tanshu
476a6d7cd0
Comment blocks now stay within three lines and explain only the non-obvious. Long histories, include examples, and commented-out code are gone. No task, key, or value changed; the only data change is comment text inside the generated unit files.
65 lines
2.5 KiB
YAML
65 lines
2.5 KiB
YAML
---
|
|
# Duplicated from caddy/vars/default.yml on purpose, so keep them in sync.
|
|
# podman_user comes from the connection user, so the play needs gather_facts.
|
|
podman_user: "{{ ansible_facts['user_id'] }}"
|
|
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
|
|
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"
|
|
|
|
host: git.tanshu.com
|
|
|
|
container_name: gitea
|
|
unit_name: "{{ container_name }}.service"
|
|
|
|
# Fully qualified because rootless Podman would otherwise prompt for a registry, and a unit has no TTY.
|
|
image: docker.io/gitea/gitea:latest
|
|
|
|
# caddy/roles/register pins the Podman network to <network_name>_net, so the Quadlet file is gitea.network.
|
|
network_name: "{{ container_name }}"
|
|
|
|
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
|
|
|
|
# The port Caddy proxies to inside the container, where app.ini's HTTP_PORT listens. Nothing is published on the host.
|
|
container_port: 3000
|
|
|
|
# The uid/gid of the image's `git` account, and therefore the uid Gitea runs as.
|
|
# UserNS maps it onto podman_user, USER_UID/GID keep it, and roles/ssh execs as it, so change all three together.
|
|
gitea_uid: 1003
|
|
gitea_gid: 1003
|
|
|
|
# The image's data directory inside the container, and the GITEA_CUSTOM it already sets.
|
|
gitea_custom: /data/gitea
|
|
|
|
# The image ships no HEALTHCHECK, so the unit defines one from this endpoint and the play gates on it.
|
|
health_cmd: "curl -fsS -o /dev/null http://127.0.0.1:{{ container_port }}/api/healthz"
|
|
|
|
# Only log timestamps are affected: Gitea stores each user's own timezone.
|
|
timezone: Asia/Kolkata
|
|
|
|
# The in-image sshd needs host keys somewhere, but it runs as a subuid, so keep them outside the data tree.
|
|
container_sshd_hostkeys: "{{ podman_data_dir }}/{{ container_name }}-sshd"
|
|
|
|
# Clients keep using git@git.tanshu.com:user/repo.git on port 22, served by the host's sshd.
|
|
# `git_home` only has to exist, and its uid is left to the system.
|
|
git_user: git
|
|
git_home: /home/git
|
|
|
|
# Renaming this path locks users out because every authorized_keys line Gitea writes already contains it.
|
|
shim_path: /usr/local/bin/gitea
|
|
|
|
# Runs as podman_user through the sudoers drop-in and does the podman exec.
|
|
podman_exec_wrapper: /usr/local/bin/gitea-container-exec
|
|
|
|
authorized_keys_command: /usr/local/bin/gitea-authorized-keys
|
|
|
|
sshd_dropin_path: /etc/ssh/sshd_config.d/60-gitea.conf
|
|
sshd_service: ssh
|
|
sudoers_path: /etc/sudoers.d/gitea-ssh-passthrough
|
|
|
|
caddy_name: caddy
|
|
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"
|
|
|
|
snippet_block: |
|
|
{{ host }} {
|
|
reverse_proxy {{ container_name }}:{{ container_port }}
|
|
}
|