4-alpine
|
||||
restart: always
|
||||
environment:
|
||||
- POSTGRES_USER=gitea
|
||||
- POSTGRES_PASSWORD=gitea
|
||||
- POSTGRES_DB=gitea
|
||||
volumes:
|
||||
- ../data/gitea/postgres:/var/lib/postgresql/data
|
||||
networks:
|
||||
- gitea
|
||||
@ -1,7 +0,0 @@
|
||||
# gitea config for keycloak integration
|
||||
# only allow open id sign-in, turn off all other registrations
|
||||
GITEA__openid__ENABLE_OPENID_SIGNIN=true
|
||||
GITEA__openid__ENABLE_OPENID_SIGNUP=false
|
||||
#GITEA__service__DISABLE_REGISTRATION=true
|
||||
GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=true
|
||||
GITEA__repository__DEFAULT_BRANCH=main
|
||||
@ -0,0 +1,4 @@
|
||||
#!/bin/bash -x
|
||||
# Setup the gitea client connection
|
||||
|
||||
client-create gitea "$GITEA_HOSTNAME.$DOMAIN_NAME" "$GITEA_CLIENT_SECRET" </dev/null
|
||||
@ -1,69 +0,0 @@
|
||||
#!/bin/bash
|
||||
die() { echo >&2 "gitea: ERROR $*" ; exit 1 ; }
|
||||
info() { echo >&2 "gitea: $*" ; }
|
||||
|
||||
DIRNAME="$(dirname $0)"
|
||||
cd "$DIRNAME"
|
||||
|
||||
source ../env.production || die "no top level environment"
|
||||
source ./env.production || die "no local environment"
|
||||
|
||||
DATA="../data/gitea"
|
||||
SECRETS="$DATA/env.secrets"
|
||||
INI="$DATA/gitea/conf/app.ini"
|
||||
|
||||
if [ -r "$SECRETS" ]; then
|
||||
docker-compose up -d || die "unable to start"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
./add-ssh-user || die "unable to add ssh user"
|
||||
|
||||
GITEA_CLIENT_SECRET="$(openssl rand -hex 32)"
|
||||
GITEA_ADMIN_PASSWORD="$(openssl rand -hex 8)"
|
||||
|
||||
info "creating new secrets $SECRETS"
|
||||
|
||||
mkdir -p "$DATA"
|
||||
cat <<EOF > "$SECRETS"
|
||||
# DO NOT CHECK IN
|
||||
GITEA_CLIENT_SECRET=$GITEA_CLIENT_SECRET
|
||||
GITEA_ADMIN_PASSWORD=$GITEA_ADMIN_PASSWORD
|
||||
GITEA__server__ROOT_URL=https://$GITEA_HOSTNAME/
|
||||
GITEA__server__SSH_DOMAIN=$GITEA_HOSTNAME
|
||||
GITEA__security__INSTALL_LOCK=true
|
||||
GITEA__security__SECRET_KEY=$(openssl rand -hex 32)
|
||||
EOF
|
||||
|
||||
|
||||
docker-compose down 2>/dev/null
|
||||
|
||||
../keycloak/client-delete gitea 2>/dev/null
|
||||
../keycloak/client-create <<EOF || die "unable to create gitea client"
|
||||
{
|
||||
"clientId": "gitea",
|
||||
"rootUrl": "https://$GITEA_HOSTNAME",
|
||||
"adminUrl": "https://$GITEA_HOSTNAME",
|
||||
"redirectUris": [ "https://$GITEA_HOSTNAME/*" ],
|
||||
"webOrigins": [ "https://$GITEA_HOSTNAME" ],
|
||||
"clientAuthenticatorType": "client-secret",
|
||||
"secret": "$GITEA_CLIENT_SECRET"
|
||||
}
|
||||
EOF
|
||||
|
||||
docker-compose up -d || die "unable to start container"
|
||||
|
||||
info "waiting for startup..."
|
||||
sleep 5
|
||||
|
||||
info "adding oauth login"
|
||||
docker-compose exec -u git gitea \
|
||||
gitea admin auth add-oauth \
|
||||
--name "keycloak" \
|
||||
--provider "openidConnect" \
|
||||
--key "gitea" \
|
||||
--secret "$GITEA_CLIENT_SECRET" \
|
||||
--auto-discover-url "https://${KEYCLOAK_HOSTNAME}/realms/${REALM}/.well-known/openid-configuration" \
|
||||
--group-claim-name "groups" \
|
||||
--admin-group "admin" \
|
||||
|| die "unable to add oauth interface"
|
||||
@ -0,0 +1,36 @@
|
||||
#!/bin/bash -x
|
||||
# This is *container* setup for the OIDC stuff
|
||||
|
||||
export APP_NAME="${DOMAIN_NAME} Gitea"
|
||||
OIDC_CANARY="/data/oidc.done"
|
||||
|
||||
if [ -r "$OIDC_CANARY" ]; then
|
||||
# based on https://github.com/go-gitea/gitea/blob/main/Dockerfile
|
||||
exec "/usr/bin/entrypoint" "/bin/s6-svscan" "/etc/s6";
|
||||
fi
|
||||
|
||||
|
||||
# We have to do some setup, so start things and wait for the config
|
||||
# file to appear so that we can edit it.
|
||||
"/usr/bin/entrypoint" "/bin/s6-svscan" "/etc/s6" &
|
||||
|
||||
echo >&2 "*** Sleeping for setup"
|
||||
sleep 30
|
||||
|
||||
echo >&2 "*** Adding OIDC login for $DOMAIN_NAME"
|
||||
su -s /bin/sh git <<EOF || exit 1
|
||||
gitea admin auth add-oauth \
|
||||
--name "keycloak" \
|
||||
--provider "openidConnect" \
|
||||
--key "gitea" \
|
||||
--secret "${GITEA_CLIENT_SECRET}" \
|
||||
--auto-discover-url "https://${KEYCLOAK_HOSTNAME}.${DOMAIN_NAME}/realms/${REALM}/.well-known/openid-configuration" \
|
||||
--group-claim-name "groups" \
|
||||
--admin-group "admin" \
|
||||
|
||||
EOF
|
||||
|
||||
touch "${OIDC_CANARY}"
|
||||
|
||||
echo >&2 "*** Done, maybe it works?"
|
||||
exit 0
|
||||
Loading…
Reference in new issue