feat(deploy): add canonical Gitea recovery flows

2026-08-22 11:14:33 +03:00
parent a9ea31f00a
commit 502acd3771
14 changed files with 15257 additions and 4 deletions
@@ -0,0 +1,112 @@
+{
+  "schemaVersion": "nodedc.gitea.incident-salvage.v1",
+  "action": "clean-state-salvage",
+  "component": "gitea",
+  "incidentId": "gitea-20260814",
+  "installRoot": "/volume1/docker/nodedc-gitea",
+  "compose": {
+    "file": "docker-compose.gitea.yml",
+    "project": "nodedc-gitea",
+    "service": "gitea",
+    "sha256": "2f031d5bfff4f42c73cabd8c94487ec3e4f1e1b0a96d3b7eec958904f735908a"
+  },
+  "runtime": {
+    "image": "docker.gitea.com/gitea:1.27.2-rootless@sha256:7de5f49ada687b8c8d2938f547cdb7634839764ba51f297457bae35cee3abd2c",
+    "imageId": "sha256:272085a806e6d182352cdb011c0ebab1d2efc7ec45247de84de5659c7bc5c4c6",
+    "repoDigest": "docker.gitea.com/gitea@sha256:7de5f49ada687b8c8d2938f547cdb7634839764ba51f297457bae35cee3abd2c",
+    "platform": "linux/amd64",
+    "pullPolicy": "never",
+    "entrypoint": "/usr/local/bin/gitea",
+    "runAs": "1000:1000",
+    "transport": "unix:/run/gitea/gitea.sock",
+    "networkMode": "none",
+    "ssh": "disabled-no-published-port",
+    "lfs": "unsupported-hard-stop",
+    "database": "new-sqlite-1.27.2-only",
+    "logging": "bounded-json-file-10m-x3",
+    "stopGracePeriod": "30s",
+    "candidateRestartPolicy": "no",
+    "acceptedRestartPolicy": "unless-stopped"
+  },
+  "decision": {
+    "schema": "nodedc.gitea.incident-decision/v2",
+    "manifestFile": "deployment/gitea-incident-salvage/confirmed-decision.json",
+    "manifestSha256": "dc9528462624158eb44218d37cc7054d551ca2d7ded562592982aa3f34c9fc2a",
+    "usersFile": "deployment/gitea-incident-salvage/users.decisions.csv",
+    "usersSha256": "e3b82f1073a86eea9e567edff062dd1689d21ec0edcf3ed92e844da9351ee8b6",
+    "repositoriesFile": "deployment/gitea-incident-salvage/repositories.decisions.csv",
+    "repositoriesSha256": "76b4bae2ab5cec490330c19bfc5ae9429abf7636705ae028c1c64fd54a6a0493",
+    "users": {
+      "active": 2,
+      "locked": 8,
+      "delete": 962
+    },
+    "repositories": {
+      "keep": 45,
+      "delete": 2013,
+      "dctouchPrivate": 32,
+      "silverPublic": 13
+    }
+  },
+  "snapshot": {
+    "root": "/volume1/.nodedc-security-snapshots/docker-gitea-incident-20260814",
+    "uuid": "f5a3fe3a-93ea-bb4d-847f-6221a6bcbc9f",
+    "readOnlyRequired": true,
+    "database": "gitea/gitea/gitea.db",
+    "databaseBytes": 182681600,
+    "databaseSha256": "8db9e74a5641662a808d8252c5d6c9de43fe9efd8687634bfbff2d4361a13052",
+    "repositoriesRoot": "gitea/git/repositories"
+  },
+  "trust": {
+    "legacyRootMounted": false,
+    "legacyDatabaseImported": false,
+    "legacyConfigImported": false,
+    "legacyCredentialsImported": false,
+    "artifactSecrets": "forbidden",
+    "runtimeSecrets": "runner-generated",
+    "repositorySelection": "exact-v2-rows-only",
+    "repositoryCopy": "same-filesystem-per-file-reflink-object-and-validated-ref-material-only",
+    "forbiddenRepositoryMaterial": [
+      "hooks",
+      "config",
+      "alternates",
+      "http-alternates",
+      "shallow",
+      "replace",
+      "grafts",
+      "worktrees",
+      "commondir",
+      "lfs"
+    ],
+    "unsupportedDatabaseState": "zero-material-rows-required-before-apply"
+  },
+  "identity": {
+    "preserveNumericUserIds": false,
+    "preserveNumericRepositoryIds": false,
+    "oldToNewIdMapping": "/volume1/docker/nodedc-gitea/audit/identity-map.json",
+    "emails": "new-local-noreply-only",
+    "passwordHashes": "never-imported",
+    "activeBootstrapCredentials": "root-only-runner-state-require-change",
+    "lockedCredentials": "fresh-random-discarded-and-login-prohibited",
+    "twoFactorAuthentication": "not-configured-by-transition"
+  },
+  "externalPrerequisites": {
+    "legacyContainer": "exact-inspect-pin-required-stopped-restart-no",
+    "publicProxy": "reviewed-nginx-uds-bridge-and-dsm-loopback-upstream",
+    "firewall": "legacy-isolation-retained-and-loopback-3000-ready",
+    "candidatePublicationGate": "socket-parent-uid1000-gid1023-mode0700",
+    "publishAction": "runner-chmod-socket-parent-0750-after-internal-acceptance",
+    "mustPassBeforeApply": true
+  },
+  "acceptance": {
+    "users": "exact-10-row-by-row",
+    "repositories": "exact-45-row-by-row-and-visibility",
+    "credentialsSessionsKeysWebhooksActions": "zero",
+    "git": "fsck-all-and-public-smart-http-smoke",
+    "registration": "closed",
+    "ssh": "disabled",
+    "network": "none-no-ports",
+    "publicHttps": "required-before-ledger-success"
+  },
+  "rollback": "stop-remove-candidate-prove-absent-quarantine-new-root-never-start-legacy"
+}