set reasonable defaults for webhook, service login, and api request timeouts/limits

.env.sample

@@ -43,6 +43,16 @@ GITEA_CACHE_ADAPTER=memory
 GITEA_CACHE_HOST=
 GITEA_CACHE_ITEM_TTL=16h
 
+GITEA_LOGIN_MAX_FAILED_ATTEMPTS=5
+GITEA_LOGIN_LOCKOUT_DURATION=1h
+
+GITEA_WEBHOOK_ALLOWED_HOST_LIST=external,loopback
+GITEA_WEBHOOK_DELIVER_TIMEOUT=5
+
+GITEA_API_MAX_RESPONSE_ITEMS=50
+GITEA_API_DEFAULT_PAGING_NUM=20
+GITEA_API_ENABLE_SWAGGER=false
+
 GITEA_REPO_UPLOAD_ENABLED=true
 GITEA_REPO_UPLOAD_ALLOWED_TYPES=*/*
 GITEA_REPO_UPLOAD_MAX_SIZE=50
@@ -51,8 +61,8 @@ GITEA_REPO_UPLOAD_MAX_FILES=5
 GITEA_MAILER_FROM=noreply@example.com
 GITEA_MAILER_USER=noreply@example.com
 
-# SSH Support
-COMPOSE_FILE="$COMPOSE_FILE:compose.ssh.yml"
+GITEA_SSH_PORT=2222
+GITEA_SSH_ENABLED=1
 
 SECRET_INTERNAL_TOKEN_VERSION=v1 # length=105
 SECRET_DB_PASSWORD_VERSION=v1

README.md

@@ -52,13 +52,15 @@ abra app deploy YOURTRAEFIKAPP
 ```
 You might need to wait a bit.  To check if it worked, you can run
 ```
-telnet my.forgejo.example.com 2222
+telnet my.gitea.example.com 2222
 ```
-Once you have added a public SSH key, you can check that you can connect to your Forgejo server with
+Once you have added a public SSH key, you can check that you can connect to your gitea server with
 ```
-ssh -T -p 2222 git@my.forgejo.example.com
+ssh -T -p 2222 git@my.gitea.example.com
 ```
 
+Note that gitea should be configured to listen to port 2222, i.e. `GITEA_SSH_PORT=2222` in the gitea config.
+
 ## Protect Forgejo from scrapers with Anubis
 
 Uncomment the Anubis compose file from the `.env` file and re-deploy the

abra.sh

@@ -1,4 +1,4 @@
-export APP_INI_VERSION=v30
+export APP_INI_VERSION=v27
 export DOCKER_SETUP_SH_VERSION=v2
 export PG_BACKUP_VERSION=v1
 

app.ini.tmpl

@@ -45,6 +45,12 @@ ALLOWED_USER_VISIBILITY_MODES = {{ env "GITEA_ALLOWED_USER_VISIBILITY_MODES" }}
 DEFAULT_ORG_VISIBILITY = {{ env "GITEA_DEFAULT_ORG_VISIBILITY" }}
 REQUIRE_SIGNIN_VIEW = {{ env "GITEA_REQUIRE_SIGNIN_VIEW" }}
 ENABLE_INTERNAL_SIGNIN = {{ env "GITEA_ENABLE_INTERNAL_SIGNIN" }}
+MAX_FAILED_ATTEMPTS = {{ or (env "GITEA_LOGIN_MAX_FAILED_ATTEMPTS") "5" }}
+LOCKOUT_DURATION = {{ or (env "GITEA_LOGIN_LOCKOUT_DURATION") "1h" }}
+
+[webhook]
+ALLOWED_HOST_LIST = {{ or (env "GITEA_WEBHOOK_ALLOWED_HOST_LIST) "external,loopback" }}
+DELIVER_TIMEOUT = {{ or (env "GITEA_WEBHOOK_DELIVER_TIMEOUT) "5" }}
 
 [openid]
 ENABLE_OPENID_SIGNIN = {{ env "GITEA_ENABLE_OPENID_SIGNIN" }}
@@ -87,10 +93,9 @@ DOMAIN = {{ env "GITEA_DOMAIN" }}
 LANDING_PAGE = {{ env "GITEA_LANDING_PAGE" }}
 ROOT_URL = https://%(DOMAIN)s/
 SSH_DOMAIN = {{ env "GITEA_DOMAIN" }}
-SSH_LISTEN_PORT = 2222
-SSH_PORT = 2222
-START_SSH_SERVER = {{ env "GITEA_SSH_ENABLED" }}
-DISABLE_SSH = {{ if eq (env "GITEA_SSH_ENABLED") "true" }}false{{ else }}true{{ end }}
+SSH_LISTEN_PORT = {{ env "GITEA_SSH_PORT" }}
+SSH_PORT = {{ env "GITEA_SSH_PORT" }}
+START_SSH_SERVER = true
 LFS_START_SERVER = {{ env "GITEA_LFS_START_SERVER" }}
 LFS_JWT_SECRET = {{ secret "lfs_jwt_secret" }}
 
@@ -155,3 +160,8 @@ ENABLED_ISSUE_BY_LABEL = {{ env "FORGEJO_METRICS_ENABLED_ISSUE_BY_LABEL" }}
 ENABLED_ISSUE_BY_REPOSITORY = {{ env "FORGEJO_METRICS_ENABLED_ISSUE_BY_REPOSITORY" }}
 TOKEN = {{ secret "metrics_token" }}
 {{ end }}
+
+[api]
+MAX_RESPONSE_ITEMS = {{ or (env "GITEA_API_MAX_RESPONSE_ITEMS") "50" }}
+DEFAULT_PAGING_NUM = {{ or (env "GITEA_API_DEFAULT_PAGING_NUM") "20" }}
+ENABLE_SWAGGER = {{ or (env "GITEA_API_ENABLE_SWAGGER") "false" }}

compose.ssh.yml

@@ -1,11 +0,0 @@
----
-version: "3.8"
-services:
-  app:
-    environment:
-      - GITEA_SSH_ENABLED=true
-    deploy:
-      labels:
-        - "traefik.tcp.routers.${STACK_NAME}-ssh.rule=HostSNI(`*`)"
-        - "traefik.tcp.routers.${STACK_NAME}-ssh.entrypoints=gitea-ssh"
-        - "traefik.tcp.services.${STACK_NAME}-ssh.loadbalancer.server.port=${GITEA_SSH_PORT}"

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: codeberg.org/forgejo/forgejo:15.0.8-rootless
+    image: codeberg.org/forgejo/forgejo:15.0.7-rootless
     configs:
       - source: app_ini
         target: /var/lib/gitea/custom/conf/app.ini
@@ -26,7 +26,7 @@ services:
       - GITEA_ENABLE_OPENID_SIGNIN
       - GITEA_ENABLE_OPENID_SIGNUP
       - GITEA_SMTP_MAILER_ENABLED
-      - GITEA_SSH_ENABLED=false
+      - GITEA_SSH_PORT
       - GITEA_DISABLE_GRAVATAR
       - GITEA_ENABLE_FEDERATED_AVATAR
       - GITEA_REGISTER_EMAIL_CONFIRM
@@ -65,7 +65,7 @@ services:
       - proxy
       - internal
     healthcheck:
-      test: ["CMD", "curl", "--user-agent=healthcheck", "-f", "http://localhost:3000/api/healthz"]
+      test: ["CMD", "curl", "-f", "http://localhost:3000/api/healthz"]
       interval: 30s
       timeout: 10s
       retries: 10
@@ -81,13 +81,16 @@ services:
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=3000"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.tcp.routers.${STACK_NAME}-ssh.rule=HostSNI(`*`)"
+        - "traefik.tcp.routers.${STACK_NAME}-ssh.entrypoints=gitea-ssh"
+        - "traefik.tcp.services.${STACK_NAME}-ssh.loadbalancer.server.port=${GITEA_SSH_PORT}"
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}_cors"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolallowheaders=content-type,authorization"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true"
-        - coop-cloud.${STACK_NAME}.version=5.6.2+15.0.8-rootless
+        - coop-cloud.${STACK_NAME}.version=5.6.1+15.0.7-rootless
 
 
 networks: