Added gitea server with podman
This commit is contained in:
alejo committed
1 parent
aa5776af18
commit
361e1c9b51
4 files changed
+1608
No files matched your search
Executable
+670
@@ -0,0 +1,670 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# setup-git-server.sh
|
||||
#
|
||||
# Sets up a self-hosted Git server (Gitea: https://about.gitea.com) on a
|
||||
# fresh Linux box, with a GitHub-style workflow:
|
||||
# - real user accounts, managed from the command line
|
||||
# - SSH clone/push exactly like GitHub: git@<host>:<user>/<repo>.git
|
||||
# - repos are created automatically on first push (push-to-create) --
|
||||
# no manual "create repo" step needed
|
||||
# - a small web UI for browsing repos, issues, PRs, etc.
|
||||
#
|
||||
# Supported distros: Arch, Debian, Ubuntu, Fedora (and close derivatives).
|
||||
# Must be run as root on a machine where systemd is actually running (a VM
|
||||
# or bare metal -- not a plain Docker container). Written for a first-time
|
||||
# install; re-running it keeps the existing secrets, the service user and
|
||||
# existing accounts.
|
||||
#
|
||||
# Usage:
|
||||
# sudo ./setup-git-server.sh [options]
|
||||
#
|
||||
# Run with --help for the full list of options.
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# Defaults (overridable via env vars, then via flags below)
|
||||
# ----------------------------------------------------------------------------
|
||||
GITEA_USER="${GITEA_USER:-git}"
|
||||
GITEA_HOME="${GITEA_HOME:-/home/${GITEA_USER}}"
|
||||
GITEA_WORK_DIR="${GITEA_WORK_DIR:-/var/lib/gitea}"
|
||||
GITEA_CONFIG_DIR="${GITEA_CONFIG_DIR:-/etc/gitea}"
|
||||
GITEA_CONFIG="${GITEA_CONFIG_DIR}/app.ini"
|
||||
GITEA_BIN="/usr/local/bin/gitea"
|
||||
GITEA_HTTP_PORT="${GITEA_HTTP_PORT:-3000}"
|
||||
GITEA_SSH_PORT="${GITEA_SSH_PORT:-}"
|
||||
GITEA_DOMAIN="${GITEA_DOMAIN:-}"
|
||||
GITEA_VERSION="${GITEA_VERSION:-latest}"
|
||||
GITEA_DISABLE_REGISTRATION="${GITEA_DISABLE_REGISTRATION:-true}"
|
||||
GITEA_ADMIN_USER="${GITEA_ADMIN_USER:-admin}"
|
||||
GITEA_ADMIN_EMAIL="${GITEA_ADMIN_EMAIL:-admin@example.com}"
|
||||
GITEA_ADMIN_PASSWORD="${GITEA_ADMIN_PASSWORD:-}"
|
||||
|
||||
# Filled in while the script runs
|
||||
DISTRO_FAMILY=""
|
||||
GITEA_GROUP=""
|
||||
GITEA_INSTALLED_VERSION=""
|
||||
ADMIN_CREATED="false"
|
||||
TMP_FILE=""
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# Small helpers
|
||||
# ----------------------------------------------------------------------------
|
||||
C_GREEN='\033[0;32m'; C_YELLOW='\033[0;33m'; C_RED='\033[0;31m'; C_RESET='\033[0m'
|
||||
log() { printf '%b\n' "${C_GREEN}[+]${C_RESET} $*"; }
|
||||
warn() { printf '%b\n' "${C_YELLOW}[!]${C_RESET} $*" >&2; }
|
||||
error_exit() { printf '%b\n' "${C_RED}[x]${C_RESET} $*" >&2; exit 1; }
|
||||
|
||||
cleanup() {
|
||||
if [[ -n "${TMP_FILE:-}" ]]; then
|
||||
rm -f -- "$TMP_FILE" "${TMP_FILE}.sha256"
|
||||
fi
|
||||
}
|
||||
trap cleanup EXIT
|
||||
|
||||
print_help() {
|
||||
cat <<'EOF'
|
||||
Usage: sudo ./setup-git-server.sh [options]
|
||||
|
||||
Sets up a self-hosted Gitea git server (Arch, Debian, Ubuntu, Fedora)
|
||||
with GitHub-style SSH access (git@host:user/repo.git) and automatic
|
||||
repo creation on first push.
|
||||
|
||||
Options:
|
||||
--domain <host> Hostname/IP used in clone URLs (default: auto-detected)
|
||||
--http-port <port> Web UI port (default: 3000)
|
||||
--ssh-port <port> SSH port (default: read from sshd config, else 22)
|
||||
--version <tag> Gitea version, e.g. 1.27.3 (default: latest release)
|
||||
--admin-user <name> Initial admin username (default: admin)
|
||||
--admin-email <email> Initial admin email (default: admin@example.com)
|
||||
--admin-password <pass> Initial admin password, 8+ chars (default: randomly generated)
|
||||
--allow-registration Let anyone sign up from the web UI (default: off)
|
||||
-h, --help Show this help and exit
|
||||
|
||||
Every option can also be set as an environment variable of the same
|
||||
name in caps, e.g.:
|
||||
GITEA_DOMAIN=git.example.com sudo -E ./setup-git-server.sh
|
||||
EOF
|
||||
}
|
||||
|
||||
require_root() {
|
||||
if [[ "${EUID}" -ne 0 ]]; then
|
||||
error_exit "Please run this script as root, e.g.: sudo $0"
|
||||
fi
|
||||
command -v systemctl &>/dev/null || error_exit "This script requires systemd."
|
||||
# The systemctl binary can exist without systemd actually running (Docker,
|
||||
# chroots, WSL without systemd) -- every enable/start below would then fail.
|
||||
[[ -d /run/systemd/system ]] \
|
||||
|| error_exit "systemd is not running as init here (container/chroot/WSL?). Run this on a real VM or host."
|
||||
}
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# Argument parsing + validation
|
||||
# ----------------------------------------------------------------------------
|
||||
need_arg() { # usage: need_arg "$@" -- an option that takes a value must have one
|
||||
[[ $# -ge 2 ]] || error_exit "Option $1 needs a value (see --help)"
|
||||
}
|
||||
|
||||
parse_args() {
|
||||
while [[ $# -gt 0 ]]; do
|
||||
case "$1" in
|
||||
--domain) need_arg "$@"; GITEA_DOMAIN="$2"; shift 2 ;;
|
||||
--http-port) need_arg "$@"; GITEA_HTTP_PORT="$2"; shift 2 ;;
|
||||
--ssh-port) need_arg "$@"; GITEA_SSH_PORT="$2"; shift 2 ;;
|
||||
--version) need_arg "$@"; GITEA_VERSION="$2"; shift 2 ;;
|
||||
--admin-user) need_arg "$@"; GITEA_ADMIN_USER="$2"; shift 2 ;;
|
||||
--admin-email) need_arg "$@"; GITEA_ADMIN_EMAIL="$2"; shift 2 ;;
|
||||
--admin-password) need_arg "$@"; GITEA_ADMIN_PASSWORD="$2"; shift 2 ;;
|
||||
--allow-registration) GITEA_DISABLE_REGISTRATION="false"; shift ;;
|
||||
-h|--help) print_help; exit 0 ;;
|
||||
*) error_exit "Unknown option: $1 (see --help)" ;;
|
||||
esac
|
||||
done
|
||||
}
|
||||
|
||||
validate_port() { # usage: validate_port <value> <what>
|
||||
if [[ ! "$1" =~ ^[0-9]+$ ]] || (( 10#$1 < 1 || 10#$1 > 65535 )); then
|
||||
error_exit "Invalid $2: '$1' (expected a port number 1-65535)"
|
||||
fi
|
||||
}
|
||||
|
||||
validate_settings() {
|
||||
validate_port "$GITEA_HTTP_PORT" "HTTP port"
|
||||
if [[ -n "$GITEA_SSH_PORT" ]]; then
|
||||
validate_port "$GITEA_SSH_PORT" "SSH port"
|
||||
fi
|
||||
[[ "$GITEA_ADMIN_USER" =~ ^[A-Za-z0-9][A-Za-z0-9._-]*$ ]] \
|
||||
|| error_exit "Invalid admin username '${GITEA_ADMIN_USER}' (letters, digits, '.', '_' and '-' only)."
|
||||
[[ "$GITEA_ADMIN_EMAIL" == ?*@?* ]] \
|
||||
|| error_exit "Invalid admin email '${GITEA_ADMIN_EMAIL}'."
|
||||
(( ${#GITEA_ADMIN_PASSWORD} >= 8 )) \
|
||||
|| error_exit "The admin password must be at least 8 characters (Gitea's default minimum)."
|
||||
}
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# Detection helpers
|
||||
# ----------------------------------------------------------------------------
|
||||
detect_distro_family() {
|
||||
[[ -r /etc/os-release ]] || error_exit "Cannot read /etc/os-release; unsupported system."
|
||||
# shellcheck disable=SC1091
|
||||
. /etc/os-release
|
||||
case "${ID:-}" in
|
||||
ubuntu|debian|linuxmint|pop|raspbian) DISTRO_FAMILY="debian" ;;
|
||||
fedora|rhel|centos|rocky|almalinux|nobara) DISTRO_FAMILY="fedora" ;;
|
||||
arch|archarm|manjaro|endeavouros) DISTRO_FAMILY="arch" ;;
|
||||
*)
|
||||
case "${ID_LIKE:-}" in
|
||||
*debian*) DISTRO_FAMILY="debian" ;;
|
||||
*fedora*|*rhel*) DISTRO_FAMILY="fedora" ;;
|
||||
*arch*) DISTRO_FAMILY="arch" ;;
|
||||
*) error_exit "Unsupported distro: ${PRETTY_NAME:-${ID:-unknown}}. This script supports Arch, Debian, Ubuntu and Fedora." ;;
|
||||
esac
|
||||
;;
|
||||
esac
|
||||
log "Detected ${PRETTY_NAME:-${ID:-unknown}} -> using ${DISTRO_FAMILY} package family."
|
||||
}
|
||||
|
||||
detect_arch() {
|
||||
case "$(uname -m)" in
|
||||
x86_64|amd64) echo "amd64" ;;
|
||||
aarch64|arm64) echo "arm64" ;;
|
||||
# Gitea publishes arm-5, arm-6 and arm64 builds -- there is no arm-7.
|
||||
# The arm-6 build runs fine on ARMv7 machines.
|
||||
armv7l|armv7|armv6l) echo "arm-6" ;;
|
||||
armv5*) echo "arm-5" ;;
|
||||
i386|i686) echo "386" ;;
|
||||
riscv64) echo "riscv64" ;;
|
||||
*) error_exit "Unsupported CPU architecture: $(uname -m)" ;;
|
||||
esac
|
||||
}
|
||||
|
||||
detect_domain() {
|
||||
local ip=""
|
||||
ip=$(ip -4 route get 1.1.1.1 2>/dev/null | awk '/src/{for(i=1;i<=NF;i++) if ($i=="src") print $(i+1)}') || true
|
||||
if [[ -z "$ip" ]]; then
|
||||
ip=$(hostname -I 2>/dev/null | awk '{print $1}') || true
|
||||
fi
|
||||
if [[ -n "$ip" ]]; then
|
||||
echo "$ip"; return
|
||||
fi
|
||||
if [[ -r /etc/hostname ]]; then
|
||||
local h=""; h=$(< /etc/hostname)
|
||||
if [[ -n "$h" ]]; then echo "$h"; return; fi
|
||||
fi
|
||||
echo "localhost"
|
||||
}
|
||||
|
||||
detect_ssh_port() {
|
||||
local port="" sshd_bin=""
|
||||
sshd_bin="$(command -v sshd 2>/dev/null || true)"
|
||||
if [[ -z "$sshd_bin" && -x /usr/sbin/sshd ]]; then
|
||||
sshd_bin=/usr/sbin/sshd
|
||||
fi
|
||||
# 'sshd -T' prints the effective config (includes and drop-ins resolved)...
|
||||
if [[ -n "$sshd_bin" ]]; then
|
||||
port=$("$sshd_bin" -T 2>/dev/null | awk '$1 == "port" { print $2; exit }') || true
|
||||
fi
|
||||
# ...falling back to a plain look at the config files.
|
||||
if [[ -z "$port" ]]; then
|
||||
port=$(cat /etc/ssh/sshd_config /etc/ssh/sshd_config.d/*.conf 2>/dev/null \
|
||||
| awk 'tolower($1) == "port" && $2 ~ /^[0-9]+$/ { print $2; exit }') || true
|
||||
fi
|
||||
echo "${port:-22}"
|
||||
}
|
||||
|
||||
generate_password() {
|
||||
tr -dc 'A-Za-z0-9' </dev/urandom 2>/dev/null | head -c 20 || true
|
||||
}
|
||||
|
||||
get_latest_version() {
|
||||
local latest="" json=""
|
||||
# 1) Gitea's own version feed -- the one its built-in update checker and
|
||||
# contrib/upgrade.sh use. Same host the binary comes from, no API rate limit.
|
||||
json=$(curl -fsSL --max-time 20 https://dl.gitea.com/gitea/version.json 2>/dev/null) || true
|
||||
latest=$(printf '%s' "$json" | tr -d '\n' | awk '
|
||||
{ i = index($0, "\"latest\"")
|
||||
if (i && match(substr($0, i), /"version"[[:space:]]*:[[:space:]]*"v?[0-9][^"]*"/)) {
|
||||
v = substr($0, i + RSTART - 1, RLENGTH)
|
||||
sub(/^"version"[[:space:]]*:[[:space:]]*"v?/, "", v); sub(/"$/, "", v); print v } }') || true
|
||||
# 2) Fallback: the GitHub API. Anonymous requests are capped at 60/hour per
|
||||
# IP, which shared VPS/NAT addresses regularly use up.
|
||||
if [[ -z "$latest" ]]; then
|
||||
latest=$(curl -fsSL --max-time 20 https://api.github.com/repos/go-gitea/gitea/releases/latest 2>/dev/null \
|
||||
| sed -nE 's/.*"tag_name"[[:space:]]*:[[:space:]]*"v?([^"]+)".*/\1/p' \
|
||||
| head -n1) || true
|
||||
fi
|
||||
echo "$latest"
|
||||
}
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# Install steps
|
||||
# ----------------------------------------------------------------------------
|
||||
install_dependencies() {
|
||||
log "Installing dependencies..."
|
||||
case "$DISTRO_FAMILY" in
|
||||
debian)
|
||||
export DEBIAN_FRONTEND=noninteractive
|
||||
apt-get update
|
||||
apt-get install -y git curl ca-certificates openssh-server sudo
|
||||
;;
|
||||
fedora)
|
||||
dnf install -y git ca-certificates openssh-server sudo
|
||||
# Some Fedora/RHEL images ship curl-minimal, which conflicts with the
|
||||
# full curl package -- only install curl when there is none at all.
|
||||
command -v curl &>/dev/null || dnf install -y curl
|
||||
;;
|
||||
arch)
|
||||
# Never do a partial upgrade (-Sy without -u) on Arch.
|
||||
pacman -Syu --noconfirm --needed git curl ca-certificates openssh sudo
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
enable_sshd() {
|
||||
log "Making sure the SSH server is enabled..."
|
||||
local unit
|
||||
# (No 'systemctl list-unit-files | grep -q' here: under pipefail, grep -q
|
||||
# exiting early can make the pipeline report failure.)
|
||||
for unit in ssh.service sshd.service; do
|
||||
if systemctl cat "$unit" &>/dev/null; then
|
||||
systemctl enable --now "$unit"
|
||||
return 0
|
||||
fi
|
||||
done
|
||||
warn "Could not find an ssh/sshd systemd unit. Make sure OpenSSH server is installed and running."
|
||||
}
|
||||
|
||||
create_git_user() {
|
||||
if id -u "$GITEA_USER" &>/dev/null; then
|
||||
log "User '${GITEA_USER}' already exists, leaving it alone."
|
||||
else
|
||||
log "Creating system user '${GITEA_USER}'..."
|
||||
useradd --system --user-group --shell /bin/bash --comment 'Git Version Control' \
|
||||
--create-home --home-dir "$GITEA_HOME" "$GITEA_USER"
|
||||
# 'useradd --system' leaves the password locked ("!"). sshd only refuses
|
||||
# locked accounts when UsePAM is off; "*" (no valid password, but not
|
||||
# locked) makes key logins work whatever the sshd config says.
|
||||
usermod --password '*' "$GITEA_USER"
|
||||
fi
|
||||
|
||||
# Use what the system really has (matters when the user already existed).
|
||||
local entry
|
||||
entry="$(getent passwd "$GITEA_USER")"
|
||||
GITEA_HOME="$(cut -d: -f6 <<<"$entry")"
|
||||
GITEA_GROUP="$(id -gn "$GITEA_USER")"
|
||||
case "$(cut -d: -f7 <<<"$entry")" in
|
||||
*/nologin|*/false|*/git-shell)
|
||||
warn "User '${GITEA_USER}' has a non-interactive login shell, so SSH pushes will fail. Fix: usermod -s /bin/bash ${GITEA_USER}"
|
||||
;;
|
||||
esac
|
||||
}
|
||||
|
||||
setup_directories() {
|
||||
log "Setting up directories..."
|
||||
mkdir -p "$GITEA_WORK_DIR"/{custom,data,log}
|
||||
chown -R "${GITEA_USER}:${GITEA_GROUP}" "$GITEA_WORK_DIR"
|
||||
chmod -R 750 "$GITEA_WORK_DIR"
|
||||
|
||||
mkdir -p "$GITEA_CONFIG_DIR"
|
||||
chown "root:${GITEA_GROUP}" "$GITEA_CONFIG_DIR"
|
||||
chmod 750 "$GITEA_CONFIG_DIR"
|
||||
|
||||
install -d -m 700 -o "$GITEA_USER" -g "$GITEA_GROUP" "${GITEA_HOME}/.ssh"
|
||||
if [[ ! -f "${GITEA_HOME}/.ssh/authorized_keys" ]]; then
|
||||
install -m 600 -o "$GITEA_USER" -g "$GITEA_GROUP" /dev/null "${GITEA_HOME}/.ssh/authorized_keys"
|
||||
fi
|
||||
|
||||
install -d -m 750 -o "$GITEA_USER" -g "$GITEA_GROUP" "${GITEA_HOME}/gitea-repositories"
|
||||
}
|
||||
|
||||
install_gitea_binary() {
|
||||
local arch version url
|
||||
arch="$(detect_arch)"
|
||||
if [[ "$GITEA_VERSION" == "latest" ]]; then
|
||||
log "Looking up the latest Gitea release..."
|
||||
version="$(get_latest_version)"
|
||||
[[ -n "$version" ]] || error_exit "Could not determine the latest Gitea version (dl.gitea.com and the GitHub API were both unreachable or rate-limited). Re-run with --version <x.y.z>."
|
||||
else
|
||||
version="${GITEA_VERSION#v}" # accept both 1.27.3 and v1.27.3
|
||||
fi
|
||||
log "Installing Gitea v${version} (linux-${arch})..."
|
||||
url="https://dl.gitea.com/gitea/${version}/gitea-${version}-linux-${arch}"
|
||||
TMP_FILE="$(mktemp)"
|
||||
curl -fL --retry 3 --retry-delay 2 -o "$TMP_FILE" "$url" \
|
||||
|| error_exit "Failed to download Gitea from $url -- check the version/architecture and try again."
|
||||
|
||||
if curl -fsSL -o "${TMP_FILE}.sha256" "${url}.sha256" 2>/dev/null; then
|
||||
local expected actual
|
||||
expected="$(awk '{print $1}' "${TMP_FILE}.sha256")"
|
||||
actual="$(sha256sum "$TMP_FILE" | awk '{print $1}')"
|
||||
if [[ -n "$expected" ]]; then
|
||||
if [[ "$expected" != "$actual" ]]; then
|
||||
error_exit "Checksum verification failed for the downloaded Gitea binary. Aborting."
|
||||
fi
|
||||
log "Checksum verified."
|
||||
else
|
||||
warn "Downloaded checksum file was empty; skipping verification."
|
||||
fi
|
||||
else
|
||||
warn "No checksum file published for this release; skipping verification."
|
||||
fi
|
||||
|
||||
install -m 755 -o root -g root "$TMP_FILE" "$GITEA_BIN"
|
||||
"$GITEA_BIN" --version >/dev/null 2>&1 \
|
||||
|| error_exit "The downloaded binary does not run on this machine ($(uname -m))."
|
||||
GITEA_INSTALLED_VERSION="$version"
|
||||
}
|
||||
|
||||
# --- app.ini -----------------------------------------------------------------
|
||||
|
||||
config_value() { # usage: config_value KEY -> current value of KEY in app.ini (empty if none)
|
||||
local key="$1"
|
||||
[[ -r "$GITEA_CONFIG" ]] || return 0
|
||||
sed -nE "s/^[[:space:]]*${key}[[:space:]]*=[[:space:]]*(.*[^[:space:]])[[:space:]]*\$/\\1/p" "$GITEA_CONFIG" | head -n1
|
||||
}
|
||||
|
||||
secret_for() { # usage: secret_for <app.ini key> <'gitea generate secret' type>
|
||||
local value=""
|
||||
value="$(config_value "$1")" # re-runs keep the secrets from the last run
|
||||
if [[ -z "$value" ]]; then
|
||||
value="$("$GITEA_BIN" generate secret "$2")" \
|
||||
|| error_exit "'gitea generate secret $2' failed."
|
||||
fi
|
||||
[[ -n "$value" ]] || error_exit "Got an empty value for $1."
|
||||
printf '%s' "$value"
|
||||
}
|
||||
|
||||
write_config() {
|
||||
local secret_key internal_token lfs_jwt_secret oauth2_jwt_secret
|
||||
|
||||
if [[ -f "$GITEA_CONFIG" ]]; then
|
||||
cp -p "$GITEA_CONFIG" "${GITEA_CONFIG}.bak.$(date +%s)"
|
||||
warn "Existing ${GITEA_CONFIG} found; backed it up (its secrets are kept, the rest is rewritten)."
|
||||
fi
|
||||
|
||||
log "Generating secrets and writing ${GITEA_CONFIG}..."
|
||||
# Every secret that Gitea would otherwise generate itself and try to write
|
||||
# back into app.ini on first start has to be in the file already. app.ini is
|
||||
# read-only for the service user, so a missing oauth2 JWT_SECRET, LFS_JWT_SECRET
|
||||
# or INTERNAL_TOKEN makes Gitea abort at startup ("save oauth2.JWT_SECRET
|
||||
# failed: ...permission denied"). WORK_PATH is set below so it doesn't try to
|
||||
# write that back either (it would only log an error, but every start).
|
||||
secret_key="$(secret_for SECRET_KEY SECRET_KEY)"
|
||||
internal_token="$(secret_for INTERNAL_TOKEN INTERNAL_TOKEN)"
|
||||
lfs_jwt_secret="$(secret_for LFS_JWT_SECRET JWT_SECRET)"
|
||||
oauth2_jwt_secret="$(secret_for JWT_SECRET JWT_SECRET)"
|
||||
|
||||
# Create the file with its final ownership/permissions *before* the secrets go in.
|
||||
: > "$GITEA_CONFIG"
|
||||
chown "root:${GITEA_GROUP}" "$GITEA_CONFIG"
|
||||
chmod 640 "$GITEA_CONFIG"
|
||||
|
||||
cat > "$GITEA_CONFIG" <<EOF
|
||||
APP_NAME = Gitea
|
||||
RUN_USER = ${GITEA_USER}
|
||||
RUN_MODE = prod
|
||||
; Also used by the 'gitea serv' / hook processes that sshd and git start
|
||||
; without any environment -- without it they fall back to /usr/local/bin.
|
||||
WORK_PATH = ${GITEA_WORK_DIR}
|
||||
|
||||
[server]
|
||||
PROTOCOL = http
|
||||
DOMAIN = ${GITEA_DOMAIN}
|
||||
HTTP_ADDR = 0.0.0.0
|
||||
HTTP_PORT = ${GITEA_HTTP_PORT}
|
||||
ROOT_URL = http://${GITEA_DOMAIN}:${GITEA_HTTP_PORT}/
|
||||
APP_DATA_PATH = ${GITEA_WORK_DIR}/data
|
||||
DISABLE_SSH = false
|
||||
START_SSH_SERVER = false
|
||||
SSH_DOMAIN = ${GITEA_DOMAIN}
|
||||
SSH_PORT = ${GITEA_SSH_PORT}
|
||||
SSH_CREATE_AUTHORIZED_KEYS_FILE = true
|
||||
LFS_START_SERVER = true
|
||||
LFS_JWT_SECRET = ${lfs_jwt_secret}
|
||||
|
||||
[database]
|
||||
DB_TYPE = sqlite3
|
||||
PATH = ${GITEA_WORK_DIR}/data/gitea.db
|
||||
|
||||
[repository]
|
||||
ROOT = ${GITEA_HOME}/gitea-repositories
|
||||
DEFAULT_BRANCH = main
|
||||
ENABLE_PUSH_CREATE_USER = true
|
||||
ENABLE_PUSH_CREATE_ORG = true
|
||||
DEFAULT_PUSH_CREATE_PRIVATE = true
|
||||
|
||||
[security]
|
||||
INSTALL_LOCK = true
|
||||
SECRET_KEY = ${secret_key}
|
||||
INTERNAL_TOKEN = ${internal_token}
|
||||
|
||||
[oauth2]
|
||||
JWT_SECRET = ${oauth2_jwt_secret}
|
||||
|
||||
[service]
|
||||
DISABLE_REGISTRATION = ${GITEA_DISABLE_REGISTRATION}
|
||||
REQUIRE_SIGNIN_VIEW = true
|
||||
DEFAULT_KEEP_EMAIL_PRIVATE = true
|
||||
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
|
||||
|
||||
[log]
|
||||
MODE = console
|
||||
LEVEL = info
|
||||
ROOT_PATH = ${GITEA_WORK_DIR}/log
|
||||
EOF
|
||||
}
|
||||
|
||||
# --- running gitea as the service user ---------------------------------------
|
||||
|
||||
run_as_gitea() {
|
||||
# Run a command as the service user, from a directory it can read (sudo keeps
|
||||
# the caller's cwd, e.g. /root), with the same work dir the service uses.
|
||||
( cd "$GITEA_WORK_DIR" && sudo -H -u "$GITEA_USER" env GITEA_WORK_DIR="$GITEA_WORK_DIR" "$@" )
|
||||
}
|
||||
|
||||
init_database() {
|
||||
# On a re-run the old service may still be up; don't migrate underneath it.
|
||||
if systemctl is-active --quiet gitea 2>/dev/null; then
|
||||
systemctl stop gitea
|
||||
fi
|
||||
# 'gitea admin user create' does NOT create the schema -- 'gitea migrate' does.
|
||||
log "Initialising the database..."
|
||||
run_as_gitea "$GITEA_BIN" --config "$GITEA_CONFIG" migrate \
|
||||
|| error_exit "'gitea migrate' failed -- see the error above."
|
||||
}
|
||||
|
||||
admin_user_exists() {
|
||||
run_as_gitea "$GITEA_BIN" --config "$GITEA_CONFIG" admin user list 2>/dev/null \
|
||||
| awk -v u="$GITEA_ADMIN_USER" 'NR > 1 && tolower($2) == tolower(u) { found = 1 } END { exit !found }'
|
||||
}
|
||||
|
||||
create_admin_user() {
|
||||
log "Creating admin user '${GITEA_ADMIN_USER}'..."
|
||||
if run_as_gitea "$GITEA_BIN" --config "$GITEA_CONFIG" admin user create \
|
||||
--username "$GITEA_ADMIN_USER" \
|
||||
--password "$GITEA_ADMIN_PASSWORD" \
|
||||
--email "$GITEA_ADMIN_EMAIL" \
|
||||
--admin --must-change-password=false; then
|
||||
ADMIN_CREATED="true"
|
||||
log "Admin user created."
|
||||
elif admin_user_exists; then
|
||||
warn "User '${GITEA_ADMIN_USER}' already exists (previous run?); leaving it and its password unchanged."
|
||||
else
|
||||
error_exit "Could not create the admin user -- see the error above."
|
||||
fi
|
||||
}
|
||||
|
||||
write_systemd_unit() {
|
||||
log "Creating the systemd service..."
|
||||
cat > /etc/systemd/system/gitea.service <<EOF
|
||||
[Unit]
|
||||
Description=Gitea (Git with a cup of tea)
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
RestartSec=2s
|
||||
Type=simple
|
||||
User=${GITEA_USER}
|
||||
Group=${GITEA_GROUP}
|
||||
WorkingDirectory=${GITEA_WORK_DIR}
|
||||
ExecStart=${GITEA_BIN} web --config ${GITEA_CONFIG}
|
||||
Restart=always
|
||||
Environment=USER=${GITEA_USER} HOME=${GITEA_HOME} GITEA_WORK_DIR=${GITEA_WORK_DIR}
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
EOF
|
||||
systemctl daemon-reload
|
||||
systemctl enable gitea
|
||||
systemctl restart gitea
|
||||
}
|
||||
|
||||
wait_for_gitea() {
|
||||
log "Waiting for Gitea to come up..."
|
||||
for _ in $(seq 1 60); do
|
||||
# /api/healthz needs no login (the front page redirects to the sign-in
|
||||
# page under REQUIRE_SIGNIN_VIEW) and only answers 2xx when the database
|
||||
# is reachable too.
|
||||
if curl -fsS -o /dev/null "http://127.0.0.1:${GITEA_HTTP_PORT}/api/healthz" 2>/dev/null; then
|
||||
log "Gitea is up."
|
||||
return 0
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
warn "Gitea did not answer on port ${GITEA_HTTP_PORT} within 60s. Last log lines:"
|
||||
journalctl -u gitea -n 30 --no-pager >&2 || true
|
||||
error_exit "Gitea failed to start -- fix the problem shown above (full log: journalctl -u gitea)."
|
||||
}
|
||||
|
||||
write_adduser_helper() {
|
||||
cat > /usr/local/bin/gitea-adduser <<EOF
|
||||
#!/usr/bin/env bash
|
||||
# Convenience wrapper around 'gitea admin user create'.
|
||||
# Examples:
|
||||
# sudo gitea-adduser --username alice --email alice@example.com --password 'TempPass123!'
|
||||
# sudo gitea-adduser --username bob --email bob@example.com --password 'TempPass123!' --admin
|
||||
[[ \$EUID -eq 0 ]] || exec sudo "\$0" "\$@"
|
||||
cd ${GITEA_WORK_DIR}
|
||||
exec sudo -H -u ${GITEA_USER} env GITEA_WORK_DIR=${GITEA_WORK_DIR} ${GITEA_BIN} --config ${GITEA_CONFIG} admin user create "\$@"
|
||||
EOF
|
||||
chmod 755 /usr/local/bin/gitea-adduser
|
||||
}
|
||||
|
||||
configure_firewall() {
|
||||
if command -v ufw &>/dev/null && [[ "$(ufw status 2>/dev/null)" == *"Status: active"* ]]; then
|
||||
log "Opening ports in ufw..."
|
||||
ufw allow "${GITEA_SSH_PORT}/tcp" || true
|
||||
ufw allow "${GITEA_HTTP_PORT}/tcp" || true
|
||||
elif command -v firewall-cmd &>/dev/null && systemctl is-active --quiet firewalld 2>/dev/null; then
|
||||
log "Opening ports in firewalld..."
|
||||
firewall-cmd --permanent --add-port="${GITEA_SSH_PORT}/tcp" || true
|
||||
firewall-cmd --permanent --add-port="${GITEA_HTTP_PORT}/tcp" || true
|
||||
firewall-cmd --reload || true
|
||||
else
|
||||
log "No active firewall manager (ufw/firewalld) found; nothing to configure there."
|
||||
fi
|
||||
}
|
||||
|
||||
apply_selinux_context() {
|
||||
if command -v restorecon &>/dev/null; then
|
||||
log "Applying SELinux file contexts..."
|
||||
restorecon -Rv "$GITEA_BIN" "$GITEA_WORK_DIR" "$GITEA_CONFIG_DIR" "$GITEA_HOME" &>/dev/null || true
|
||||
fi
|
||||
}
|
||||
|
||||
print_summary() {
|
||||
local registration="enabled" admin_password_line
|
||||
if [[ "$GITEA_DISABLE_REGISTRATION" == "true" ]]; then
|
||||
registration="disabled"
|
||||
fi
|
||||
if [[ "$ADMIN_CREATED" == "true" ]]; then
|
||||
admin_password_line="${GITEA_ADMIN_PASSWORD} (log in and change/rotate it)"
|
||||
else
|
||||
admin_password_line="(account already existed -- password left unchanged)"
|
||||
fi
|
||||
|
||||
cat <<EOF
|
||||
|
||||
============================================================================
|
||||
Gitea is installed and running (version ${GITEA_INSTALLED_VERSION})
|
||||
============================================================================
|
||||
|
||||
Web UI http://${GITEA_DOMAIN}:${GITEA_HTTP_PORT}/
|
||||
Admin user ${GITEA_ADMIN_USER}
|
||||
Admin email ${GITEA_ADMIN_EMAIL}
|
||||
Admin password ${admin_password_line}
|
||||
|
||||
Clone and push over SSH, exactly like GitHub:
|
||||
|
||||
git@${GITEA_DOMAIN}:<username>/<repo>.git
|
||||
|
||||
A repo doesn't need to be created first -- the first push creates it
|
||||
(as a private repo by default):
|
||||
|
||||
mkdir myproject && cd myproject && git init
|
||||
git commit --allow-empty -m "init"
|
||||
git remote add origin git@${GITEA_DOMAIN}:${GITEA_ADMIN_USER}/myproject.git
|
||||
git push -u origin main
|
||||
|
||||
Each user needs an SSH key on file before they can push: Web UI ->
|
||||
Settings -> SSH / GPG Keys -> Add Key.
|
||||
|
||||
Add more accounts any time with:
|
||||
|
||||
sudo gitea-adduser --username <name> --email <email> --password '<temp-pass>'
|
||||
|
||||
Useful commands:
|
||||
systemctl status gitea
|
||||
systemctl restart gitea
|
||||
journalctl -u gitea -f
|
||||
Config: ${GITEA_CONFIG}
|
||||
Repo storage: ${GITEA_HOME}/gitea-repositories
|
||||
|
||||
Public sign-up from the web UI: ${registration} (see [service] DISABLE_REGISTRATION in the config)
|
||||
|
||||
This is plain HTTP -- fine on a LAN or over a VPN. For anything reachable
|
||||
from the open internet: put it behind a reverse proxy (nginx/Caddy) with
|
||||
a real TLS certificate, and double check any cloud provider firewall /
|
||||
security group rules in addition to the local firewall this script
|
||||
already configured.
|
||||
============================================================================
|
||||
EOF
|
||||
}
|
||||
|
||||
# ----------------------------------------------------------------------------
|
||||
# Main
|
||||
# ----------------------------------------------------------------------------
|
||||
main() {
|
||||
require_root
|
||||
: "${GITEA_ADMIN_PASSWORD:=$(generate_password)}"
|
||||
validate_settings
|
||||
detect_distro_family
|
||||
|
||||
install_dependencies
|
||||
enable_sshd
|
||||
|
||||
# These need tools/services installed above (ip, sshd), so detect them now.
|
||||
: "${GITEA_DOMAIN:=$(detect_domain)}"
|
||||
: "${GITEA_SSH_PORT:=$(detect_ssh_port)}"
|
||||
|
||||
create_git_user
|
||||
setup_directories
|
||||
install_gitea_binary
|
||||
write_config
|
||||
init_database
|
||||
create_admin_user
|
||||
write_systemd_unit
|
||||
wait_for_gitea
|
||||
write_adduser_helper
|
||||
configure_firewall
|
||||
apply_selinux_context
|
||||
print_summary
|
||||
}
|
||||
|
||||
# Only run when executed, not when sourced (handy for testing single functions).
|
||||
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
|
||||
parse_args "$@"
|
||||
main
|
||||
fi
|
||||
|
||||
Reference in new issue
Block a user