133 lines
4.3 KiB
Markdown
133 lines
4.3 KiB
Markdown
# Installing gitlab on your local ssh with SSH
|
|
This guide showcases my experience with installing gitea
|
|
within a docker compose.
|
|
|
|
## Step 1: The traefik service
|
|
If you use rootful podman, make sure that the container has access to a few
|
|
DNS servers. (configure it in the corresponding DNS provider.)
|
|
If you use podman, make sure to map the corresponding podman socket into the
|
|
container, instead of "/var/run/docker.sock".
|
|
Otherwise you should not change the config.
|
|
|
|
```yaml
|
|
services:
|
|
traefik:
|
|
image: traefik:latest
|
|
container_name: traefik
|
|
command:
|
|
- --providers.docker=true
|
|
- --entrypoints.web.address=:80
|
|
- --entrypoints.websecure.address=:443
|
|
- --certificatesresolvers.letsencrypt.acme.httpchallenge=true
|
|
- --certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web
|
|
- --certificatesresolvers.letsencrypt.acme.email=<your-email>
|
|
- --certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json
|
|
restart: unless-stopped
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- letsencrypt:/letsencrypt
|
|
- /var/run/docker.sock:/var/run/docker.sock:rw
|
|
networks:
|
|
- traefik-net
|
|
- proxy
|
|
dns:
|
|
- 1.1.1.1
|
|
```
|
|
|
|
|
|
## Step 2: The gitea service
|
|
You should add the script "/usr/local/bin/gitea-ssh.sh".
|
|
|
|
```bash
|
|
#!/bin/sh
|
|
exec /usr/bin/docker exec -e SSH_ORIGINAL_COMMAND="$SSH_ORIGINAL_COMMAND" --user git -i gitea
|
|
/usr/local/bin/gitea $@
|
|
```
|
|
|
|
Otherwise you can simply change
|
|
`GITEA__server__SSH_AUTHORIZED_KEYS_COMMAND_TEMPLATE` option to include the
|
|
docker command. If you would use rootful podman you should also add the `-c`
|
|
parameter and corresponding value for specifiying the connection.
|
|
As you can see command uses the git user.
|
|
It is necessary to set the "USER_UID" and "USER_GID" to the ones of your git
|
|
local git user/group. That is because the "authorized_keys" file is mapped into
|
|
a directory which does outside of the container and is used for external ssh
|
|
connections.
|
|
In theory you could use another user for ssh, but I don't know how that would
|
|
translate into another gitea config. For the ssh config you would simply replace
|
|
the user in the snippet below.
|
|
|
|
Add the following config snippet to your sshd config. It can be in a separate
|
|
file or at the end of your "sshd_config" file.
|
|
|
|
```sshd
|
|
Match User git
|
|
AllowTcpForwarding no
|
|
PermitTTY yes
|
|
X11Forwarding no
|
|
PasswordAuthentication no
|
|
AuthorizedKeysFile /srv/gitea/git/.ssh/authorized_keys
|
|
```
|
|
|
|
|
|
For the database you can use any database inside the docker compose
|
|
file you just have to specify the options "host", "name", "user" and "type".
|
|
|
|
To change the domain, you have to add under "gitea.rule" the domain.
|
|
|
|
```yaml
|
|
gitea:
|
|
image: gitea/gitea:1.22
|
|
container_name: gitea
|
|
restart: unless-stopped
|
|
environment:
|
|
USER_UID: 999
|
|
USER_GID: 989
|
|
GITEA__server__DOMAIN: gitea.${DOMAIN}
|
|
GITEA__server__ROOT_URL: https://gitea.${DOMAIN}/
|
|
GITEA__server__PROTOCOL: http
|
|
GITEA__server__SSH_AUTHORIZED_KEYS_FILE: /git/.ssh/authorized_keys
|
|
GITEA__server__SSH_DOMAIN: gitea.${DOMAIN}
|
|
GITEA__server__SSH_LISTEN_PORT: 2223
|
|
GITEA__server__SSH_AUTHORIZED_KEYS_COMMAND_TEMPLATE: /usr/local/bin/gitea-ssh.sh --config={{.CustomConf}} serv key-{{.Key.ID}}
|
|
GITEA__server__START_SSH_SERVER: "false"
|
|
GITEA__security__INSTALL_LOCK: "true"
|
|
GITEA__database__DB_TYPE: postgres
|
|
GITEA__database__HOST: db:5432
|
|
GITEA__database__NAME: gitea
|
|
GITEA__database__USER: gitea
|
|
GITEA__database__PASSWD: NOPE
|
|
volumes:
|
|
- gitea-data:/data
|
|
- /srv/gitea/git/.ssh:/data/git/.ssh
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.gitea.rule=Host(`gitea.${DOMAIN}`)"
|
|
- "traefik.http.routers.gitea.entrypoints=websecure"
|
|
- "traefik.http.routers.gitea.tls=true"
|
|
- "traefik.http.routers.gitea.tls.certresolver=letsencrypt"
|
|
- "traefik.http.services.gitea.loadbalancer.server.port=3000"
|
|
networks:
|
|
- proxy
|
|
depends_on:
|
|
- db
|
|
```
|
|
|
|
## Step 3. Include a postgres database.
|
|
Simply add this service with the corresponding password.
|
|
```yaml
|
|
db:
|
|
image: docker.io/library/postgres:14
|
|
restart: always
|
|
environment:
|
|
- POSTGRES_USER=gitea
|
|
- POSTGRES_DB=gitea
|
|
- POSTGRES_PASSWORD=NOPE
|
|
volumes:
|
|
- ./postgres:/var/lib/postgresql/data
|
|
networks:
|
|
- proxy
|
|
```
|