autonomic-bot
096cc70fd9
Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1:
- CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch
submitted twice triggers an add/add conflict that writes an executable
post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea
service account. Affects 1.17-1.27.0; public PoC.
- CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE
accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0),
escalating to RCE by reading config/tokens.
Based on current upstream main, so it includes the BREAKING CHANGE: remove forgejo
work; the previous branch predated it and was verified against a tree that would
not have deployed. Version label left at 3.6.0+1.24.2-rootless per upgrade-PR
convention (operator runs abra recipe release).
Gitea
- Category: Development
- Status: 5
- Image:
gitea/gitea, 4, upstream - Healthcheck: Yes
- Backups: Yes
- Email: Yes
- Tests: 2
- SSO: 3 (OAuth)
Basic usage
- Set up Docker Swarm and
abra - Deploy
coop-cloud/traefik abra app new gitea --secrets(optionally with--passif you'd like to save secrets inpass)abra app config YOURAPPDOMAIN- be sure to change$DOMAINto something that resolves to your Docker swarm boxabra app deploy YOURAPPDOMAIN
Create first user
Run
abra app run YOURAPPNAME app -- gitea -c /etc/gitea/app.ini admin user create --username USERNAME --admin --random-password --email EMAIL
See the Gitea command-line documentation for more options. Make sure not to forget the -c /etc/gitea/app.ini.
Enable SSH
You most certainly want to be able to access your repository over SSH. To do so, make sure you uncomment the right lines in the configuration for traefik.
abra app config YOURTRAEFIKAPP
There uncomment or add these lines:
GITEA_SSH_ENABLED=1
COMPOSE_FILE="compose.yml:compose.gitea.yml"
Then redeploy traefik:
abra app undeploy YOURTRAEFIKAPP
abra app deploy YOURTRAEFIKAPP
You might need to wait a bit. To check if it worked, you can run
telnet my.gitea.example.com 2222
Once you have added a public SSH key, you can check that you can connect to your gitea server with
ssh -T -p 2222 git@my.gitea.example.com
Note that gitea should be configured to listen to port 2222, i.e. GITEA_SSH_PORT=2222 in the gitea config.