feat(deploy): add canonical Gitea recovery flows

2026-08-22 11:14:33 +03:00
parent a9ea31f00a
commit 502acd3771
14 changed files with 15257 additions and 4 deletions
@@ -0,0 +1,42 @@
+{
+  "schemaVersion": "nodedc.gitea.fresh-install.v1",
+  "action": "fresh-install",
+  "component": "gitea",
+  "installRoot": "/volume1/docker/nodedc-gitea",
+  "compose": {
+    "file": "docker-compose.gitea.yml",
+    "project": "nodedc-gitea",
+    "service": "gitea",
+    "sha256": "25868a40996c405543b4627d06499b68f43556e607d839e969a400b0bc0ddadb"
+  },
+  "runtime": {
+    "image": "docker.gitea.com/gitea:1.27.1-rootless@sha256:89dc3c214b3992e5bb01e05ad21139d7a8b302d3ea3d8942d3f7e904e92af148",
+    "platform": "linux/amd64",
+    "pullPolicy": "never",
+    "minimumComposeVersion": "2.20.1",
+    "transport": "unix:/run/gitea/gitea.sock",
+    "socketBind": "/volume1/docker/nodedc-gitea/socket:/run/gitea",
+    "ssh": "disabled-no-published-port",
+    "database": "fresh-sqlite-only",
+    "lfs": "disabled-pending-reviewed-restore-transition",
+    "networkMode": "none",
+    "logging": "bounded-json-file-10m-x3",
+    "stopGracePeriod": "30s"
+  },
+  "trust": {
+    "artifactSecrets": "forbidden",
+    "runtimeSecrets": "runner-managed-file-mounts",
+    "legacyRootAccess": "forbidden",
+    "legacyDatabaseImport": "forbidden",
+    "legacyRepositoryImport": "forbidden"
+  },
+  "reverseProxyPrerequisite": {
+    "managedOutsideArtifact": true,
+    "requiredDsmUpstream": "127.0.0.1:3000",
+    "requiredNginxBridge": "/usr/local/etc/nginx/conf.d/http.nodedc-gitea-uds.conf",
+    "requiredNginxBridgeSha256": "164f37a12a4f91e656cf20bd5b109978d16d723bdfde236653722aaf820780c9",
+    "requiredUnixUpstream": "/volume1/docker/nodedc-gitea/socket/gitea.sock",
+    "mustBeCompletedBeforeApply": true
+  },
+  "rollback": "stop-candidate-preserve-fresh-runtime-state-and-restore-source"
+}
@@ -0,0 +1,128 @@
+name: nodedc-gitea
+
+services:
+  gitea:
+    image: docker.gitea.com/gitea:1.27.1-rootless@sha256:89dc3c214b3992e5bb01e05ad21139d7a8b302d3ea3d8942d3f7e904e92af148
+    platform: linux/amd64
+    pull_policy: never
+    network_mode: none
+    user: "1000:1000"
+    restart: unless-stopped
+    stop_grace_period: 30s
+    init: true
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 512
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    environment:
+      GITEA_WORK_DIR: /var/lib/gitea
+      GITEA__database__DB_TYPE: sqlite3
+      GITEA__database__PATH: /var/lib/gitea/data/gitea.db
+      GITEA__server__DOMAIN: git.dcserve.ru
+      GITEA__server__ROOT_URL: https://git.dcserve.ru/
+      GITEA__server__PROTOCOL: http+unix
+      GITEA__server__HTTP_ADDR: /run/gitea/gitea.sock
+      GITEA__server__UNIX_SOCKET_PERMISSION: "0666"
+      GITEA__server__LOCAL_ROOT_URL: http://unix/
+      GITEA__server__DISABLE_SSH: "true"
+      GITEA__server__START_SSH_SERVER: "false"
+      GITEA__server__SSH_CREATE_AUTHORIZED_KEYS_FILE: "false"
+      GITEA__server__LFS_START_SERVER: "false"
+      GITEA__server__LFS_ALLOW_PURE_SSH: "false"
+      GITEA__server__OFFLINE_MODE: "true"
+      GITEA__server__LANDING_PAGE: login
+      GITEA__security__INSTALL_LOCK: "true"
+      GITEA__security__SECRET_KEY_URI: file:/run/secrets/gitea_secret_key
+      GITEA__security__INTERNAL_TOKEN_URI: file:/run/secrets/gitea_internal_token
+      GITEA__security__REVERSE_PROXY_LIMIT: "1"
+      GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: 127.0.0.0/8,::1/128
+      GITEA__security__DISABLE_GIT_HOOKS: "true"
+      GITEA__security__DISABLE_WEBHOOKS: "true"
+      GITEA__security__IMPORT_LOCAL_PATHS: "false"
+      GITEA__security__ONLY_ALLOW_PUSH_IF_GITEA_ENVIRONMENT_SET: "true"
+      GITEA__security__PASSWORD_HASH_ALGO: argon2
+      GITEA__security__MIN_PASSWORD_LENGTH: "16"
+      GITEA__security__PASSWORD_COMPLEXITY: lower,upper,digit,spec
+      GITEA__security__TWO_FACTOR_AUTH: enforced
+      GITEA__security__DISABLE_QUERY_AUTH_TOKEN: "true"
+      GITEA__security__ALLOWED_HOST_LIST: loopback
+      GITEA__service__DISABLE_REGISTRATION: "true"
+      GITEA__service__REQUIRE_SIGNIN_VIEW: "true"
+      GITEA__service__SHOW_REGISTRATION_BUTTON: "false"
+      GITEA__service__DEFAULT_KEEP_EMAIL_PRIVATE: "true"
+      GITEA__service__DEFAULT_ALLOW_CREATE_ORGANIZATION: "false"
+      GITEA__service__DEFAULT_USER_IS_RESTRICTED: "true"
+      GITEA__service__DEFAULT_USER_VISIBILITY: private
+      GITEA__service__ALLOWED_USER_VISIBILITY_MODES: private
+      GITEA__service__DEFAULT_ORG_VISIBILITY: private
+      GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION: "false"
+      GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION_API: "false"
+      GITEA__service__ENABLE_REVERSE_PROXY_AUTO_REGISTRATION: "false"
+      GITEA__service__ENABLE_NOTIFY_MAIL: "false"
+      GITEA__service__ENABLE_BASIC_AUTHENTICATION: "false"
+      GITEA__admin__DISABLE_REGULAR_ORG_CREATION: "true"
+      GITEA__admin__USER_DISABLED_FEATURES: deletion,manage_ssh_keys,manage_gpg_keys,change_username
+      GITEA__repository__FORCE_PRIVATE: "true"
+      GITEA__repository__DEFAULT_PRIVATE: private
+      GITEA__repository__USER_MAX_CREATION_LIMIT: "0"
+      GITEA__repository__ORG_MAX_CREATION_LIMIT: "0"
+      GITEA__repository__ENABLE_PUSH_CREATE_USER: "false"
+      GITEA__repository__ENABLE_PUSH_CREATE_ORG: "false"
+      GITEA__repository__DISABLE_MIGRATIONS: "true"
+      GITEA__repository__ALLOW_ADOPTION_OF_UNADOPTED_REPOSITORIES: "false"
+      GITEA__repository__ALLOW_DELETION_OF_UNADOPTED_REPOSITORIES: "false"
+      GITEA__repository__DISABLE_HTTP_GIT: "false"
+      GITEA__repository.upload__ENABLED: "false"
+      GITEA__attachment__ENABLED: "false"
+      GITEA__actions__ENABLED: "false"
+      GITEA__packages__ENABLED: "false"
+      GITEA__oauth2__ENABLED: "false"
+      GITEA__oauth2_client__ENABLE_AUTO_REGISTRATION: "false"
+      GITEA__openid__ENABLE_OPENID_SIGNIN: "false"
+      GITEA__openid__ENABLE_OPENID_SIGNUP: "false"
+      GITEA__federation__ENABLED: "false"
+      GITEA__mailer__ENABLED: "false"
+      GITEA__session__COOKIE_SECURE: "true"
+      GITEA__session__SAME_SITE: strict
+      GITEA__api__ENABLE_SWAGGER: "false"
+      GITEA__migrations__ALLOW_LOCALNETWORKS: "false"
+      GITEA__migrations__SKIP_TLS_VERIFY: "false"
+      GITEA__cors__ENABLED: "false"
+      GITEA__metrics__ENABLED: "false"
+      GITEA__cron.update_checker__ENABLED: "false"
+      GITEA__log__MODE: console
+      GITEA__log__LEVEL: Info
+    volumes:
+      - type: bind
+        source: /volume1/docker/nodedc-gitea/data
+        target: /var/lib/gitea
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-gitea/config
+        target: /etc/gitea
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-gitea/socket
+        target: /run/gitea
+        bind:
+          create_host_path: false
+    secrets:
+      - gitea_secret_key
+      - gitea_internal_token
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,nodev,size=256m
+
+secrets:
+  gitea_secret_key:
+    file: /volume1/docker/nodedc-gitea/secrets/secret-key
+  gitea_internal_token:
+    file: /volume1/docker/nodedc-gitea/secrets/internal-token