Initial version of the forgejo collection

* Forgejo role for quick deployment in podman
* Forgejo_OAuth module to manage authentication source

Signed-off-by: Nis Wechselberg <enbewe@enbewe.de>

roles/forgejo/defaults/main.yml

@@ -0,0 +1,15 @@
+---
+forgejo_network_name: 'forgejo-net'
+
+forgejo_db_image_name: 'docker.io/library/postgres'
+forgejo_db_image_tag: '17.2'
+forgejo_db_volume_name: 'forgejo_db_storage'
+
+forgejo_app_image_name: 'codeberg.org/forgejo/forgejo'
+forgejo_app_image_tag: '11.0.0'
+forgejo_app_volume_name: 'forgejo_app_storage'
+
+forgejo_db_user: 'forgejo'
+forgejo_db_database: 'forgejo'
+
+forgejo_conf_path: '/srv/git/conf'

roles/forgejo/handlers/main.yml

@@ -0,0 +1,56 @@
+---
+- name: 'Reload forgejo services'
+  become: true
+  ansible.builtin.service:
+    daemon_reload: true
+
+- name: 'Restart forgejo network'
+  become: true
+  ansible.builtin.service:
+    name: '{{ forgejo_network_name }}-network'
+    state: 'restarted'
+  notify:
+    - 'Restart forgejo-db container'
+    - 'Restart forgejo-app container'
+
+- name: 'Restart forgejo volumes'
+  become: true
+  ansible.builtin.service:
+    name: '{{ item }}'
+    state: 'restarted'
+  loop:
+    - '{{ forgejo_db_volume_name }}-volume'
+    - '{{ forgejo_app_volume_name }}-volume'
+  notify:
+    - 'Restart forgejo-db container'
+    - 'Restart forgejo-app container'
+
+- name: 'Restart forgejo-db image'
+  become: true
+  ansible.builtin.service:
+    name: 'forgejo-db-image'
+    state: 'restarted'
+  notify:
+    - 'Restart forgejo-db container'
+
+- name: 'Restart forgejo-db container'
+  become: true
+  ansible.builtin.service:
+    name: 'forgejo-db'
+    state: 'restarted'
+  notify:
+    - 'Restart forgejo-app container'
+
+- name: 'Restart forgejo-app image'
+  become: true
+  ansible.builtin.service:
+    name: 'forgejo-app-image'
+    state: 'restarted'
+  notify:
+    - 'Restart forgejo-app container'
+
+- name: 'Restart forgejo-app container'
+  become: true
+  ansible.builtin.service:
+    name: 'forgejo-app'
+    state: 'restarted'

roles/forgejo/tasks/main.yml

@@ -0,0 +1,187 @@
+---
+- name: 'Install required software'
+  become: true
+  ansible.builtin.apt:
+    name: 'podman'
+    state: 'present'
+
+- name: 'Create forgejo podman network'
+  become: true
+  containers.podman.podman_network:
+    name: '{{ forgejo_network_name }}'
+    ipv6: true
+    state: 'quadlet'
+  notify:
+    - 'Reload forgejo services'
+    - 'Restart forgejo network'
+
+- name: 'Create forgejo volumes'
+  become: true
+  containers.podman.podman_volume:
+    name: '{{ item }}'
+    state: 'quadlet'
+  loop:
+    - '{{ forgejo_db_volume_name }}'
+    - '{{ forgejo_app_volume_name }}'
+  notify:
+    - 'Reload forgejo services'
+    - 'Restart forgejo volumes'
+
+- name: 'Define forgejo-db image'
+  become: true
+  containers.podman.podman_image:
+    name: '{{ forgejo_db_image_name }}:{{ forgejo_db_image_tag }}'
+    quadlet_filename: 'forgejo-db'
+    state: 'quadlet'
+  notify:
+    - 'Reload forgejo services'
+    - 'Restart forgejo-db image'
+
+- name: 'Create forgejo-db container'
+  become: true
+  containers.podman.podman_container:
+    name: 'forgejo-db'
+    image: 'forgejo-db.image'
+    network: '{{ forgejo_network_name }}.network'
+    state: 'quadlet'
+    volume:
+      - '{{ forgejo_db_volume_name }}.volume:/var/lib/postgresql/data/'
+    env:
+      POSTGRES_DB: '{{ forgejo_db_database }}'
+      POSTGRES_USER: '{{ forgejo_db_user }}'
+      POSTGRES_PASSWORD: '{{ forgejo_db_password }}'
+    quadlet_options: |
+      [Install]
+      WantedBy=default.target
+  notify:
+    - 'Reload forgejo services'
+    - 'Restart forgejo-db container'
+
+# Application
+- name: 'Prepare config location'
+  become: true
+  ansible.builtin.file:
+    path: '{{ forgejo_conf_path }}'
+    state: 'directory'
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rwx,g=rx,o=rx'
+
+- name: 'Deploy application config'
+  become: true
+  ansible.builtin.template:
+    src: 'forgejo.ini.j2'
+    dest: '{{ forgejo_conf_path }}/forgejo.ini'
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rw,g=r,o=r'
+  notify: 'Restart forgejo-app container'
+
+- name: 'Define forgejo-app image'
+  become: true
+  containers.podman.podman_image:
+    name: '{{ forgejo_app_image_name }}:{{ forgejo_app_image_tag }}'
+    quadlet_filename: 'forgejo-app'
+    state: 'quadlet'
+  notify:
+    - 'Reload forgejo services'
+    - 'Restart forgejo-app image'
+
+- name: 'Create forgejo-app container'
+  become: true
+  containers.podman.podman_container:
+    name: 'forgejo-app'
+    image: 'forgejo-app.image'
+    network: '{{ forgejo_network_name }}.network'
+    state: 'quadlet'
+    volume:
+      - '{{ forgejo_app_volume_name }}.volume:/data/'
+      - '/etc/timezone:/etc/timezone:ro'
+      - '/etc/localtime:/etc/localtime:ro'
+      - '{{ forgejo_conf_path }}/forgejo.ini:/data/gitea/conf/app.ini:ro'
+    env:
+      USER_UID: '1000'
+      USER_GID: '1000'
+      FORGEJO__database__DB_TYPE: 'postgres'
+      FORGEJO__database__HOST: 'forgejo-db:5432'
+      FORGEJO__database__NAME: '{{ forgejo_db_database }}'
+      FORGEJO__database__USER: '{{ forgejo_db_user }}'
+      FORGEJO__database__PASSWD: '{{ forgejo_db_password }}'
+    quadlet_options: |
+      [Install]
+      WantedBy=default.target
+      [Unit]
+      Requires=forgejo-db.service
+      After=forgejo-db.service
+  notify:
+    - 'Reload forgejo services'
+    - 'Restart forgejo-app container'
+
+- name: 'Flush handlers'
+  ansible.builtin.meta: 'flush_handlers'
+
+# Authentication source
+- name: 'Configure forgejo authentication source'
+  become: true
+  when: 'forgejo_sso_create_source'
+  enbewe.forgejo.forgejo_oauth:
+    state: 'present'
+    update: '{{ forgejo_sso_update | default(false) }}'
+    name: '{{ forgejo_sso_name }}'
+    provider: '{{ forgejo_sso_provider }}'
+    key: '{{ forgejo_sso_key }}'
+    secret: '{{ forgejo_sso_secret }}'
+    auto_discover_url: '{{ forgejo_sso_auto_discover_url | default("") }}'
+    use_custom_urls: '{{ forgejo_sso_use_custom_urls | default(false) }}'
+    custom_tenant_id: '{{ forgejo_sso_custom_tenant_id | default("") }}'
+    custom_auth_url: '{{ forgejo_sso_custom_auth_url | default("") }}'
+    custom_token_url: '{{ forgejo_sso_custom_token_url | default("") }}'
+    custom_profile_url: '{{ forgejo_sso_custom_profile_url | default("") }}'
+    custom_email_url: '{{ forgejo_sso_custom_email_url | default("") }}'
+    icon_url: '{{ forgejo_sso_icon_url | default("") }}'
+    skip_local_2fa: '{{ forgejo_sso_skip_local_2fa | default(true) }}'
+    scopes: '{{ forgejo_sso_scopes | default("") }}'
+    required_claim_name: '{{ forgejo_sso_required_claim_name | default("") }}'
+    required_claim_value: '{{ forgejo_sso_required_claim_value | default("") }}'
+    group_claim_name: '{{ forgejo_sso_group_claim_name | default("") }}'
+    admin_group: '{{ forgejo_sso_admin_group | default("") }}'
+    restricted_group: '{{ forgejo_sso_restricted_group | default("") }}'
+    group_team_map: '{{ forgejo_sso_group_team_map | default("") }}'
+    group_team_map_removal: '{{ forgejo_sso_group_team_map_removal | default(false) }}'
+  retries: 5
+  delay: 5
+
+- name: 'Create forgejo-shell on host'
+  become: true
+  ansible.builtin.template:
+    src: 'forgejo-shell.j2'
+    dest: '/usr/local/bin/forgejo-shell'
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rwx,g=rx,o=rx'
+
+- name: 'Create the git user on the host to forward requests to forgejo'
+  become: true
+  ansible.builtin.user:
+    name: 'git'
+    shell: '/usr/local/bin/forgejo-shell'
+
+- name: 'Create the permission for git user to run things in container'
+  become: true
+  ansible.builtin.template:
+    src: 'sudoers-forgejo-shell.j2'
+    dest: '/etc/sudoers.d/forgejo-shell'
+    owner: 'root'
+    group: 'root'
+    mode: 'u=rw,g=r,o='
+
+- name: 'Redirect authorized hosts checks for git user'
+  become: true
+  ansible.builtin.blockinfile:
+    path: '/etc/ssh/sshd_config'
+    append_newline: true
+    prepend_newline: true
+    block: |
+      Match User git
+        AuthorizedKeysCommandUser root
+        AuthorizedKeysCommand /usr/bin/podman exec -u 1000:1000 -i forgejo-app /usr/local/bin/forgejo keys -e git -u %u -t %t -k %k

roles/forgejo/templates/forgejo-shell.j2

@@ -0,0 +1,2 @@
+#!/bin/sh
+sudo /usr/bin/podman exec -u 1000:1000 -i --env SSH_ORIGINAL_COMMAND="$SSH_ORIGINAL_COMMAND" forgejo-app sh "$@"

roles/forgejo/templates/forgejo.ini.j2

@@ -0,0 +1,130 @@
+APP_NAME = {{ forgejo_general_app_name }}
+RUN_MODE = {{ forgejo_general_run_mode | default('prod') }}
+RUN_USER = git
+WORK_PATH = /data/gitea
+
+[repository]
+ROOT = /data/git/repositories
+DEFAULT_PRIVATE = {{ forgejo_repostiory_default_private | default('last') }}
+DISABLE_HTTP_GIT = {{ forgejo_repostiory_disable_http_git | default(false) }}
+ENABLE_PUSH_CREATE_USER = {{ forgejo_repostiory_enable_push_create_user | default(false) }}
+ENABLE_PUSH_CREATE_ORG = {{ forgejo_repostiory_enable_push_create_org | default(false) }}
+
+[repository.pull-request]
+DEFAULT_MERGE_STYLE = merge
+
+[repository.upload]
+TEMP_PATH = /data/gitea/uploads
+
+[repository.signing]
+DEFAULT_TRUST_MODEL = committer
+
+[repository.local]
+LOCAL_COPY_PATH = /data/gitea/tmp/local-repo
+
+[server]
+APP_DATA_PATH = /data/gitea
+DOMAIN = {{ forgejo_server_domain }}
+SSH_DOMAIN = {{ forgejo_server_ssh_domain | default(forgejo_server_domain) }}
+HTTP_PORT = 3000
+ROOT_URL = {{ forgejo_server_root_url }}
+DISABLE_SSH = false
+LFS_START_SERVER = true
+LFS_JWT_SECRET = {{ forgejo_server_lfs_jwt_secret }}
+OFFLINE_MODE = {{ forgejo_server_offline_mode | default(true) }}
+LANDING_PAGE = {{ forgejo_server_landing_page | default('home') }}
+
+[database]
+DB_TYPE = postgres
+HOST = forgejo-db:5432
+NAME = {{ forgejo_db_database }}
+USER = {{ forgejo_db_user }}
+PASSWD = {{ forgejo_db_password }}
+SCHEMA = 
+SSL_MODE = disable
+LOG_SQL = false
+
+[indexer]
+ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
+
+[admin]
+DEFAULT_EMAIL_NOTIFICATIONS = {{ forgejo_admin_default_email_notification | default('enabled') }}
+DISABLE_REGULAR_ORG_CREATION = {{ forgejo_admin_disable_regular_org_creation | default(false) }}
+SEND_NOTIFICATION_EMAIL_ON_NEW_USER = {{ forgejo_admin_send_notification_email_on_new_user | default(false) }}
+
+[security]
+INSTALL_LOCK = true
+SECRET_KEY = {{ forgejo_security_secret_key }}
+REVERSE_PROXY_LIMIT = 1
+REVERSE_PROXY_TRUSTED_PROXIES = *
+INTERNAL_TOKEN = {{ forgejo_security_internal_token }}
+PASSWORD_HASH_ALGO = pbkdf2_hi
+
+[openid]
+ENABLE_OPENID_SIGNIN = {{ forgejo_openid_enable_openid_signin | default(true) }}
+ENABLE_OPENID_SIGNUP = {{ forgejo_openid_enable_openid_signup | default(false) }}
+
+[oauth2_client]
+ENABLE_AUTO_REGISTRATION = {{ forgejo_oauth2_enable_auto_registration | default(false) }}
+
+[service]
+REGISTER_EMAIL_CONFIRM = {{ forgejo_service_register_email_confirm | default(false) }}
+REGISTER_MANUAL_CONFIRM = {{ forgejo_service_register_manual_confirm | default(false) }}
+DISABLE_REGISTRATION = {{ forgejo_service_disable_registration | default(false) }}
+REQUIRE_SIGNIN_VIEW = {{ forgejo_service_require_signin_view | default(true) }}
+ENABLE_NOTIFY_MAIL = {{ forgejo_service_enable_notify_mail | default(false) }}
+ENABLE_CAPTCHA = false
+DEFAULT_KEEP_EMAIL_PRIVATE = {{ forgejo_service_default_keep_email_private | default(true) }}
+DEFAULT_ALLOW_CREATE_ORGANIZATION = {{ forgejo_service_default_allow_create_organization | default(false) }}
+DEFAULT_ENABLE_TIMETRACKING = false
+ALLOW_ONLY_INTERNAL_REGISTRATION = {{ forgejo_service_allow_only_internal_registration | default(false) }}
+ALLOW_ONLY_EXTERNAL_REGISTRATION = {{ forgejo_service_allow_only_external_registration | default(false) }}
+
+[service.explore]
+REQUIRE_SIGNIN_VIEW = {{ forgejo_service_explore_require_signin_view | default(false) }}
+DISABLE_USERS_PAGE = {{ forgejo_service_explore_disable_users_page | default(true) }}
+
+[mailer]
+ENABLED = {{ forgejo_mailer_enabled | default(false) }}
+PROTOCOL = {{ forgejo_mailer_protocol | default('') }}
+SMTP_ADDR = {{ forgejo_mailer_smtp_addr | default('') }}
+SMTP_PORT = {{ forgejo_mailer_smtp_port | default('') }}
+USER = {{ forgejo_mailer_user | default('') }}
+PASSWD = {{ forgejo_mailer_passwd | default('') }}
+FROM = {{ forgejo_mailer_from | default('') }}
+ENVELOPE_FROM = {{ forgejo_mailer_envelope_from | default('') }}
+SUBJECT_PREFIX = {{ forgejo_mailer_subject_prefix | default('') }}
+
+[session]
+PROVIDER = file
+PROVIDER_CONFIG = /data/gitea/sessions
+
+[picture]
+AVATAR_UPLOAD_PATH = /data/gitea/avatars
+REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars
+
+[attachment]
+PATH = /data/gitea/attachments
+
+[log]
+MODE = console
+LEVEL = {{ forgejo_log_level | default('info') }}
+ROOT_PATH = /data/gitea/log
+
+[cron.update_checker]
+ENABLED = true
+
+[oauth2]
+ENABLED = {{ forgejo_oauth2_provider_enabled | default(false) }}
+JWT_SECRET = {{ forgejo_oauth2_jwt_secret }}
+
+[federation]
+ENABLED = {{ forgejo_federation_enabled | default(false) }}
+SHARE_USER_STATISTICS = {{ forgejo_federation_share_user_statistics | default(true) }}
+MAX_SIZE = {{ forgejo_federation_max_size | default(4) }}
+
+[lfs]
+PATH = /data/git/lfs
+
+[actions]
+ENABLED = {{ forgejo_actions_enabled | default(false) }}

roles/forgejo/templates/sudoers-forgejo-shell.j2

@@ -0,0 +1,2 @@
+# Allow access to forgejo-app container
+git ALL = (root) NOPASSWD: /usr/bin/podman