Reapply "fix: c3c7696807d34e6d12464f3b72b4b9b3e5e52e0d"

This reverts commit 904039c1b3.

.env.sample

@@ -38,10 +38,6 @@ GITEA_ENABLE_PUSH_CREATE_USER=false
 GITEA_ENABLE_PUSH_CREATE_ORG=false
 GITEA_LFS_START_SERVER=false
 GITEA_MAX_CREATION_LIMIT=-1
-GITEA_SESSION_PROVIDER=db
-GITEA_CACHE_ADAPTER=memory
-GITEA_CACHE_HOST=
-GITEA_CACHE_ITEM_TTL=16h
 
 GITEA_REPO_UPLOAD_ENABLED=true
 GITEA_REPO_UPLOAD_ALLOWED_TYPES=*/*
@@ -51,8 +47,8 @@ GITEA_REPO_UPLOAD_MAX_FILES=5
 GITEA_MAILER_FROM=noreply@example.com
 GITEA_MAILER_USER=noreply@example.com
 
-# SSH Support
-COMPOSE_FILE="$COMPOSE_FILE:compose.ssh.yml"
+GITEA_SSH_PORT=2222
+GITEA_SSH_ENABLED=1
 
 SECRET_INTERNAL_TOKEN_VERSION=v1 # length=105
 SECRET_DB_PASSWORD_VERSION=v1
@@ -60,25 +56,6 @@ SECRET_DB_ROOT_PASSWORD_VERSION=v1
 SECRET_JWT_SECRET_VERSION=v1 # length=43
 SECRET_SECRET_KEY_VERSION=v1 # length=64
 
-# Change to "minio" an configure to enable S3 storage
-# https://forgejo.org/docs/latest/admin/setup/storage/
-GITEA_STORAGE_TYPE=local
-# MINIO_ENDPOINT=
-# MINIO_ACCESS_KEY_ID=
-# SECRET_MINIO_SECRET_ACCESS_KEY_VERSION=v1
-# MINIO_BUCKET=
-# MINIO_BUCKET_LOOKUP=auto
-# MINIO_LOCATION=garage
-# MINIO_CHECKSUM_ALGORITHM=default
-# COMPOSE_FILE="$COMPOSE_FILE:compose.s3.yml"
-
-# Instance Commit Signing
-# https://forgejo.org/docs/latest/admin/advanced/signing/
-# COMPOSE_FILE="$COMPOSE_FILE:compose.signing.yml"
-# GITEA_SIGNING_ENABLED=1
-# SECRET_SIGNING_PUBLIC_KEY_VERSION=v1
-# SECRET_SIGNING_PRIVATE_KEY_VERSION=v1
-
 # SMTP Mailer
 # COMPOSE_FILE="$COMPOSE_FILE:compose.smtp.yml"
 # GITEA_SMTP_MAILER_ENABLED=1
@@ -104,10 +81,3 @@ GITEA_STORAGE_TYPE=local
 # GITEA_REPO_INDEXER_ENABLED=false
 # GITEA_ISSUE_INDEXER_TYPE=db
 # GITEA_STARTUP_TIMEOUT=-1
-
-# Prometheus metrics
-# FORGEJO_METRICS_ENABLED=false
-# FORGEJO_METRICS_ENABLED_ISSUE_BY_LABEL=false
-# FORGEJO_METRICS_ENABLED_ISSUE_BY_REPOSITORY=false
-# SECRET_FORGEJO_METRICS_TOKEN_VERSION=v1
-# COMPOSE_FILE="$COMPOSE_FILE:compose.metrics.yml"

README.md

@@ -3,7 +3,7 @@
 [![Build Status](https://build.coopcloud.tech/api/badges/coop-cloud/forgejo/status.svg)](https://build.coopcloud.tech/coop-cloud/forgejo)
 
 <!-- metadata -->
-* **Maintainer**: [@fauno](https://git.coopcloud.tech/fauno)
+* **Maintainer**: [@p4u1](https://git.coopcloud.tech/p4u1), [@fauno](https://git.coopcloud.tech/fauno)
 * **Category**: Development
 * **Status**: 5
 * **Image**: [`forgejo/forgejo`](https://codeberg.org/forgejo/-/packages/container/forgejo/13-rootless), 4, upstream
@@ -52,28 +52,17 @@ abra app deploy YOURTRAEFIKAPP
 ```
 You might need to wait a bit.  To check if it worked, you can run
 ```
-telnet my.forgejo.example.com 2222
+telnet my.gitea.example.com 2222
 ```
-Once you have added a public SSH key, you can check that you can connect to your Forgejo server with
+Once you have added a public SSH key, you can check that you can connect to your gitea server with
 ```
-ssh -T -p 2222 git@my.forgejo.example.com
+ssh -T -p 2222 git@my.gitea.example.com
 ```
 
+Note that gitea should be configured to listen to port 2222, i.e. `GITEA_SSH_PORT=2222` in the gitea config.
+
 ## Protect Forgejo from scrapers with Anubis
 
 Uncomment the Anubis compose file from the `.env` file and re-deploy the
 app.  Don't forget to actually [enable Anubis on the Traefik app
 too](https://recipes.coopcloud.tech/traefik)!
-
-## [Instance Commit Signing](https://forgejo.org/docs/latest/admin/advanced/signing/)
-
-To allow Forgejo to sign commits, uncomment the corresponding
-configuration block, and then generate and insert the SSH keys:
-
-```sh
-abra app config git.example.coop
-ssh-keygen -t ed25519
-app app secret insert git.example.coop signing_public_key v1 -f ~/.ssh/id_ed25519.pub
-app app secret insert git.example.coop signing_private_key v1 -f ~/.ssh/id_ed25519
-app app deploy git.example.coop
-```

abra.sh

@@ -1,5 +1,5 @@
-export APP_INI_VERSION=v27
-export DOCKER_SETUP_SH_VERSION=v2
+export APP_INI_VERSION=v24
+export DOCKER_SETUP_SH_VERSION=v1
 export PG_BACKUP_VERSION=v1
 
 abra_backup_app() {

app.ini.tmpl

@@ -16,21 +16,6 @@ PATH = {{ env "GITEA_PATH" }}
 DISABLE_GRAVATAR = {{ env "GITEA_DISABLE_GRAVATAR" }}
 ENABLE_FEDERATED_AVATAR = {{ env "GITEA_ENABLE_FEDERATED_AVATAR" }}
 
-[storage]
-STORAGE_TYPE = {{ env "GITEA_STORAGE_TYPE" }}
-{{ if eq (env "GITEA_STORAGE_TYPE") "minio" }}
-SERVE_DIRECT = false
-MINIO_ENDPOINT = {{ env "MINIO_ENDPOINT" }}
-MINIO_ACCESS_KEY_ID = {{ env "MINIO_ACCESS_KEY_ID" }}
-MINIO_SECRET_ACCESS_KEY = {{ secret "minio_secret_access_key" }}
-MINIO_BUCKET = {{ env "MINIO_BUCKET" }}
-MINIO_BUCKET_LOOKUP = {{ env "MINIO_BUCKET_LOOKUP" }}
-MINIO_LOCATION = {{ env "MINIO_LOCATION" }}
-MINIO_USE_SSL = true
-MINIO_INSECURE_SKIP_VERIFY = false
-MINIO_CHECKSUM_ALGORITHM = {{ env "MINIO_CHECKSUM_ALGORITHM" }}
-{{ end }}
-
 [service]
 ALLOW_ONLY_EXTERNAL_REGISTRATION = {{ env "GITEA_ALLOW_ONLY_EXTERNAL_REGISTRATION" }}
 ALLOW_ONLY_INTERNAL_REGISTRATION = {{ env "GITEA_ALLOW_ONLY_INTERNAL_REGISTRATION" }}
@@ -62,18 +47,6 @@ ALLOWED_TYPES = {{ env "GITEA_REPO_UPLOAD_ALLOWED_TYPES" }}
 FILE_MAX_SIZE = {{ env "GITEA_REPO_UPLOAD_MAX_SIZE" }}
 MAX_FILES = {{ env "GITEA_REPO_UPLOAD_MAX_FILES" }}
 
-{{ if eq (env "GITEA_SIGNING_ENABLED") "1" }}
-[repository.signing]
-FORMAT = ssh
-SIGNING_KEY = /var/lib/gitea/signing_key.pub
-SIGNING_NAME = {{ env "GITEA_APP_NAME" }}
-SIGNING_EMAIL = {{ env "GITEA_MAILER_FROM" }}
-INITIAL_COMMIT = always
-WIKI = always
-CRUD_ACTIONS = always
-MERGES = always
-{{ end }}
-
 [ui]
 SHOW_USER_EMAIL = {{ env "GITEA_SHOW_USER_EMAIL" }}
 
@@ -87,10 +60,9 @@ DOMAIN = {{ env "GITEA_DOMAIN" }}
 LANDING_PAGE = {{ env "GITEA_LANDING_PAGE" }}
 ROOT_URL = https://%(DOMAIN)s/
 SSH_DOMAIN = {{ env "GITEA_DOMAIN" }}
-SSH_LISTEN_PORT = 2222
-SSH_PORT = 2222
-START_SSH_SERVER = {{ env "GITEA_SSH_ENABLED" }}
-DISABLE_SSH = {{ if eq (env "GITEA_SSH_ENABLED") "true" }}false{{ else }}true{{ end }}
+SSH_LISTEN_PORT = {{ env "GITEA_SSH_PORT" }}
+SSH_PORT = {{ env "GITEA_SSH_PORT" }}
+START_SSH_SERVER = true
 LFS_START_SERVER = {{ env "GITEA_LFS_START_SERVER" }}
 LFS_JWT_SECRET = {{ secret "lfs_jwt_secret" }}
 
@@ -139,19 +111,3 @@ MODE=console
 LEVEL=WARN
 STACKTRACE_LEVEL=None
 ENABLE_XORM_LOG=false
-
-[session]
-PROVIDER = {{ env "GITEA_SESSION_PROVIDER" }}
-
-[cache]
-ADAPTER = {{ env "GITEA_CACHE_ADAPTER" }}
-HOST = {{ env "GITEA_CACHE_HOST" }}
-ITEM_TTL = {{ env "GITEA_CACHE_ITEM_TTL" }}
-
-{{ if eq (env "FORGEJO_METRICS_ENABLED") "true" }}
-[metrics]
-ENABLED = {{ env "FORGEJO_METRICS_ENABLED" }}
-ENABLED_ISSUE_BY_LABEL = {{ env "FORGEJO_METRICS_ENABLED_ISSUE_BY_LABEL" }}
-ENABLED_ISSUE_BY_REPOSITORY = {{ env "FORGEJO_METRICS_ENABLED_ISSUE_BY_REPOSITORY" }}
-TOKEN = {{ secret "metrics_token" }}
-{{ end }}

compose.metrics.yml

@@ -1,16 +0,0 @@
----
-version: "3.8"
-services:
-  app:
-    secrets:
-      - metrics_token
-    deploy:
-      labels:
-        - "prometheus.io/scrape=true"
-        - "prometheus.io/port=3000"
-        - "prometheus.io/path=/metrics"
-        - "prometheus.io/auth=bearer"
-secrets:
-  metrics_token:
-    name: ${STACK_NAME}_metrics_token_${SECRET_FORGEJO_METRICS_TOKEN_VERSION}
-    external: true

compose.s3.yml

@@ -1,10 +0,0 @@
----
-version: "3.8"
-services:
-  app:
-    secrets:
-      - minio_secret_access_key
-secrets:
-  minio_secret_access_key:
-    name: ${STACK_NAME}_minio_secret_access_key_${SECRET_MINIO_SECRET_ACCESS_KEY_VERSION}
-    external: true

compose.signing.yml

@@ -1,14 +0,0 @@
-version: '3.8'
-
-services:
-  app:
-    secrets:
-    - signing_public_key
-    - signing_private_key
-secrets:
-  signing_public_key:
-    name: ${STACK_NAME}_signing_public_key_${SECRET_SIGNING_PUBLIC_KEY_VERSION}
-    external: true
-  signing_private_key:
-    name: ${STACK_NAME}_signing_private_key_${SECRET_SIGNING_PRIVATE_KEY_VERSION}
-    external: true

compose.ssh.yml

@@ -1,11 +0,0 @@
----
-version: "3.8"
-services:
-  app:
-    environment:
-      - GITEA_SSH_ENABLED=true
-    deploy:
-      labels:
-        - "traefik.tcp.routers.${STACK_NAME}-ssh.rule=HostSNI(`*`)"
-        - "traefik.tcp.routers.${STACK_NAME}-ssh.entrypoints=gitea-ssh"
-        - "traefik.tcp.services.${STACK_NAME}-ssh.loadbalancer.server.port=${GITEA_SSH_PORT}"

compose.yml

@@ -3,10 +3,10 @@ version: "3.8"
 
 services:
   app:
-    image: codeberg.org/forgejo/forgejo:15.0.7-rootless
+    image: git.sutty.abyaya.la/containers/forgejo:v15.0-rootless
     configs:
       - source: app_ini
-        target: /var/lib/gitea/custom/conf/app.ini
+        target: /etc/gitea/app.ini
       - source: docker_setup_sh
         target: /usr/local/bin/docker-setup.sh
         mode: 0555
@@ -26,7 +26,7 @@ services:
       - GITEA_ENABLE_OPENID_SIGNIN
       - GITEA_ENABLE_OPENID_SIGNUP
       - GITEA_SMTP_MAILER_ENABLED
-      - GITEA_SSH_ENABLED=false
+      - GITEA_SSH_PORT
       - GITEA_DISABLE_GRAVATAR
       - GITEA_ENABLE_FEDERATED_AVATAR
       - GITEA_REGISTER_EMAIL_CONFIRM
@@ -59,6 +59,7 @@ services:
       - GITEA_MAX_CREATION_LIMIT=${GITEA_MAX_CREATION_LIMIT:--1}
     volumes:
       - data:/var/lib/gitea
+      - config:/etc/gitea
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     networks:
@@ -73,7 +74,7 @@ services:
     deploy:
       update_config:
         failure_action: rollback
-        order: stop-first
+        order: start-first
       labels:
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "traefik.enable=true"
@@ -81,13 +82,16 @@ services:
         - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
         - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=3000"
         - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
+        - "traefik.tcp.routers.${STACK_NAME}-ssh.rule=HostSNI(`*`)"
+        - "traefik.tcp.routers.${STACK_NAME}-ssh.entrypoints=gitea-ssh"
+        - "traefik.tcp.services.${STACK_NAME}-ssh.loadbalancer.server.port=${GITEA_SSH_PORT}"
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}_cors"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolallowheaders=content-type,authorization"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true"
-        - coop-cloud.${STACK_NAME}.version=5.6.1+15.0.7-rootless
+        - coop-cloud.${STACK_NAME}.version=5.1.0+14.0.1-rootless
 
 
 networks:
@@ -121,3 +125,4 @@ secrets:
 
 volumes:
   data:
+  config:

docker-setup.sh.tmpl

@@ -6,18 +6,10 @@
 # Prepare git folder
 mkdir -p ${HOME} && chmod 0700 ${HOME}
 if [ ! -w ${HOME} ]; then echo "${HOME} is not writable"; exit 1; fi
+
 # Prepare custom folder
 mkdir -p ${GITEA_CUSTOM} && chmod 0500 ${GITEA_CUSTOM}
 
 # Prepare temp folder
 mkdir -p ${GITEA_TEMP} && chmod 0700 ${GITEA_TEMP}
 if [ ! -w ${GITEA_TEMP} ]; then echo "${GITEA_TEMP} is not writable"; exit 1; fi
-
-if [ -e /run/secrets/signing_public_key ] ; then
-  if [ ! -e /var/lib/gitea/signing_key.pub ]; then
-    ln -s /run/secrets/signing_public_key /var/lib/gitea/signing_key.pub
-    ln -s /run/secrets/signing_private_key /var/lib/gitea/signing_key
-  fi
-
-  chmod 600 /var/lib/gitea/signing_key*
-fi

release/5.4.0+15.0.2-rootless

@@ -1 +0,0 @@
-New enviromental variables have been added! Please update your .env before deploying.

renovate.json

@@ -4,7 +4,6 @@
     "config:recommended"
   ],
   "reviewers": [
-    "fauno",
-    "p4u1"
+    "team:forgejo-maintainers"
   ]
 }