Run Gitea as a rootless Podman Quadlet, with git over SSH on the host's sshd
Replaces the docker_container deployment on monoco with a Quadlet systemd user unit on emily, and moves state from /var/lib/gitea to ~/podman-data/gitea. Gitea is SQLite -- the live app.ini on monoco says DB_TYPE = sqlite3 with PATH = /data/gitea/gitea.db -- so there is no postgres role and the database travels inside the data tree. git-over-SSH is the part that could not simply be moved. Port 22 stays the host's sshd, so no client changes its remote, but the second hop does: the Docker-era design sshed into an sshd *inside* the container, and under keep-id that sshd runs as a subuid which cannot read the authorized_keys Gitea writes as tanshu. It is replaced by a `podman exec`, reached through a shim sshd runs as a new `git` login user, a one-command sudoers rule, and an AuthorizedKeysCommand that hands sshd the key file without the ownership check StrictModes would otherwise apply. Two things stopped it starting, and both only showed up when it was run: keep-id runs the container *process* as the uid it maps, not just the file ownership, so the whole container came up as `git` while the image's start-up is written to begin as root. /usr/bin/entrypoint rewrites /etc/passwd, /etc/s6/gitea/setup prepares /data before the run script `su-exec git`s the server, and the image's own CMD is s6-svscan, which has to create .s6-svscan/lock inside root-owned /etc/s6. The container died on the last two -- "sed: can't create temp file '/etc/passwdXXXXXX': Permission denied" and "s6-svscan: fatal: unable to open .s6-svscan/lock: Permission denied" -- and Restart=always turned that into a crash loop, which `is-active` reports as `activating` rather than as a failure. User=0 restores root for the start-up and leaves the mapping alone: the server still runs as git through su-exec, which is what satisfies mustNotRunAsRoot. (nextcloud.container carries the same pair for the same reason.) The `ssh/` directory under /data is only ever a mount point -- the in-image sshd's host keys are mounted over it from ~/podman-data/gitea-sshd -- so it is hidden inside the container and nothing ever chowns it. When Podman has to create it, it lands in the data tree owned by the subuid, and the role's own "nothing here belongs to another user" check fails on it, correctly. Creating it in the role first is what keeps the tree wholly tanshu's. Start, is-active and the health check are now one block whose rescue dumps status, journal and podman logs, because they fail the same way: `systemctl start` reports success as soon as systemd holds the unit, so a container that dies a second later surfaces only as `activating` -- which is exactly how the two failures above were reported, with the reason in the journal and nowhere the play looked. Verified on emily: the play runs to ok=27/changed=7/failed=0, the health check and the stray-owner assertion both pass, and the ssh second hop still returns the container's Gitea 28.1.0 through the wrapper. The role's comments and the readme were corrected where they explained the old failures as EPERM from the root phases: container root holds the usual capabilities inside its user namespace, so those phases succeed and leave subuid-owned files behind, which is the real reason the tree is created up front. The readme's list of "expected" chmod EPERM lines is gone, because the log is clean. The data directory was emptied of the fresh app.ini afterwards and the unit left stopped, ready for the copy from monoco.
This commit is contained in:
tanshu committed
1 parent
3d4ccdd6d1
commit
fc70acb66b
14 files changed
+1260
-106
No files matched your search
@@ -1,5 +1,31 @@
|
||||
---
|
||||
# Handlers for Caddy role
|
||||
# Caddy is its own playbook (caddy/playbook.yml) and a rootless Quadlet unit
|
||||
# there. These handlers run as the connection user, so `systemctl --user` and
|
||||
# `podman exec` work without any XDG_RUNTIME_DIR juggling.
|
||||
|
||||
# Notified by this role when the Caddyfile changes. A reload keeps existing
|
||||
# connections; a restart would briefly drop every hosted site.
|
||||
#
|
||||
# Note the config path: /etc/caddy/Caddyfile is the mount inside the container,
|
||||
# not {{ caddyfile_path }}, which is the host side of it.
|
||||
- name: Reload Caddy configuration
|
||||
ansible.builtin.command: "docker exec -w /etc/caddy {{ caddy_container }} caddy reload"
|
||||
ansible.builtin.command: >-
|
||||
podman exec {{ caddy_name }} caddy reload --config /etc/caddy/Caddyfile
|
||||
changed_when: true
|
||||
listen: "Reload Caddy"
|
||||
|
||||
# Notified by caddy/roles/register when this service's network unit, or the
|
||||
# drop-in that attaches Caddy to it, is written. Quadlet has no live equivalent
|
||||
# of `docker network connect`, so the container has to be recreated — a brief
|
||||
# restart of every hosted site, not just this one. See caddy/readme.md,
|
||||
# "Trade-off worth knowing".
|
||||
#
|
||||
# Defined after the reload above so that when both are notified the cheap config
|
||||
# reload happens first.
|
||||
- name: Restart Caddy
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ caddy_name }}.service"
|
||||
scope: user
|
||||
state: restarted
|
||||
daemon_reload: true
|
||||
listen: Restart Caddy
|
||||
@@ -1,22 +1,22 @@
|
||||
---
|
||||
- name: Read current Caddyfile
|
||||
ansible.builtin.slurp:
|
||||
path: "{{ caddyfile_path }}"
|
||||
register: caddyfile_raw
|
||||
# Append this site's block to the shared Caddyfile.
|
||||
#
|
||||
# The Caddyfile is a bind mount into the Caddy container, so Caddy sees the
|
||||
# change as soon as the file is written; the handler only asks Caddy to re-read
|
||||
# it. That is a reload, not a restart, so the other hosted sites are untouched.
|
||||
#
|
||||
# blockinfile is idempotent on its own via the marker, so there is no need to
|
||||
# slurp the file and compare first — which also matters because slurp *fails*
|
||||
# when the Caddyfile does not exist yet, on a host where the Caddy playbook has
|
||||
# not run.
|
||||
|
||||
- name: Decode Caddyfile content
|
||||
set_fact:
|
||||
caddyfile_content: "{{ caddyfile_raw['content'] | b64decode }}"
|
||||
|
||||
- name: Check if snippet already exists
|
||||
set_fact:
|
||||
snippet_present: "{{ snippet_block in caddyfile_content }}"
|
||||
|
||||
- name: Add snippet if missing
|
||||
- name: "Add the {{ host }} site block to the Caddyfile"
|
||||
ansible.builtin.blockinfile:
|
||||
path: "{{ caddyfile_path }}"
|
||||
marker: "# {mark} Ansible managed Caddy snippet for {{ http_host }}"
|
||||
marker: "# {mark} Ansible managed Caddy snippet for {{ host }}"
|
||||
block: "{{ snippet_block }}"
|
||||
create: yes
|
||||
when: not snippet_present
|
||||
notify: "Reload Caddy"
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: '0644'
|
||||
notify: Reload Caddy
|
||||
@@ -0,0 +1,19 @@
|
||||
---
|
||||
# All handlers run as the connection user ({{ podman_user }}), so systemctl
|
||||
# --user works without setting XDG_RUNTIME_DIR.
|
||||
|
||||
- name: Reload systemd user units
|
||||
ansible.builtin.command: systemctl --user daemon-reload
|
||||
changed_when: true
|
||||
listen: Reload systemd user units
|
||||
|
||||
# A changed unit file changes the generated unit, so Gitea is recreated. All of
|
||||
# its state is on the bind mount or in the SQLite database, so a recreate loses
|
||||
# nothing — but it is a few seconds of downtime for the one site.
|
||||
- name: Restart Gitea
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ unit_name }}"
|
||||
scope: user
|
||||
state: restarted
|
||||
daemon_reload: true
|
||||
listen: Restart Gitea
|
||||
@@ -1,36 +1,211 @@
|
||||
---
|
||||
# Tasks for Gitea role
|
||||
- name: Pull Gitea image
|
||||
docker_image:
|
||||
name: "{{ container_image }}"
|
||||
source: pull
|
||||
state: present
|
||||
force_source: yes
|
||||
# Gitea as a rootless Podman Quadlet unit.
|
||||
#
|
||||
# Everything here runs as {{ podman_user }} — the connection user. No become, no
|
||||
# XDG_RUNTIME_DIR: the SSH connection gave us a real PAM session, so systemd's
|
||||
# user manager is reachable through the standard environment.
|
||||
|
||||
- getent:
|
||||
database: passwd
|
||||
key: "{{ user }}"
|
||||
split: ":"
|
||||
# The data tree is created here rather than left to the image, and that is not
|
||||
# housekeeping. With keep-id:uid={{ gitea_uid }} the container process runs as
|
||||
# `git`, so /usr/bin/entrypoint is the *only* part of the image's start-up that
|
||||
# root can do — and it needs root for /etc/passwd, /etc/s6 and this tree.
|
||||
#
|
||||
# Container root is a subuid on the host, but inside its user namespace it holds
|
||||
# the usual capabilities, so `mkdir`, `chmod` and `chown` all succeed; what it
|
||||
# creates is simply left owned by that subuid. The image chowns the directories it
|
||||
# knows about back to `git` — `chown -R ${USER}:git /data/gitea` and `/data/git`
|
||||
# in /etc/s6/gitea/setup, which is where app.ini comes from — so those work either
|
||||
# way. The things it does *not* chown are what this task is for, and they are the
|
||||
# ones that would otherwise be subuid-owned and invisible to the app and to a
|
||||
# plain tar backup:
|
||||
#
|
||||
# gitea/ app.ini, gitea.db, sessions, avatars, indexers
|
||||
# gitea/conf where the entrypoint would generate app.ini
|
||||
# gitea/log Gitea's file log
|
||||
# git/ repositories, LFS, and the git account's HOME
|
||||
# git/.ssh authorized_keys — written by Gitea, read by the host's sshd
|
||||
# ssh/ only ever a *mount point* — see below
|
||||
#
|
||||
# The sshd *inside* the image is the exception; it cannot use this tree at all.
|
||||
# See {{ container_sshd_hostkeys }} below.
|
||||
- name: Ensure the Gitea data directory exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ host_directory }}"
|
||||
state: directory
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: '0755'
|
||||
|
||||
- name: Create gitea container
|
||||
docker_container:
|
||||
name: "{{ container_name }}"
|
||||
image: "{{ container_image }}"
|
||||
state: started
|
||||
restart_policy: "unless-stopped"
|
||||
cpus: .10
|
||||
memory: "512M"
|
||||
memory_swap: "512M"
|
||||
env:
|
||||
USER_UID: "{{ ansible_facts['getent_passwd'][user][1] }}"
|
||||
USER_GID: "{{ ansible_facts['getent_passwd'][user][2] }}"
|
||||
published_ports:
|
||||
- "127.0.0.1:3000:3000"
|
||||
- "127.0.0.1:2222:22"
|
||||
volumes:
|
||||
- /var/lib/gitea:/data
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
- "/home/{{ user }}/.ssh/:/data/git/.ssh"
|
||||
networks:
|
||||
- name: "{{ docker_network }}"
|
||||
- name: Ensure the directories the image expects under /data exist
|
||||
ansible.builtin.file:
|
||||
path: "{{ host_directory }}/{{ item.path }}"
|
||||
state: directory
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: "{{ item.mode }}"
|
||||
loop:
|
||||
- { path: gitea, mode: '0755' }
|
||||
- { path: gitea/conf, mode: '0755' }
|
||||
- { path: gitea/log, mode: '0755' }
|
||||
- { path: git, mode: '0755' }
|
||||
# 0700 because that is what the image's own setup script chmods it to
|
||||
# (`chmod 700 /data/git/.ssh` in /etc/s6/gitea/setup, which runs as root
|
||||
# before `su-exec git`). Set here so the mode never depends on that script
|
||||
# having run.
|
||||
- { path: git/.ssh, mode: '0700' }
|
||||
# The in-image sshd's host keys are mounted over /data/ssh from
|
||||
# {{ container_sshd_hostkeys }}, so this directory is never written to — it
|
||||
# has to *exist*, because it is the mount point. If it does not, Podman
|
||||
# creates it during container set-up, inside the container's user namespace,
|
||||
# and it lands here owned by the subuid rather than by {{ podman_user }}:
|
||||
#
|
||||
# drwxr-xr-t 2 165536 165536 4096 ssh
|
||||
#
|
||||
# which the check at the end of this role then (correctly) fails on. Creating
|
||||
# it first is what keeps the data tree wholly {{ podman_user }}'s.
|
||||
- { path: ssh, mode: '0755' }
|
||||
|
||||
# The image's setup creates this file if it is missing, as root — and it is the
|
||||
# one file under /data the setup never chowns back to `git`, so on a fresh host it
|
||||
# would be left subuid-owned. Writing it here, as {{ podman_user }} and 0600,
|
||||
# both avoids that and states the value the image's own environment carries.
|
||||
- name: Write the container-side .ssh/environment file
|
||||
ansible.builtin.copy:
|
||||
dest: "{{ host_directory }}/git/.ssh/environment"
|
||||
content: |
|
||||
GITEA_CUSTOM={{ gitea_custom }}
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: '0600'
|
||||
|
||||
# The image always starts an sshd of its own inside the container, and that sshd
|
||||
# wants host keys. This deployment does not use it — git-over-SSH arrives on the
|
||||
# host's sshd on port 22 — but it has to have somewhere to write, and the process
|
||||
# that runs it maps to a subuid that cannot touch the data directory. Keeping it
|
||||
# out here means no subuid-owned file ever lands in {{ host_directory }}, so a
|
||||
# plain tar/rsync of the data tree stays complete and error-free, and the check
|
||||
# at the end of this role stays meaningful.
|
||||
#
|
||||
# 0777 is deliberate and bounded: /home/{{ podman_user }} is 0750, so no other
|
||||
# host user can reach this path at all. The mode only matters inside the userns.
|
||||
- name: Ensure the scratch host key directory exists
|
||||
ansible.builtin.file:
|
||||
path: "{{ container_sshd_hostkeys }}"
|
||||
state: directory
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: '0777'
|
||||
|
||||
- name: Install the Gitea Quadlet unit
|
||||
ansible.builtin.template:
|
||||
src: gitea.container.j2
|
||||
dest: "{{ quadlet_dir }}/{{ container_name }}.container"
|
||||
owner: "{{ podman_user }}"
|
||||
group: "{{ podman_user }}"
|
||||
mode: '0644'
|
||||
notify:
|
||||
- Reload systemd user units
|
||||
- Restart Gitea
|
||||
|
||||
# Quadlet honours [Install] WantedBy= when it generates the unit, so
|
||||
# `systemctl --user enable` is neither needed nor possible on a generated unit.
|
||||
#
|
||||
# All three steps are in one block because they fail the same way and want the
|
||||
# same evidence. `systemctl start` reports success as soon as it has handed the
|
||||
# unit to systemd, so a container that dies a second later — a `User=0` missing,
|
||||
# an unwritable /data, a subuid that cannot run the image's start-up — surfaces
|
||||
# only as `activating` from `is-active`, or as a health check that never passes,
|
||||
# with the reason in the journal and nowhere else. Restart=always makes that a
|
||||
# crash loop rather than an error.
|
||||
- name: Start and verify Gitea
|
||||
block:
|
||||
- name: Start Gitea
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ unit_name }}"
|
||||
scope: user
|
||||
state: started
|
||||
daemon_reload: true
|
||||
|
||||
# Retried rather than checked once: podman reports `activating` for the
|
||||
# interval between systemd starting the container and its readiness
|
||||
# notification.
|
||||
- name: Verify Gitea is running
|
||||
ansible.builtin.command: "systemctl --user is-active {{ unit_name }}"
|
||||
register: gitea_active
|
||||
until: gitea_active.stdout == 'active'
|
||||
retries: 12
|
||||
delay: 5
|
||||
changed_when: false
|
||||
|
||||
# `is-active` says the container is running; it does not say the app can
|
||||
# serve. The image ships no HEALTHCHECK, so the unit defines one (HealthCmd=,
|
||||
# see the template) and this runs exactly that command once, synchronously.
|
||||
- name: Wait for Gitea to pass its health check
|
||||
ansible.builtin.command: "podman healthcheck run {{ container_name }}"
|
||||
register: gitea_health
|
||||
until: gitea_health.rc == 0
|
||||
retries: 30
|
||||
delay: 5
|
||||
changed_when: false
|
||||
rescue:
|
||||
# systemd reports "control process exited with error code" and nothing else,
|
||||
# which is useless for the usual failures. The journal is where the image's
|
||||
# own start-up output is — that is where a s6 or entrypoint permission
|
||||
# failure shows up.
|
||||
- name: Collect Gitea diagnostics
|
||||
ansible.builtin.command: "{{ item }}"
|
||||
loop:
|
||||
- "systemctl --user status {{ unit_name }} --no-pager"
|
||||
- "journalctl --user -u {{ unit_name }} --no-pager -n 40"
|
||||
- "podman logs --tail 40 {{ container_name }}"
|
||||
register: gitea_diag
|
||||
changed_when: false
|
||||
failed_when: false
|
||||
|
||||
- name: Show Gitea diagnostics
|
||||
ansible.builtin.debug:
|
||||
msg: "{{ gitea_diag.results | map(attribute='stdout') | list }}"
|
||||
|
||||
- name: Fail
|
||||
ansible.builtin.fail:
|
||||
msg: "Gitea did not start — see the diagnostics above."
|
||||
|
||||
# A wrong keep-id is the one failure here that does not look like one: Gitea
|
||||
# still serves, but from files it owns as an unmapped subuid on the host — files
|
||||
# that then disappear from a tar backup and cannot be deleted without
|
||||
# `podman unshare`. Check the whole tree, not a sample.
|
||||
#
|
||||
# Deliberately not `failed_when: false`: if `find` cannot read something in the
|
||||
# data directory, the tree is not provably clean, and that is the finding.
|
||||
- name: List anything in the data tree not owned by {{ podman_user }}
|
||||
ansible.builtin.command: >-
|
||||
find {{ host_directory }} ! -user {{ podman_user }}
|
||||
register: gitea_stray_owners
|
||||
changed_when: false
|
||||
|
||||
- name: Fail if the data tree holds files owned by another user
|
||||
ansible.builtin.assert:
|
||||
that: gitea_stray_owners.stdout_lines | length == 0
|
||||
fail_msg: >-
|
||||
{{ gitea_stray_owners.stdout_lines | join(', ') }} — every file under
|
||||
{{ host_directory }} must belong to {{ podman_user }}. A subuid in there
|
||||
means the uid Gitea writes as and the uid mapped onto {{ podman_user }}
|
||||
have drifted apart: compare gitea_uid in vars/default.yml with UserNS and
|
||||
USER_UID/USER_GID in {{ quadlet_dir }}/{{ container_name }}.container.
|
||||
|
||||
- name: Check whether the data has been restored
|
||||
ansible.builtin.stat:
|
||||
path: "{{ host_directory }}/gitea/gitea.db"
|
||||
register: gitea_db
|
||||
|
||||
# Not a failure: a fresh instance legitimately has no database yet. But on a
|
||||
# migration it means the copy in readme.md has not run, and the instance that is
|
||||
# now serving is an empty installer rather than this repository's Gitea.
|
||||
- name: Report a data directory with no database in it
|
||||
ansible.builtin.debug:
|
||||
msg: >-
|
||||
{{ host_directory }}/gitea/gitea.db is missing, so this Gitea has no data:
|
||||
it will serve its install page and write a fresh app.ini. Expected only on
|
||||
a brand-new instance — a migrated one is given its data first. See
|
||||
readme.md, "Migrating the data from monoco".
|
||||
when: not gitea_db.stat.exists
|
||||
@@ -0,0 +1,83 @@
|
||||
# Gitea — rootless Podman Quadlet unit.
|
||||
# Managed by Ansible (gitea/roles/gitea). Do not edit by hand.
|
||||
#
|
||||
# Joins {{ network_name }}.network, written by caddy/roles/register — the same
|
||||
# include that attaches Caddy to it. Caddy reaches Gitea by container name, so
|
||||
# nothing is published on the host for HTTP.
|
||||
|
||||
[Unit]
|
||||
Description=Gitea
|
||||
Documentation=https://docs.gitea.com/
|
||||
After=network-online.target
|
||||
Wants=network-online.target
|
||||
|
||||
[Container]
|
||||
ContainerName={{ container_name }}
|
||||
Image={{ image }}
|
||||
|
||||
# Gitea refuses to run as root (`mustNotRunAsRoot`), so the app cannot simply be
|
||||
# container-root the way Caddy and Audiobookshelf are. Instead container uid
|
||||
# {{ gitea_uid }} — the image's own `git` account — is mapped onto
|
||||
# {{ podman_user }}, which keeps every file Gitea writes owned by
|
||||
# {{ podman_user }} on the host: plain tar/rsync backups, no subuids, no
|
||||
# `podman unshare`. The cost is that the image's *root* phases run as a subuid,
|
||||
# which is why roles/gitea creates the data tree up front.
|
||||
#
|
||||
# USER_UID/USER_GID are not decoration: they make the entrypoint keep the
|
||||
# account at {{ gitea_uid }} instead of the image default, which is what holds
|
||||
# the file layout and this mapping together. All of it comes from gitea_uid in
|
||||
# vars/default.yml — change one and the others have to follow.
|
||||
UserNS=keep-id:uid={{ gitea_uid }},gid={{ gitea_gid }}
|
||||
Environment=USER_UID={{ gitea_uid }}
|
||||
Environment=USER_GID={{ gitea_gid }}
|
||||
|
||||
# keep-id also runs the container *process* as that mapped uid, i.e. as `git`,
|
||||
# while the image's start-up is written to begin as root: `s6-svscan`, which is
|
||||
# the image's own CMD, creates `.s6-svscan/lock` inside root-owned /etc/s6, and
|
||||
# /usr/bin/entrypoint rewrites /etc/passwd and /etc/group to apply
|
||||
# USER_UID/USER_GID. Denied both, the container died with
|
||||
#
|
||||
# sed: can't create temp file '/etc/passwdXXXXXX': Permission denied
|
||||
# s6-svscan: fatal: unable to open .s6-svscan/lock: Permission denied
|
||||
#
|
||||
# and Restart=always turned that into a crash loop — which `is-active` reports as
|
||||
# `activating`, not as a failure. User=0 forces the process back to root, and the
|
||||
# mapping above is untouched by it: the server itself still runs as `git`, which
|
||||
# is what satisfies mustNotRunAsRoot. (nextcloud.container carries the same pair
|
||||
# for the same reason.)
|
||||
User=0
|
||||
|
||||
# Only log timestamps: Gitea keeps each user's own timezone in the database.
|
||||
Environment=TZ={{ timezone }}
|
||||
|
||||
# The image's VOLUME. Repositories, LFS, the SQLite database, app.ini, sessions,
|
||||
# logs, and the authorized_keys file the host's sshd reads.
|
||||
Volume={{ host_directory }}:/data
|
||||
|
||||
# The image starts an sshd of its own on port 22 inside the container. This
|
||||
# deployment does not use it — git-over-SSH arrives on the *host's* sshd and is
|
||||
# forwarded with `podman exec` — but it still wants host keys, and it runs as the
|
||||
# container's root, which under keep-id is a subuid that cannot write into the
|
||||
# data directory. It gets a scratch directory of its own instead, outside the
|
||||
# data tree, so nothing it writes can end up in a backup. It is not published,
|
||||
# and nothing connects to it.
|
||||
Volume={{ container_sshd_hostkeys }}:/data/ssh
|
||||
|
||||
Network={{ network_name }}.network
|
||||
|
||||
# The image ships no HEALTHCHECK, so the unit defines one and the play gates on
|
||||
# it. /api/healthz is Gitea's own unauthenticated health endpoint.
|
||||
HealthCmd={{ health_cmd }}
|
||||
HealthInterval=30s
|
||||
HealthTimeout=5s
|
||||
HealthRetries=3
|
||||
HealthStartPeriod=60s
|
||||
|
||||
[Service]
|
||||
Restart=always
|
||||
# The first start initialises the SQLite database and runs its migrations before
|
||||
# the server answers.
|
||||
TimeoutStartSec=180
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@@ -0,0 +1,140 @@
|
||||
---
|
||||
# The host half of Gitea's git-over-SSH support.
|
||||
#
|
||||
# Port 22 belongs to the host's sshd and stays that way: clients keep using
|
||||
# git@git.tanshu.com:user/repo.git, and no remote URL changes. Four host-side
|
||||
# pieces make that work:
|
||||
#
|
||||
# 1. a `{{ git_user }}` login user with no interactive access — every key
|
||||
# Gitea accepts carries a forced command, so sshd runs the shim and
|
||||
# nothing else;
|
||||
# 2. {{ shim_path }}, the shim those forced commands invoke;
|
||||
# 3. {{ podman_exec_wrapper }} plus a one-command sudoers rule — how the shim,
|
||||
# running as `{{ git_user }}`, reaches a container owned by
|
||||
# {{ podman_user }};
|
||||
# 4. the sshd and sudoers drop-ins that tie the above together.
|
||||
#
|
||||
# What differs from the Docker-era role is the second hop. It used to be an ssh
|
||||
# into an sshd running *inside* the container; under keep-id that sshd runs as a
|
||||
# subuid and cannot read the authorized_keys Gitea writes as {{ podman_user }},
|
||||
# so the hop is a `podman exec` instead. readme.md, "How git over SSH works
|
||||
# now", is where the reasoning lives.
|
||||
#
|
||||
# Every task here is root-only (users, /usr/local/bin, /etc/ssh, /etc/sudoers),
|
||||
# so each elevates on its own. The play carries no become, because the Quadlet
|
||||
# units have to belong to the connection user.
|
||||
|
||||
- name: Ensure the git group exists
|
||||
ansible.builtin.group:
|
||||
name: "{{ git_user }}"
|
||||
become: true
|
||||
|
||||
# The shell matters even though nobody ever gets one: sshd runs a forced command
|
||||
# through the login user's shell (`/bin/bash -c '...'`), so a nologin shell would
|
||||
# break git-over-SSH outright.
|
||||
#
|
||||
# The uid is deliberately left to the system. On monoco the host git account was
|
||||
# uid 1003 because the container's git account was 1003 and the two shared one
|
||||
# uid space; under keep-id the container's 1003 is mapped onto {{ podman_user }}
|
||||
# instead, so nothing on this host depends on this number any more — not the
|
||||
# key file (owned by name), not the sudoers rule (matched by name), not the
|
||||
# authorized_keys hook (run as {{ podman_user }}).
|
||||
- name: Add the git login user
|
||||
ansible.builtin.user:
|
||||
name: "{{ git_user }}"
|
||||
comment: Gitea SSH login user
|
||||
group: "{{ git_user }}"
|
||||
home: "{{ git_home }}"
|
||||
shell: /bin/bash
|
||||
create_home: true
|
||||
become: true
|
||||
|
||||
# There is deliberately no ~/.ssh for this user any more. Its old contents were
|
||||
# the shim's client key and the authorized_keys Gitea maintains; the key is
|
||||
# obsolete (nothing authenticates over ssh in this design) and the file lives in
|
||||
# the container's data tree now, where Gitea writes it. The migration notes in
|
||||
# readme.md move the file into place.
|
||||
|
||||
- name: Install the git-over-SSH passthrough shim
|
||||
ansible.builtin.template:
|
||||
src: gitea.j2
|
||||
dest: "{{ shim_path }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
become: true
|
||||
|
||||
- name: Install the container exec wrapper
|
||||
ansible.builtin.template:
|
||||
src: gitea-container-exec.j2
|
||||
dest: "{{ podman_exec_wrapper }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
become: true
|
||||
|
||||
- name: Install the authorized_keys hook sshd runs for the git user
|
||||
ansible.builtin.template:
|
||||
src: gitea-authorized-keys.j2
|
||||
dest: "{{ authorized_keys_command }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0755'
|
||||
become: true
|
||||
|
||||
# valid with `visudo -cf %s`: a syntax error in /etc/sudoers.d does not fail one
|
||||
# rule, it fails *every* sudo invocation on the host, which on a server reached
|
||||
# by ssh is a nasty way to find out.
|
||||
- name: Let the git user reach the container as {{ podman_user }}
|
||||
ansible.builtin.template:
|
||||
src: sudoers-gitea.j2
|
||||
dest: "{{ sudoers_path }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0440'
|
||||
validate: /usr/sbin/visudo -cf %s
|
||||
become: true
|
||||
|
||||
- name: Point sshd at Gitea's authorized_keys
|
||||
block:
|
||||
- name: Install the sshd drop-in for the git user
|
||||
ansible.builtin.template:
|
||||
src: sshd-gitea.conf.j2
|
||||
dest: "{{ sshd_dropin_path }}"
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
register: gitea_sshd_dropin
|
||||
become: true
|
||||
|
||||
# A drop-in that does not parse is not a failed play, it is a host nobody can
|
||||
# log in to after the next reboot: sshd reads the whole directory at start-up.
|
||||
# Validate the resulting configuration before it is ever loaded, and take the
|
||||
# file away again if it does not parse.
|
||||
- name: Validate the resulting sshd configuration
|
||||
ansible.builtin.command: /usr/sbin/sshd -t
|
||||
changed_when: false
|
||||
become: true
|
||||
when: gitea_sshd_dropin.changed
|
||||
rescue:
|
||||
- name: Take the sshd drop-in back out
|
||||
ansible.builtin.file:
|
||||
path: "{{ sshd_dropin_path }}"
|
||||
state: absent
|
||||
become: true
|
||||
|
||||
- name: Fail
|
||||
ansible.builtin.fail:
|
||||
msg: >-
|
||||
{{ sshd_dropin_path }} did not validate, so it has been removed and
|
||||
sshd is still running — and still restarting — on its previous
|
||||
configuration. Run `/usr/sbin/sshd -t` on the host to see why.
|
||||
|
||||
# `reload`, not `restart`: a reload re-execs sshd without dropping the connection
|
||||
# this play is running over.
|
||||
- name: Reload sshd
|
||||
ansible.builtin.systemd_service:
|
||||
name: "{{ sshd_service }}"
|
||||
state: reloaded
|
||||
become: true
|
||||
when: gitea_sshd_dropin.changed
|
||||
@@ -0,0 +1,29 @@
|
||||
#!/bin/sh
|
||||
# sshd's source for the `{{ git_user }}` user's authorized_keys.
|
||||
# Managed by Ansible (gitea/roles/ssh). Do not edit by hand.
|
||||
#
|
||||
# Gitea maintains that file from inside its container, where it runs as
|
||||
# {{ podman_user }} (container uid {{ gitea_uid }} is mapped onto that user by
|
||||
# keep-id), so the file belongs to {{ podman_user }} and not to `{{ git_user }}`.
|
||||
# sshd refuses a file the login user does not own — that is StrictModes — and
|
||||
# StrictModes cannot be relaxed for one user, because sshd_config(5) does not
|
||||
# allow the option inside a Match block. So the file is fed to sshd through
|
||||
# AuthorizedKeysCommand instead: sshd uses whatever this prints, and applies no
|
||||
# ownership check to it.
|
||||
#
|
||||
# Only lines that force the passthrough shim are printed. Gitea's file also
|
||||
# carries an unforced entry for the "Gitea Host Key" that the Docker-era
|
||||
# deployment needed so that its shim could ssh into a second sshd inside the
|
||||
# container. Nothing reads that entry any more, and printing it would hand an
|
||||
# interactive `{{ git_user }}` login on this host — and therefore rootless
|
||||
# Podman, through the sudoers drop-in — to anyone holding a copy of that key,
|
||||
# a backup included.
|
||||
#
|
||||
# The pattern is exactly the shape Gitea writes. If it ever changes,
|
||||
# git-over-SSH stops working while HTTPS keeps serving, and
|
||||
# podman exec {{ container_name }} cat /data/git/.ssh/authorized_keys
|
||||
# shows what Gitea writes now.
|
||||
keys="{{ host_directory }}/git/.ssh/authorized_keys"
|
||||
[ -r "$keys" ] || exit 0
|
||||
grep -E '^command="{{ shim_path }} ' "$keys"
|
||||
exit 0
|
||||
@@ -0,0 +1,34 @@
|
||||
#!/bin/sh
|
||||
# Runs one authorized_keys command inside Gitea's rootless container.
|
||||
# Managed by Ansible (gitea/roles/ssh). Do not edit by hand.
|
||||
#
|
||||
# This runs as {{ podman_user }} — the user whose rootless Podman owns the
|
||||
# container, which is the entire reason the wrapper exists. The `{{ git_user }}`
|
||||
# login user cannot enter another user's rootless container, and there is no
|
||||
# sshd inside the container to hop through any more (see readme.md, "How git
|
||||
# over SSH works now"), so the forced command sshd runs for a git client ends up
|
||||
# here.
|
||||
#
|
||||
# $1 SSH_ORIGINAL_COMMAND — the client's original request, passed through so
|
||||
# Gitea can serve it.
|
||||
# $@ the rest of the authorized_keys line, i.e.
|
||||
# /usr/local/bin/gitea --config=/data/gitea/conf/app.ini serv key-N —
|
||||
# the *container's* Gitea binary, not the host's shim at the same path.
|
||||
#
|
||||
# --user, HOME and GITEA_CUSTOM are what sshd used to supply: it ran the command
|
||||
# as the container's git account, with HOME from /etc/passwd and GITEA_CUSTOM
|
||||
# from /data/git/.ssh/environment. GITEA_CUSTOM and USER are image defaults and
|
||||
# come through `podman exec` on their own; HOME does not, and git looks there for
|
||||
# /data/git/.gitconfig, so it is set explicitly.
|
||||
#
|
||||
# XDG_RUNTIME_DIR is set explicitly because `sudo -u` creates no PAM session, so
|
||||
# Podman would not otherwise find this user's runtime directory — the same reason
|
||||
# caddy/readme.md shows the `sudo -u … systemctl --user` form with it.
|
||||
original_command="$1"
|
||||
shift
|
||||
exec env XDG_RUNTIME_DIR="/run/user/$(id -u)" \
|
||||
podman exec --interactive \
|
||||
--user {{ gitea_uid }}:{{ gitea_gid }} \
|
||||
--env "HOME=/data/git" \
|
||||
--env "SSH_ORIGINAL_COMMAND=$original_command" \
|
||||
{{ container_name }} "$@"
|
||||
@@ -0,0 +1,25 @@
|
||||
#!/bin/sh
|
||||
# Gitea's git-over-SSH passthrough shim — {{ shim_path }}
|
||||
# Managed by Ansible (gitea/roles/ssh). Do not edit by hand.
|
||||
#
|
||||
# The host's sshd runs this, as the `{{ git_user }}` login user, whenever a
|
||||
# client presents a key whose authorized_keys line is a forced command. Gitea
|
||||
# writes those lines itself, from inside its container, and each one looks like
|
||||
# this:
|
||||
#
|
||||
# command="/usr/local/bin/gitea --config=/data/gitea/conf/app.ini serv key-5",...
|
||||
#
|
||||
# So $@ here is `--config=/data/gitea/conf/app.ini serv key-5`, and $0 is the
|
||||
# path of Gitea's own binary *inside the container*, which the wrapper resolves
|
||||
# in there. The path is a contract, not a knob: it is already baked into every
|
||||
# line of the authorized_keys file copied from monoco.
|
||||
#
|
||||
# `{{ git_user }}` cannot reach rootless containers that belong to
|
||||
# {{ podman_user }}, so the command is handed to {{ podman_exec_wrapper }}, which
|
||||
# sudo runs as {{ podman_user }}. SSH_ORIGINAL_COMMAND — the client's own
|
||||
# git-upload-pack / git-receive-pack request — crosses as an argument, because
|
||||
# sudo strips the environment.
|
||||
#
|
||||
# `sudo -n` on purpose: there is no TTY on this path, so a password prompt would
|
||||
# hang a git push instead of failing it.
|
||||
exec sudo -n -u {{ podman_user }} {{ podman_exec_wrapper }} "$SSH_ORIGINAL_COMMAND" "$@"
|
||||
@@ -0,0 +1,20 @@
|
||||
# git-over-SSH for Gitea's `{{ git_user }}` login user.
|
||||
# Managed by Ansible (gitea/roles/ssh). Do not edit by hand.
|
||||
#
|
||||
# The authorized_keys file is maintained by Gitea from inside its container, as
|
||||
# {{ podman_user }}, so `{{ git_user }}` does not own it — which is precisely what
|
||||
# StrictModes refuses. StrictModes cannot be relaxed for a single user
|
||||
# (sshd_config(5) does not permit it inside a Match block), so the keys are
|
||||
# handed to sshd by {{ authorized_keys_command }} instead, which sshd uses
|
||||
# without any ownership check.
|
||||
#
|
||||
# AuthorizedKeysFile=none turns the file lookup off. Without it sshd would still
|
||||
# read (and log a StrictModes complaint about) ~/.ssh/authorized_keys on every
|
||||
# connection before falling through to the command.
|
||||
#
|
||||
# This drop-in must stay in one file, and the Match block must stay last in it:
|
||||
# sshd applies everything after a Match to the matched connections only.
|
||||
Match User {{ git_user }}
|
||||
AuthorizedKeysFile none
|
||||
AuthorizedKeysCommand {{ authorized_keys_command }}
|
||||
AuthorizedKeysCommandUser {{ podman_user }}
|
||||
@@ -0,0 +1,17 @@
|
||||
# Let Gitea's `{{ git_user }}` login user run exactly one command as
|
||||
# {{ podman_user }}: the wrapper that execs into Gitea's rootless container.
|
||||
# Managed by Ansible (gitea/roles/ssh). Do not edit by hand.
|
||||
#
|
||||
# This is what replaces the ssh hop the Docker-era deployment used. A rootless
|
||||
# container belongs to one user and cannot be entered by another, and no sshd
|
||||
# runs inside the container any more, so the forced command sshd runs for a git
|
||||
# client has to become `podman exec` — run as {{ podman_user }}.
|
||||
#
|
||||
# No arguments are pinned, on purpose. The command line comes from the
|
||||
# authorized_keys lines Gitea maintains (… serv key-N), and that file is already
|
||||
# the thing deciding who may reach which repository; restating its format here
|
||||
# would only add a second place to update whenever Gitea changes it, and pinning
|
||||
# it loosely enough to be useful (… serv *) would not restrict anything the
|
||||
# wrapper does not already fix — container, uid and environment are all baked
|
||||
# into {{ podman_exec_wrapper }}.
|
||||
{{ git_user }} ALL=({{ podman_user }}) NOPASSWD: {{ podman_exec_wrapper }}
|
||||
Reference in new issue
Block a user