Initial version of the forgejo collection
* Forgejo role for quick deployment in podman * Forgejo_OAuth module to manage authentication source Signed-off-by: Nis Wechselberg <enbewe@enbewe.de>
This commit is contained in:
Nis Wechselberg
parent
70646c7ba8
commit
47467b3169
GPG key ID:
7B25171F921B9E57
12 changed files with 923 additions and 0 deletions
15
roles/forgejo/defaults/main.yml
Normal file
15
roles/forgejo/defaults/main.yml
Normal file
|
|
@ -0,0 +1,15 @@
|
|||
---
|
||||
forgejo_db_image_name: 'docker.io/library/postgres'
|
||||
forgejo_db_image_tag: '17.2'
|
||||
forgejo_db_volume_name: 'forgejo_db_storage'
|
||||
|
||||
forgejo_network_name: 'forgejo-net'
|
||||
|
||||
forgejo_app_image_name: 'codeberg.org/forgejo/forgejo'
|
||||
forgejo_app_image_tag: '9.0.3'
|
||||
forgejo_app_volume_name: 'forgejo_app_storage'
|
||||
|
||||
forgejo_db_user: 'forgejo'
|
||||
forgejo_db_database: 'forgejo'
|
||||
|
||||
forgejo_ssh_port: 2222
|
||||
|
|
@ -0,0 +1,69 @@
|
|||
{{if or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn)}}
|
||||
{{template "base/alert" .}}
|
||||
{{end}}
|
||||
<h4 class="ui top attached header center">
|
||||
{{if .LinkAccountMode}}
|
||||
{{ctx.Locale.Tr "auth.oauth_signin_title"}}
|
||||
{{else}}
|
||||
{{ctx.Locale.Tr "auth.login_userpass"}}
|
||||
{{end}}
|
||||
</h4>
|
||||
<div class="ui attached segment">
|
||||
<form class="ui form tw-max-w-2xl tw-m-auto" action="{{.SignInLink}}" method="post">
|
||||
{{.CsrfTokenHtml}}
|
||||
{{if (not .OAuth2Providers)}}
|
||||
<div class="required field {{if and (.Err_UserName) (or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn))}}error{{end}}">
|
||||
<label for="user_name">{{ctx.Locale.Tr "home.uname_holder"}}</label>
|
||||
<input id="user_name" type="text" name="user_name" value="{{.user_name}}" autofocus required>
|
||||
</div>
|
||||
{{if or (not .DisablePassword) .LinkAccountMode}}
|
||||
<div class="required field {{if and (.Err_Password) (or (not .LinkAccountMode) (and .LinkAccountMode .LinkAccountModeSignIn))}}error{{end}}">
|
||||
<label for="password">{{ctx.Locale.Tr "password"}}</label>
|
||||
<input id="password" name="password" type="password" value="{{.password}}" autocomplete="current-password" required>
|
||||
</div>
|
||||
{{end}}
|
||||
{{if not .LinkAccountMode}}
|
||||
<div class="inline field">
|
||||
<div class="ui checkbox">
|
||||
<label>{{ctx.Locale.Tr "auth.remember_me"}}</label>
|
||||
<input name="remember" type="checkbox">
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
|
||||
{{template "user/auth/captcha" .}}
|
||||
|
||||
<div class="field">
|
||||
<button class="ui primary button">
|
||||
{{if .LinkAccountMode}}
|
||||
{{ctx.Locale.Tr "auth.oauth_signin_submit"}}
|
||||
{{else}}
|
||||
{{ctx.Locale.Tr "sign_in"}}
|
||||
{{end}}
|
||||
</button>
|
||||
<a href="{{AppSubUrl}}/user/forgot_password">{{ctx.Locale.Tr "auth.forgot_password"}}</a>
|
||||
</div>
|
||||
|
||||
{{if .ShowRegistrationButton}}
|
||||
<div class="field">
|
||||
<a href="{{AppSubUrl}}/user/sign_up">{{ctx.Locale.Tr "auth.sign_up_now"}}</a>
|
||||
</div>
|
||||
{{end}}
|
||||
{{end}}
|
||||
|
||||
{{if .OAuth2Providers}}
|
||||
<div id="oauth2-login-navigator" class="tw-py-1">
|
||||
<div class="tw-flex tw-flex-col tw-justify-center">
|
||||
<div id="oauth2-login-navigator-inner" class="tw-flex tw-flex-col tw-flex-wrap tw-items-center tw-gap-2">
|
||||
{{range $provider := .OAuth2Providers}}
|
||||
<a class="{{$provider.Name}} ui button tw-flex tw-items-center tw-justify-center tw-py-2 tw-w-full oauth-login-link" href="{{AppSubUrl}}/user/oauth2/{{$provider.DisplayName}}">
|
||||
{{$provider.IconHTML 28}}
|
||||
{{ctx.Locale.Tr "sign_in_with_provider" $provider.DisplayName}}
|
||||
</a>
|
||||
{{end}}
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
{{end}}
|
||||
</form>
|
||||
</div>
|
||||
56
roles/forgejo/handlers/main.yml
Normal file
56
roles/forgejo/handlers/main.yml
Normal file
|
|
@ -0,0 +1,56 @@
|
|||
---
|
||||
- name: 'Reload forgejo services'
|
||||
become: true
|
||||
ansible.builtin.service:
|
||||
daemon_reload: true
|
||||
|
||||
- name: 'Restart forgejo network'
|
||||
become: true
|
||||
ansible.builtin.service:
|
||||
name: '{{ forgejo_network_name }}-network'
|
||||
state: 'restarted'
|
||||
notify:
|
||||
- 'Restart forgejo-db container'
|
||||
- 'Restart forgejo-app container'
|
||||
|
||||
- name: 'Restart forgejo volumes'
|
||||
become: true
|
||||
ansible.builtin.service:
|
||||
name: '{{ item }}'
|
||||
state: 'restarted'
|
||||
loop:
|
||||
- '{{ forgejo_db_volume_name }}-volume'
|
||||
- '{{ forgejo_app_volume_name }}-volume'
|
||||
notify:
|
||||
- 'Restart forgejo-db container'
|
||||
- 'Restart forgejo-app container'
|
||||
|
||||
- name: 'Restart forgejo-db image'
|
||||
become: true
|
||||
ansible.builtin.service:
|
||||
name: 'forgejo-db-image'
|
||||
state: 'restarted'
|
||||
notify:
|
||||
- 'Restart forgejo-db container'
|
||||
|
||||
- name: 'Restart forgejo-db container'
|
||||
become: true
|
||||
ansible.builtin.service:
|
||||
name: 'forgejo-db'
|
||||
state: 'restarted'
|
||||
notify:
|
||||
- 'Restart forgejo-app container'
|
||||
|
||||
- name: 'Restart forgejo-app image'
|
||||
become: true
|
||||
ansible.builtin.service:
|
||||
name: 'forgejo-app-image'
|
||||
state: 'restarted'
|
||||
notify:
|
||||
- 'Restart forgejo-app container'
|
||||
|
||||
- name: 'Restart forgejo-app container'
|
||||
become: true
|
||||
ansible.builtin.service:
|
||||
name: 'forgejo-app'
|
||||
state: 'restarted'
|
||||
177
roles/forgejo/tasks/main.yml
Normal file
177
roles/forgejo/tasks/main.yml
Normal file
|
|
@ -0,0 +1,177 @@
|
|||
---
|
||||
# Basic stuff
|
||||
- name: 'Install required software'
|
||||
become: true
|
||||
ansible.builtin.apt:
|
||||
name: 'podman'
|
||||
state: 'present'
|
||||
|
||||
- name: 'Create forgejo podman network'
|
||||
become: true
|
||||
containers.podman.podman_network:
|
||||
name: '{{ forgejo_network_name }}'
|
||||
state: 'quadlet'
|
||||
notify:
|
||||
- 'Reload forgejo services'
|
||||
- 'Restart forgejo network'
|
||||
|
||||
- name: 'Create forgejo volumes'
|
||||
become: true
|
||||
containers.podman.podman_volume:
|
||||
name: '{{ item }}'
|
||||
state: 'quadlet'
|
||||
loop:
|
||||
- '{{ forgejo_db_volume_name }}'
|
||||
- '{{ forgejo_app_volume_name }}'
|
||||
notify:
|
||||
- 'Reload forgejo services'
|
||||
- 'Restart forgejo volumes'
|
||||
|
||||
- name: 'Define forgejo-db image'
|
||||
become: true
|
||||
containers.podman.podman_image:
|
||||
name: '{{ forgejo_db_image_name }}:{{ forgejo_db_image_tag }}'
|
||||
quadlet_filename: 'forgejo-db'
|
||||
state: 'quadlet'
|
||||
notify:
|
||||
- 'Reload forgejo services'
|
||||
- 'Restart forgejo-db image'
|
||||
|
||||
- name: 'Create forgejo-db container'
|
||||
become: true
|
||||
containers.podman.podman_container:
|
||||
name: 'forgejo-db'
|
||||
image: 'forgejo-db.image'
|
||||
network: '{{ forgejo_network_name }}.network'
|
||||
state: 'quadlet'
|
||||
volume:
|
||||
- '{{ forgejo_db_volume_name }}.volume:/var/lib/postgresql/data/'
|
||||
env:
|
||||
POSTGRES_DB: '{{ forgejo_db_database }}'
|
||||
POSTGRES_USER: '{{ forgejo_db_user }}'
|
||||
POSTGRES_PASSWORD: '{{ forgejo_db_password }}'
|
||||
quadlet_options: |
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
[Unit]
|
||||
Requires={{ forgejo_network_name }}-network.service
|
||||
Requires={{ forgejo_db_volume_name }}-volume.service
|
||||
After={{ forgejo_network_name }}-network.service
|
||||
After={{ forgejo_db_volume_name }}-volume.service
|
||||
notify:
|
||||
- 'Reload forgejo services'
|
||||
- 'Restart forgejo-db container'
|
||||
|
||||
# Application
|
||||
- name: 'Prepare config location'
|
||||
become: true
|
||||
ansible.builtin.file:
|
||||
path: '{{ item }}'
|
||||
state: 'directory'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: 'u=rwx,g=rx,o=rx'
|
||||
loop:
|
||||
- '/srv/git/conf/'
|
||||
- '/srv/git/custom/templates/user/auth'
|
||||
|
||||
- name: 'Deploy application config'
|
||||
become: true
|
||||
ansible.builtin.template:
|
||||
src: 'forgejo.ini.j2'
|
||||
dest: '/srv/git/conf/forgejo.ini'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: 'u=rw,g=r,o=r'
|
||||
notify: 'Restart forgejo-app container'
|
||||
|
||||
- name: 'Write customized login page'
|
||||
become: true
|
||||
ansible.builtin.copy:
|
||||
src: 'forgejo/templates/user/auth/signin_inner.tmpl'
|
||||
dest: '/srv/git/custom/templates/user/auth/signin_inner.tmpl'
|
||||
owner: 'root'
|
||||
group: 'root'
|
||||
mode: 'u=rw,g=r,o=r'
|
||||
notify: 'Restart forgejo-app container'
|
||||
|
||||
- name: 'Define forgejo-app image'
|
||||
become: true
|
||||
containers.podman.podman_image:
|
||||
name: '{{ forgejo_app_image_name }}:{{ forgejo_app_image_tag }}'
|
||||
quadlet_filename: 'forgejo-app'
|
||||
state: 'quadlet'
|
||||
notify:
|
||||
- 'Reload forgejo services'
|
||||
- 'Restart forgejo-app image'
|
||||
|
||||
- name: 'Create forgejo-app container'
|
||||
become: true
|
||||
containers.podman.podman_container:
|
||||
name: 'forgejo-app'
|
||||
image: 'forgejo-app.image'
|
||||
network: '{{ forgejo_network_name }}.network'
|
||||
state: 'quadlet'
|
||||
volume:
|
||||
- '{{ forgejo_app_volume_name }}.volume:/data/'
|
||||
- '/etc/timezone:/etc/timezone:ro'
|
||||
- '/etc/localtime:/etc/localtime:ro'
|
||||
- '/srv/git/conf/forgejo.ini:/data/gitea/conf/app.ini:ro'
|
||||
- '/srv/git/custom/templates:/data/gitea/templates:ro'
|
||||
env:
|
||||
USER_UID: '1000'
|
||||
USER_GID: '1000'
|
||||
FORGEJO__database__DB_TYPE: 'postgres'
|
||||
FORGEJO__database__HOST: 'forgejo-db:5432'
|
||||
FORGEJO__database__NAME: '{{ forgejo_db_database }}'
|
||||
FORGEJO__database__USER: '{{ forgejo_db_user }}'
|
||||
FORGEJO__database__PASSWD: '{{ forgejo_db_password }}'
|
||||
ports:
|
||||
- '{{ forgejo_ssh_port }}:22/tcp'
|
||||
quadlet_options: |
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
[Unit]
|
||||
Requires={{ forgejo_network_name }}-network.service
|
||||
Requires={{ forgejo_app_volume_name }}-volume.service
|
||||
Requires=forgejo-db.service
|
||||
After={{ forgejo_network_name }}-network.service
|
||||
After={{ forgejo_app_volume_name }}-volume.service
|
||||
After=forgejo-db.service
|
||||
notify:
|
||||
- 'Reload forgejo services'
|
||||
- 'Restart forgejo-app container'
|
||||
|
||||
- name: Flush handlers
|
||||
ansible.builtin.meta: flush_handlers
|
||||
|
||||
# Authentication source
|
||||
- name: 'Configure forgejo authentication source'
|
||||
become: true
|
||||
when: forgejo_sso_create_source
|
||||
enbewe.forgejo.forgejo_oauth:
|
||||
state: 'present'
|
||||
update: '{{ forgejo_sso_update | default(false) }}'
|
||||
name: '{{ forgejo_sso_name }}'
|
||||
provider: '{{ forgejo_sso_provider }}'
|
||||
key: '{{ forgejo_sso_key }}'
|
||||
secret: '{{ forgejo_sso_secret }}'
|
||||
auto_discover_url: '{{ forgejo_sso_auto_discover_url | default("") }}'
|
||||
use_custom_urls: '{{ forgejo_sso_use_custom_urls | default(false) }}'
|
||||
custom_tenant_id: '{{ forgejo_sso_custom_tenant_id | default("") }}'
|
||||
custom_auth_url: '{{ forgejo_sso_custom_auth_url | default("") }}'
|
||||
custom_token_url: '{{ forgejo_sso_custom_token_url | default("") }}'
|
||||
custom_profile_url: '{{ forgejo_sso_custom_profile_url | default("") }}'
|
||||
custom_email_url: '{{ forgejo_sso_custom_email_url | default("") }}'
|
||||
icon_url: '{{ forgejo_sso_icon_url | default("") }}'
|
||||
skip_local_2fa: '{{ forgejo_sso_skip_local_2fa | default(true) }}'
|
||||
scopes: '{{ forgejo_sso_scopes | default("") }}'
|
||||
required_claim_name: '{{ forgejo_sso_required_claim_name | default("") }}'
|
||||
required_claim_value: '{{ forgejo_sso_required_claim_value | default("") }}'
|
||||
group_claim_name: '{{ forgejo_sso_group_claim_name | default("") }}'
|
||||
admin_group: '{{ forgejo_sso_admin_group | default("") }}'
|
||||
restricted_group: '{{ forgejo_sso_restricted_group | default("") }}'
|
||||
group_team_map: '{{ forgejo_sso_group_team_map | default("") }}'
|
||||
group_team_map_removal: '{{ forgejo_sso_group_team_map_removal | default(false) }}'
|
||||
retries: 5
|
||||
delay: 5
|
||||
124
roles/forgejo/templates/forgejo.ini.j2
Normal file
124
roles/forgejo/templates/forgejo.ini.j2
Normal file
|
|
@ -0,0 +1,124 @@
|
|||
APP_NAME = {{ forgejo_general_app_name }}
|
||||
RUN_MODE = {{ forgejo_general_run_mode | default('prod') }}
|
||||
RUN_USER = git
|
||||
WORK_PATH = /data/gitea
|
||||
|
||||
[repository]
|
||||
ROOT = /data/git/repositories
|
||||
DEFAULT_PRIVATE = {{ forgejo_repostiory_default_private | default('last') }}
|
||||
DISABLE_HTTP_GIT = {{ forgejo_repostiory_disable_http_git | default(false) }}
|
||||
ENABLE_PUSH_CREATE_USER = {{ forgejo_repostiory_enable_push_create_user | default(false) }}
|
||||
ENABLE_PUSH_CREATE_ORG = {{ forgejo_repostiory_enable_push_create_org | default(false) }}
|
||||
|
||||
[repository.pull-request]
|
||||
DEFAULT_MERGE_STYLE = merge
|
||||
|
||||
[repository.upload]
|
||||
TEMP_PATH = /data/gitea/uploads
|
||||
|
||||
[repository.signing]
|
||||
DEFAULT_TRUST_MODEL = committer
|
||||
|
||||
[repository.local]
|
||||
LOCAL_COPY_PATH = /data/gitea/tmp/local-repo
|
||||
|
||||
[server]
|
||||
APP_DATA_PATH = /data/gitea
|
||||
DOMAIN = {{ forgejo_server_domain }}
|
||||
SSH_DOMAIN = {{ forgejo_server_ssh_domain | default(forgejo_server_domain) }}
|
||||
HTTP_PORT = 3000
|
||||
ROOT_URL = {{ forgejo_server_root_url }}
|
||||
DISABLE_SSH = false
|
||||
SSH_PORT = {{ forgejo_ssh_port }}
|
||||
SSH_LISTEN_PORT = 22
|
||||
LFS_START_SERVER = true
|
||||
LFS_JWT_SECRET = {{ forgejo_server_lfs_jwt_secret }}
|
||||
OFFLINE_MODE = {{ forgejo_server_offline_mode | default(true) }}
|
||||
LANDING_PAGE = {{ forgejo_server_landing_page | default('home') }}
|
||||
|
||||
[database]
|
||||
DB_TYPE = postgres
|
||||
HOST = forgejo-db:5432
|
||||
NAME = {{ forgejo_db_database }}
|
||||
USER = {{ forgejo_db_user }}
|
||||
PASSWD = {{ forgejo_db_password }}
|
||||
SCHEMA =
|
||||
SSL_MODE = disable
|
||||
LOG_SQL = false
|
||||
|
||||
[indexer]
|
||||
ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
|
||||
|
||||
[admin]
|
||||
DEFAULT_EMAIL_NOTIFICATIONS = {{ forgejo_admin_default_email_notification | default('enabled') }}
|
||||
DISABLE_REGULAR_ORG_CREATION = {{ forgejo_admin_disable_regular_org_creation | default(false) }}
|
||||
SEND_NOTIFICATION_EMAIL_ON_NEW_USER = {{ forgejo_admin_send_notification_email_on_new_user | default(false) }}
|
||||
|
||||
[security]
|
||||
INSTALL_LOCK = true
|
||||
SECRET_KEY = {{ forgejo_security_secret_key }}
|
||||
REVERSE_PROXY_LIMIT = 1
|
||||
REVERSE_PROXY_TRUSTED_PROXIES = *
|
||||
INTERNAL_TOKEN = {{ forgejo_security_internal_token }}
|
||||
PASSWORD_HASH_ALGO = pbkdf2_hi
|
||||
|
||||
[openid]
|
||||
ENABLE_OPENID_SIGNIN = {{ forgejo_openid_enable_openid_signin | default(true) }}
|
||||
ENABLE_OPENID_SIGNUP = {{ forgejo_openid_enable_openid_signup | default(false) }}
|
||||
|
||||
[oauth2_client]
|
||||
ENABLE_AUTO_REGISTRATION = {{ forgejo_oauth2_enable_auto_registration | default(false) }}
|
||||
|
||||
[service]
|
||||
REGISTER_EMAIL_CONFIRM = {{ forgejo_service_register_email_confirm | default(false) }}
|
||||
REGISTER_MANUAL_CONFIRM = {{ forgejo_service_register_manual_confirm | default(false) }}
|
||||
DISABLE_REGISTRATION = {{ forgejo_service_disable_registration | default(false) }}
|
||||
REQUIRE_SIGNIN_VIEW = {{ forgejo_service_require_signin_view | default(true) }}
|
||||
ENABLE_NOTIFY_MAIL = {{ forgejo_service_enable_notify_mail | default(false) }}
|
||||
ENABLE_CAPTCHA = false
|
||||
DEFAULT_KEEP_EMAIL_PRIVATE = {{ forgejo_service_default_keep_email_private | default(true) }}
|
||||
DEFAULT_ALLOW_CREATE_ORGANIZATION = {{ forgejo_service_default_allow_create_organization | default(false) }}
|
||||
DEFAULT_ENABLE_TIMETRACKING = false
|
||||
ALLOW_ONLY_INTERNAL_REGISTRATION = {{ forgejo_service_allow_only_internal_registration | default(false) }}
|
||||
ALLOW_ONLY_EXTERNAL_REGISTRATION = {{ forgejo_service_allow_only_external_registration | default(false) }}
|
||||
|
||||
[service.explore]
|
||||
REQUIRE_SIGNIN_VIEW = {{ forgejo_service_explore_require_signin_view | default(false) }}
|
||||
DISABLE_USERS_PAGE = {{ forgejo_service_explore_disable_users_page | default(true) }}
|
||||
|
||||
[mailer]
|
||||
ENABLED = false
|
||||
|
||||
[session]
|
||||
PROVIDER = file
|
||||
PROVIDER_CONFIG = /data/gitea/sessions
|
||||
|
||||
[picture]
|
||||
AVATAR_UPLOAD_PATH = /data/gitea/avatars
|
||||
REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars
|
||||
|
||||
[attachment]
|
||||
PATH = /data/gitea/attachments
|
||||
|
||||
[log]
|
||||
MODE = console
|
||||
LEVEL = {{ forgejo_log_level | default('info') }}
|
||||
ROOT_PATH = /data/gitea/log
|
||||
|
||||
[cron.update_checker]
|
||||
ENABLED = true
|
||||
|
||||
[oauth2]
|
||||
ENABLED = {{ forgejo_oauth2_provider_enabled | default(false) }}
|
||||
JWT_SECRET = {{ forgejo_oauth2_jwt_secret }}
|
||||
|
||||
[federation]
|
||||
ENABLED = {{ forgejo_federation_enabled | default(false) }}
|
||||
SHARE_USER_STATISTICS = {{ forgejo_federation_share_user_statistics | default(true) }}
|
||||
MAX_SIZE = {{ forgejo_federation_max_size | default(4) }}
|
||||
|
||||
[lfs]
|
||||
PATH = /data/git/lfs
|
||||
|
||||
[actions]
|
||||
ENABLED = {{ forgejo_actions_enabled | default(false) }}
|
||||
Loading…
Add table
Add a link
Reference in a new issue