feat: add Gitea Docker deployment with automated user provisioning (#141)#148
Open
t0kubetsu wants to merge 3 commits into
Open
feat: add Gitea Docker deployment with automated user provisioning (#141)#148t0kubetsu wants to merge 3 commits into
t0kubetsu wants to merge 3 commits into
Conversation
) Two-stage Dockerfile (golang:alpine builder → gitea/gitea:latest runtime) with a provisioner sidecar that bootstraps users and SSH keys on first run. - Dockerfile: two-stage build; builder installs yq+jq, runtime inherits gitea CLI - compose.yml: db (postgres:16-alpine) + gitea + provisioner with health-chain - provisioning/users.yml: declarative admin/user/SSH-key manifest - provisioning/init.sh: idempotent bootstrap via gitea CLI (users) + REST API (SSH keys) - .env.example: all tunable vars documented with safe defaults - Makefile: up/down/build/rebuild/reprovision/term targets - README.md: quick-start, user declaration, SSH key format, env vars, troubleshooting - .dockerignore: prevents .env and key files leaking into build context Security: jq used for JSON construction to prevent SSH-key injection; wait loop has 180 s timeout; plaintext passwords marked CHANGE BEFORE DEPLOY.
- Fix SSH port: use SSH_LISTEN_PORT=22 + SSH_PORT=${SSH_PORT:-2222} to advertise correct host port
- Fix silent errors: capture gitea CLI stderr, distinguish 'already exists' from real failures
- Fix yq: explicitly install mikefarah/yq v4.44.1 (apk yq may be kislyuk/yq)
- Fix postgres: require POSTGRES_PASSWORD to be set explicitly (no weak default)
- Add .PHONY declarations to Makefile
Author
Fix commit pushedAddressed all critical and high findings from code review:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #141. Delivers a standalone, provisioned Gitea deployment via Docker Compose. All users and SSH keys are declared in a single YAML manifest; a provisioner sidecar bootstraps them automatically on first run — no manual steps after
make up.Changes
Dockerfile (two-stage)
builder(golang:alpine) — installsyq+jq, copies and pre-validates provisioning scriptsruntime(gitea/gitea:latest, Alpine-based) — inherits thegiteaCLI binary; copies tooling from builder; runsinit.shas entrypointcompose.yml
db—postgres:16-alpinewith healthcheck (pg_isready)gitea—gitea/gitea:latestwithINSTALL_LOCK=true,DISABLE_REGISTRATION=true, HTTP + SSH ports, healthcheck on/api/v1/versionprovisioner— built from the Dockerfile;depends_on: gitea: healthy;restart: "no"(one-shot)provisioning/init.sh
gitea admin user createCLI (direct DB, no HTTP auth needed)jqused to build JSON payload (prevents injection via crafted key strings)/data/gitea/.provisionedprevents double-provisioningprovisioning/users.yml — declarative manifest; add/remove entries to scale users
.env.example — all tunable vars documented with
CHANGEMEplaceholders for secretsMakefile —
up / down / build / rebuild / reprovision / logs-provisioner / termtargets following existing project conventionsREADME.md — Quick Start, Build & Push, User Declaration, SSH Key Format, Env Vars table, Troubleshooting
.dockerignore — excludes
.env,*.key,*.pemfrom build contextFiles Changed
03_container_layer/docker/admin/gitea/Dockerfile03_container_layer/docker/admin/gitea/compose.yml03_container_layer/docker/admin/gitea/provisioning/init.sh03_container_layer/docker/admin/gitea/provisioning/users.yml03_container_layer/docker/admin/gitea/.env.example03_container_layer/docker/admin/gitea/Makefile03_container_layer/docker/admin/gitea/README.md03_container_layer/docker/admin/gitea/.dockerignoreDesign Notes
golang:alpine(builder) →gitea/gitea:latest(runtime). Ubuntu LTS was not used; the official Gitea Dockerfile uses Alpine/golang:alpine and this PR follows that convention.jq --argused for JSON construction (H-1 injection fix);.dockerignoreadded (M-4); wait loop has hard timeout (L-4); Postgres password placeholder strengthened; plaintext passwords inusers.ymlmarked withCHANGE BEFORE DEPLOYbanner.Testing
Related Issues
Closes #141