Merge branch 'main' into ssh-optional

Reviewed-on: #47
Reviewed-by: fauno <fauno@sutty.coop.ar>

.env.sample

@@ -51,8 +51,8 @@ GITEA_REPO_UPLOAD_MAX_FILES=5
 GITEA_MAILER_FROM=noreply@example.com
 GITEA_MAILER_USER=noreply@example.com
 
-GITEA_SSH_PORT=2222
-GITEA_SSH_ENABLED=1
+# SSH Support
+COMPOSE_FILE="$COMPOSE_FILE:compose.ssh.yml"
 
 SECRET_INTERNAL_TOKEN_VERSION=v1 # length=105
 SECRET_DB_PASSWORD_VERSION=v1
@@ -72,6 +72,13 @@ GITEA_STORAGE_TYPE=local
 # MINIO_CHECKSUM_ALGORITHM=default
 # COMPOSE_FILE="$COMPOSE_FILE:compose.s3.yml"
 
+# Instance Commit Signing
+# https://forgejo.org/docs/latest/admin/advanced/signing/
+# COMPOSE_FILE="$COMPOSE_FILE:compose.signing.yml"
+# GITEA_SIGNING_ENABLED=1
+# SECRET_SIGNING_PUBLIC_KEY_VERSION=v1
+# SECRET_SIGNING_PRIVATE_KEY_VERSION=v1
+
 # SMTP Mailer
 # COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
 # GITEA_SMTP_MAILER_ENABLED=1
@@ -97,3 +104,10 @@ GITEA_STORAGE_TYPE=local
 # GITEA_REPO_INDEXER_ENABLED=false
 # GITEA_ISSUE_INDEXER_TYPE=db
 # GITEA_STARTUP_TIMEOUT=-1
+
+# Prometheus metrics
+# FORGEJO_METRICS_ENABLED=false
+# FORGEJO_METRICS_ENABLED_ISSUE_BY_LABEL=false
+# FORGEJO_METRICS_ENABLED_ISSUE_BY_REPOSITORY=false
+# SECRET_FORGEJO_METRICS_TOKEN_VERSION=v1
+# COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"

README.md

@@ -3,7 +3,7 @@
 [![Build Status](https://build.coopcloud.tech/api/badges/coop-cloud/forgejo/status.svg)](https://build.coopcloud.tech/coop-cloud/forgejo)
 
 <!-- metadata -->
-* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@fauno](https://git.coopcloud.tech/fauno)
+* **Maintainer**: [@fauno](https://git.coopcloud.tech/fauno)
 * **Category**: Development
 * **Status**: 5
 * **Image**: [`forgejo/forgejo`](https://codeberg.org/forgejo/-/packages/container/forgejo/13-rootless), 4, upstream
@@ -52,17 +52,28 @@ abra app deploy YOURTRAEFIKAPP
 ```
 You might need to wait a bit.  To check if it worked, you can run
 ```
-telnet my.gitea.example.com 2222
+telnet my.forgejo.example.com 2222
 ```
-Once you have added a public SSH key, you can check that you can connect to your gitea server with
+Once you have added a public SSH key, you can check that you can connect to your Forgejo server with
 ```
-ssh -T -p 2222 git@my.gitea.example.com
+ssh -T -p 2222 git@my.forgejo.example.com
 ```
 
-Note that gitea should be configured to listen to port 2222, i.e. `GITEA_SSH_PORT=2222` in the gitea config.
-
 ## Protect Forgejo from scrapers with Anubis
 
 Uncomment the Anubis compose file from the `.env` file and re-deploy the
 app.  Don't forget to actually [enable Anubis on the Traefik app
 too](https://recipes.coopcloud.tech/traefik)!
+
+## [Instance Commit Signing](https://forgejo.org/docs/latest/admin/advanced/signing/)
+
+To allow Forgejo to sign commits, uncomment the corresponding
+configuration block, and then generate and insert the SSH keys:
+
+```sh
+abra app config git.example.coop
+ssh-keygen -t ed25519
+app app secret insert git.example.coop signing_public_key v1 -f ~/.ssh/id_ed25519.pub
+app app secret insert git.example.coop signing_private_key v1 -f ~/.ssh/id_ed25519
+app app deploy git.example.coop
+```

abra.sh

@@ -1,5 +1,5 @@
-export APP_INI_VERSION=v26
-export DOCKER_SETUP_SH_VERSION=v1
+export APP_INI_VERSION=v27
+export DOCKER_SETUP_SH_VERSION=v2
 export PG_BACKUP_VERSION=v1
 
 abra_backup_app() {

app.ini.tmpl

@@ -62,6 +62,18 @@ ALLOWED_TYPES = {{ env "GITEA_REPO_UPLOAD_ALLOWED_TYPES" }}
 FILE_MAX_SIZE = {{ env "GITEA_REPO_UPLOAD_MAX_SIZE" }}
 MAX_FILES = {{ env "GITEA_REPO_UPLOAD_MAX_FILES" }}
 
+{{ if eq (env "GITEA_SIGNING_ENABLED") "1" }}
+[repository.signing]
+FORMAT = ssh
+SIGNING_KEY = /var/lib/gitea/signing_key.pub
+SIGNING_NAME = {{ env "GITEA_APP_NAME" }}
+SIGNING_EMAIL = {{ env "GITEA_MAILER_FROM" }}
+INITIAL_COMMIT = always
+WIKI = always
+CRUD_ACTIONS = always
+MERGES = always
+{{ end }}
+
 [ui]
 SHOW_USER_EMAIL = {{ env "GITEA_SHOW_USER_EMAIL" }}
 
@@ -75,9 +87,10 @@ DOMAIN = {{ env "GITEA_DOMAIN" }}
 LANDING_PAGE = {{ env "GITEA_LANDING_PAGE" }}
 ROOT_URL = https://%(DOMAIN)s/
 SSH_DOMAIN = {{ env "GITEA_DOMAIN" }}
-SSH_LISTEN_PORT = {{ env "GITEA_SSH_PORT" }}
-SSH_PORT = {{ env "GITEA_SSH_PORT" }}
-START_SSH_SERVER = true
+SSH_LISTEN_PORT = 2222
+SSH_PORT = 2222
+START_SSH_SERVER = {{ env "GITEA_SSH_ENABLED" }}
+DISABLE_SSH = {{ if eq (env "GITEA_SSH_ENABLED") "true" }}false{{ else }}true{{ end }}
 LFS_START_SERVER = {{ env "GITEA_LFS_START_SERVER" }}
 LFS_JWT_SECRET = {{ secret "lfs_jwt_secret" }}
 
@@ -134,3 +147,11 @@ PROVIDER = {{ env "GITEA_SESSION_PROVIDER" }}
 ADAPTER = {{ env "GITEA_CACHE_ADAPTER" }}
 HOST = {{ env "GITEA_CACHE_HOST" }}
 ITEM_TTL = {{ env "GITEA_CACHE_ITEM_TTL" }}
+
+{{ if eq (env "FORGEJO_METRICS_ENABLED") "true" }}
+[metrics]
+ENABLED = {{ env "FORGEJO_METRICS_ENABLED" }}
+ENABLED_ISSUE_BY_LABEL = {{ env "FORGEJO_METRICS_ENABLED_ISSUE_BY_LABEL" }}
+ENABLED_ISSUE_BY_REPOSITORY = {{ env "FORGEJO_METRICS_ENABLED_ISSUE_BY_REPOSITORY" }}
+TOKEN = {{ secret "metrics_token" }}
+{{ end }}

compose.metrics.yml

@@ -0,0 +1,16 @@
+---
+version: "3.8"
+services:
+  app:
+    secrets:
+      - metrics_token
+    deploy:
+      labels:
+        - "prometheus.io/scrape=true"
+        - "prometheus.io/port=3000"
+        - "prometheus.io/path=/metrics"
+        - "prometheus.io/auth=bearer"
+secrets:
+  metrics_token:
+    name: ${STACK_NAME}_metrics_token_${SECRET_FORGEJO_METRICS_TOKEN_VERSION}
+    external: true

compose.signing.yml

@@ -0,0 +1,14 @@
+version: '3.8'
+
+services:
+  app:
+    secrets:
+    - signing_public_key
+    - signing_private_key
+secrets:
+  signing_public_key:
+    name: ${STACK_NAME}_signing_public_key_${SECRET_SIGNING_PUBLIC_KEY_VERSION}
+    external: true
+  signing_private_key:
+    name: ${STACK_NAME}_signing_private_key_${SECRET_SIGNING_PRIVATE_KEY_VERSION}
+    external: true

compose.ssh.yml

@@ -0,0 +1,11 @@
+---
+version: "3.8"
+services:
+  app:
+    environment:
+      - GITEA_SSH_ENABLED=true
+    deploy:
+      labels:
+        - "traefik.tcp.routers.${STACK_NAME}-ssh.rule=HostSNI(`*`)"
+        - "traefik.tcp.routers.${STACK_NAME}-ssh.entrypoints=gitea-ssh"
+        - "traefik.tcp.services.${STACK_NAME}-ssh.loadbalancer.server.port=${GITEA_SSH_PORT}"

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: codeberg.org/forgejo/forgejo:15.0.2-rootless
+    image: codeberg.org/forgejo/forgejo:15.0.7-rootless
     configs:
       - source: app_ini
         target: /var/lib/gitea/custom/conf/app.ini
@@ -26,7 +26,7 @@ services:
       - GITEA_ENABLE_OPENID_SIGNIN
       - GITEA_ENABLE_OPENID_SIGNUP
       - GITEA_SMTP_MAILER_ENABLED
-      - GITEA_SSH_PORT
+      - GITEA_SSH_ENABLED=false
       - GITEA_DISABLE_GRAVATAR
       - GITEA_ENABLE_FEDERATED_AVATAR
       - GITEA_REGISTER_EMAIL_CONFIRM
@@ -81,16 +81,13 @@ services:
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=3000"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "traefik.tcp.routers.${STACK_NAME}-ssh.rule=HostSNI(`*`)"
-        - "traefik.tcp.routers.${STACK_NAME}-ssh.entrypoints=gitea-ssh"
-        - "traefik.tcp.services.${STACK_NAME}-ssh.loadbalancer.server.port=${GITEA_SSH_PORT}"
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}_cors"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolallowheaders=content-type,authorization"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true"
-        - coop-cloud.${STACK_NAME}.version=5.4.0+15.0.2-rootless
+        - coop-cloud.${STACK_NAME}.version=5.6.1+15.0.7-rootless
 
 
 networks:

docker-setup.sh.tmpl

@@ -6,10 +6,18 @@
 # Prepare git folder
 mkdir -p ${HOME} && chmod 0700 ${HOME}
 if [ ! -w ${HOME} ]; then echo "${HOME} is not writable"; exit 1; fi
-
 # Prepare custom folder
 mkdir -p ${GITEA_CUSTOM} && chmod 0500 ${GITEA_CUSTOM}
 
 # Prepare temp folder
 mkdir -p ${GITEA_TEMP} && chmod 0700 ${GITEA_TEMP}
 if [ ! -w ${GITEA_TEMP} ]; then echo "${GITEA_TEMP} is not writable"; exit 1; fi
+
+if [ -e /run/secrets/signing_public_key ] ; then
+  if [ ! -e /var/lib/gitea/signing_key.pub ]; then
+    ln -s /run/secrets/signing_public_key /var/lib/gitea/signing_key.pub
+    ln -s /run/secrets/signing_private_key /var/lib/gitea/signing_key
+  fi
+
+  chmod 600 /var/lib/gitea/signing_key*
+fi