roles/server/gitea: Reworked gitea / service configuration

roles/server/gitea/templates/app.ini

@@ -1,4 +1,5 @@
 ; Configuration for Gitea
+; TODO Fix paths
 
 ; see https://docs.gitea.io/en-us/config-cheat-sheet/ for additional documentation.
 
@@ -139,12 +140,12 @@ HTTP_ADDR = {{ gitea_socket_path }}
 REDIRECT_OTHER_PORT = false
 PORT_TO_REDIRECT = 80
 ; Permission for unix socket
-UNIX_SOCKET_PERMISSION = 660
+UNIX_SOCKET_PERMISSION = 666
 ; Local (DMZ) URL for Gitea workers (such as SSH update) accessing web service.
 ; In most cases you do not need to change the default value.
 ; Alter it only if your SSH server node is not the same as HTTP node.
 ; Do not set this variable if PROTOCOL is set to 'unix'.
-LOCAL_ROOT_URL = %(PROTOCOL)s://%(HTTP_ADDR)s:%(HTTP_PORT)s/
+;LOCAL_ROOT_URL = %(PROTOCOL)s://%(HTTP_ADDR)s:%(HTTP_PORT)s/
 ; Disable SSH feature when not available
 DISABLE_SSH = false
 ; Whether to use the builtin SSH server or not.
@@ -203,11 +204,11 @@ PPROF_DATA_PATH = data/tmp/pprof
 ; Landing page, can be "home", "explore", or "organizations"
 LANDING_PAGE = home
 ; Enables git-lfs support. true or false, default is false.
-LFS_START_SERVER = false
+LFS_START_SERVER = true
 ; Where your lfs files reside, default is data/lfs.
 LFS_CONTENT_PATH = data/lfs
 ; LFS authentication secret, change this yourself
-LFS_JWT_SECRET =
+LFS_JWT_SECRET = `{{ gitea_lfs_jwt_secret }}`
 ; LFS authentication validity period (in time.Duration), pushes taking longer than this may fail.
 LFS_HTTP_AUTH_EXPIRY = 20m
 
@@ -222,10 +223,10 @@ DSA = -1
 ; Either "mysql", "postgres", "mssql" or "sqlite3", it's your choice
 DB_TYPE = mysql
 HOST = 127.0.0.1:3306
-NAME = {{ gitea_sql_name }}
-USER = {{ gitea_sql_user }}
+NAME = {{ gitea_database_name }}
+USER = {{ gitea_database_user }}
 ; Use PASSWD = `your password` for quoting if you use special characters in the password.
-PASSWD = `{{ gitea_sql_pass }}`
+PASSWD = `{{ gitea_database_pass }}`
 ; For Postgres, either "disable" (default), "require", or "verify-full"
 ; For MySQL, either "false" (default), "true", or "skip-verify"
 SSL_MODE = disable
@@ -270,6 +271,8 @@ DISABLE_REGULAR_ORG_CREATION = false
 [security]
 ; Whether the installer is disabled
 INSTALL_LOCK = true
+; Used for internal communication
+INTERNAL_TOKEN = `{{ gitea_internal_token }}`
 ; !!CHANGE THIS TO KEEP YOUR USER DATA SAFE!!
 SECRET_KEY = `{{ gitea_cookie_secret }}`
 ; How long to remember that an user is logged in before requiring relogin (in days)
@@ -513,7 +516,7 @@ MACARON = file
 ROUTER_LOG_LEVEL = Info
 ROUTER = console
 ENABLE_ACCESS_LOG = false
-ACCESS_LOG_TEMPLATE = {{.Ctx.RemoteAddr}} - {{.Identity}} {{.Start.Format "[02/Jan/2006:15:04:05 -0700]" }} "{{.Ctx.Req.Method}} {{.Ctx.Req.RequestURI}} {{.Ctx.Req.Proto}}" {{.ResponseWriter.Status}} {{.ResponseWriter.Size}} "{{.Ctx.Req.Referer}}\" \"{{.Ctx.Req.UserAgent}}"
+ACCESS_LOG_TEMPLATE = {% raw %}{{.Ctx.RemoteAddr}} - {{.Identity}} {{.Start.Format "[02/Jan/2006:15:04:05 -0700]" }} "{{.Ctx.Req.Method}} {{.Ctx.Req.RequestURI}} {{.Ctx.Req.Proto}}" {{.ResponseWriter.Status}} {{.ResponseWriter.Size}} "{{.Ctx.Req.Referer}}\" \"{{.Ctx.Req.UserAgent}}"{% endraw %}
 ACCESS = file
 ; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "Trace"
 LEVEL = Info
@@ -669,7 +672,7 @@ ACCESS_TOKEN_EXPIRATION_TIME=3600
 ; Lifetime of an OAuth2 access token in hours
 REFRESH_TOKEN_EXPIRATION_TIME=730
 ; OAuth2 authentication secret for access and refresh tokens, change this a unique string.
-JWT_SECRET=Bk0yK7Y9g_p56v86KaHqjSbxvNvu3SbKoOdOt2ZcXvU
+JWT_SECRET=`{{ gitea_oauth_jwt_secret }}`
 
 [i18n]
 LANGS = en-US,zh-CN,zh-HK,zh-TW,de-DE,fr-FR,nl-NL,lv-LV,ru-RU,uk-UA,ja-JP,es-ES,pt-BR,pl-PL,bg-BG,it-IT,fi-FI,tr-TR,cs-CZ,sr-SP,sv-SE,ko-KR
@@ -704,7 +707,7 @@ ko-KR = ko
 ; NOTE: THE DEFAULT VALUES HERE WILL NEED TO BE CHANGED
 ; Two Factor authentication with security keys
 ; https://developers.yubico.com/U2F/App_ID.html
-APP_ID = https://{{ domain }}/
+APP_ID = https://{{ domain }}
 ; Comma seperated list of trusted facets
 ;TRUSTED_FACETS = http://localhost:3000/
 

roles/server/gitea/templates/gitea.service

@@ -16,11 +16,11 @@ Type=simple
 User={{ gitea_system_user }}
 Group={{ gitea_system_user }}
 WorkingDirectory={{ gitea_installation_directory }}
-ExecStart="{{ gitea_binary_path }}" web -c /etc/gitea/app.ini "{{ gitea_custom_directory }}/app.ini"
+ExecStart="{{ gitea_binary_path }}" web -c "{{ gitea_configuration_path }}"
 Restart=always
-Environment="USER='{{ gitea_system_user }}'"
-Environment="HOME='{{ gitea_user_directory }}'"
-Environment="GITEA_WORK_DIR='{{ gitea_installation_directory }}'"
+Environment="USER={{ gitea_system_user }}"
+Environment="HOME={{ gitea_user_directory }}"
+Environment="GITEA_WORK_DIR={{ gitea_installation_directory }}"
 
 [Install]
 WantedBy=multi-user.target