Added gitea

README.md

@@ -28,6 +28,7 @@ What do you get if you point Sovereign at a server? All kinds of good stuff!
 -   [CalDAV](https://en.wikipedia.org/wiki/CalDAV) and [CardDAV](https://en.wikipedia.org/wiki/CardDAV) to keep your calendars and contacts in sync, via [NextCloud](http://nextcloud.com/).
 -   Your own VPN server via [OpenVPN](http://openvpn.net/index.php/open-source.html).
 -   An IRC bouncer via [ZNC](http://wiki.znc.in/ZNC).
+-   Git Repo hosting via [gitea](https://gitea.io/en-us/).
 -   [Monit](http://mmonit.com/monit/) to keep everything running smoothly (and alert you when it’s not).
 -   Web hosting (ex: for your blog) via [Apache](https://www.apache.org/).
 -   Statistics for the website using [Fathom](https://github.com/usefathom/fathom).
@@ -116,6 +117,7 @@ Create `A` or `CNAME` records which point to your server's IP address:
 * `fathom.example.com` (for web stats)
 * `news.example.com` (for Selfoss)
 * `cloud.example.com` (for NextCloud)
+* `git.example.com` (for gitea)
 
 ### 6. Run the Ansible Playbooks
 

roles/common/templates/etc_fail2ban_jail.local.j2

@@ -62,3 +62,13 @@ logpath = /var/log/mail.log
 maxretry = 20
 findtime = 1200
 bantime = 1200
+
+[gitea]
+enabled = true
+port = http,https
+filter = gitea
+logpath = /data/gitea/log/gitea.log
+maxretry = 10
+findtime = 3600
+bantime = 900
+action = iptables-allports

roles/gitea/defaults/main.yml

@@ -0,0 +1,22 @@
+secret_root: '{{ inventory_dir | realpath }}'
+secret_name: 'secret'
+secret: '{{ secret_root + "/" + secret_name }}'
+
+gitea_subdomain: "git"
+gitea_domain: "{{ gitea_subdomain }}.{{ domain }}"
+
+gitea_version: "1.7.3"
+gitea_release: "https://github.com/go-gitea/gitea/releases/download/v{{ gitea_version }}/gitea-{{ gitea_version }}-linux-amd64"
+
+gitea_admin_username: "{{ main_user_name }}"
+gitea_admin_password: "{{ lookup('password', secret + '/' + 'gitea_admin_password length=32') }}"
+
+gitea_db_username: giteauser
+gitea_db_password: "{{ lookup('password', secret + '/' + 'gitea_db_password length=32') }}"
+gitea_db_database: gitea
+
+gitea_secret: "{{ lookup('password', secret + '/' + 'db_admin_password length=14') }}"
+
+# must match values in roles/common
+db_admin_username: 'postgres'
+db_admin_password: "{{ lookup('password', secret + '/' + 'db_admin_password length=32') }}"

roles/gitea/files/etc_fail2ban_filter.d_gitea.conf

@@ -0,0 +1,4 @@
+# gitea.conf
+[Definition]
+failregex =  .*Failed authentication attempt for .* from <HOST>
+ignoreregex =

roles/gitea/files/etc_systemd_system_gitea.service

@@ -0,0 +1,17 @@
+[Unit]
+Description=Starts the gitea server
+Requires=network.target
+After=network.target
+After=syslog.target
+
+[Service]
+Type=simple
+User=git
+Restart=always
+RestartSec=3
+WorkingDirectory=/data/gitea
+ExecStart=/usr/local/bin/gitea web -c /etc/gitea/app.ini
+Environment=USER=git HOME=/home/git GITEA_WORK_DIR=/data/gitea
+
+[Install]
+WantedBy=multi-user.target

roles/gitea/handlers/main.yml

@@ -0,0 +1,2 @@
+- name: restart apache
+  service: name=apache2 state=restarted

roles/gitea/tasks/gitea.yml

@@ -0,0 +1,122 @@
+- name: Create temporary gitea directory
+  file: state=directory path=/root/gitea
+
+- name: Download gitea {{ gitea_version }} release
+  get_url:
+    url="{{ gitea_release }}"
+    dest=/root/gitea/gitea-{{ gitea_version }}
+
+- name: Make gitea release download executable
+  file: path=/root/gitea/gitea-{{ gitea_version }} mode=0775
+
+- name: Create /usr/local/bin
+  file: state=directory path=/usr/local/bin
+
+- name: Stop old gitea instance
+  service: name=gitea state=stopped
+  ignore_errors: True
+
+- name: Copy gitea binary to /usr/local/bin
+  shell: cp gitea/gitea-{{ gitea_version }} /usr/local/bin/gitea chdir=/root
+
+- name: Add git user
+  user:
+    name: git
+    home: /home/git
+    create_home: yes
+    shell: /bin/bash
+    password_lock: yes
+    state: present
+    system: yes
+
+- name: Create gitea data directories
+  file:
+    state: directory
+    path: "/data/{{ item }}"
+    owner: git
+    group: git
+    mode: 0750
+  with_items:
+    - gitea
+    - gitea/custom
+    - gitea/data
+    - gitea/log
+    - gitea/repos
+
+- name: Create gitea config directory
+  file:
+    state: directory
+    path: "/etc/gitea"
+    owner: git
+    group: git
+    mode: 0750
+
+- name: Add gitea config file
+  template:
+    src=etc_gitea_app_ini.j2
+    dest=/etc/gitea/app.ini
+    owner=git
+    group=root
+    mode=0644
+
+- name: Add gitea postgres user
+  postgresql_user:
+    login_host=localhost
+    login_user={{ db_admin_username }}
+    login_password="{{ db_admin_password }}"
+    name={{ gitea_db_username }}
+    password="{{ gitea_db_password }}"
+    encrypted=yes
+    state=present
+
+- name: Create gitea database
+  postgresql_db:
+    login_host=localhost
+    login_user={{ db_admin_username }}
+    login_password="{{ db_admin_password }}"
+    name={{ gitea_db_database }}
+    state=present
+    owner={{ gitea_db_username }}
+
+# Unfortunately, create-user is not idempotent, so this task will fail
+# https://github.com/go-gitea/gitea/issues/6307
+- name: Create gitea admin user account
+  become: true
+  become_user: git
+  shell: /usr/local/bin/gitea admin create-user --admin --config /etc/gitea/app.ini --name {{ gitea_admin_username }} --password {{ gitea_admin_password }} --email {{ admin_email }}
+  args:
+    chdir: /data/gitea
+  ignore_errors: True
+
+- name: Add fail2ban script for gitea
+  copy:
+    src=etc_fail2ban_filter.d_gitea.conf
+    dest=/etc/fail2ban/filter.d/gitea.conf
+    owner=root
+    group=root
+
+- name: Add systemd service to start gitea automatically
+  copy:
+    src=etc_systemd_system_gitea.service
+    dest=/etc/systemd/system/gitea.service
+    owner=root
+    group=root
+
+- name: Register new gitea service
+  systemd: name=gitea daemon_reload=yes enabled=yes
+
+- name: Start new gitea instance
+  service: name=gitea state=started
+
+- name: Create the Apache gitea sites config files
+  template:
+    src=etc_apache2_sites-available_gitea.j2
+    dest=/etc/apache2/sites-available/gitea_{{ item.name }}.conf
+    owner=root
+    group=root
+  with_items: "{{ virtual_domains }}"
+
+- name: Enable Apache sites (creates new sites-enabled symlinks)
+  command: a2ensite gitea_{{ item }}.conf creates=/etc/apache2/sites-enabled/gitea_{{ item }}.conf
+  notify: restart apache
+  with_items: "{{ virtual_domains | json_query('[*].name') }}"

roles/gitea/tasks/main.yml

@@ -0,0 +1 @@
+- include: gitea.yml tags=gitea

roles/gitea/templates/etc_apache2_sites-available_gitea.j2

@@ -0,0 +1,20 @@
+<VirtualHost *:80>
+    ServerName {{ gitea_subdomain }}.{{ item.name }}
+
+    Redirect permanent / https://{{ item.name }}/
+</VirtualHost>
+
+<VirtualHost *:443>
+    ServerName {{ gitea_subdomain }}.{{ item.name }}
+
+    SSLEngine               On
+    DocumentRoot            "{{ item.doc_root }}"
+    DirectoryIndex          index.html
+    Options                 -Indexes
+    HostnameLookups         Off
+
+    ProxyRequests           Off
+    ProxyPreserveHost       On
+    ProxyPass               / http://localhost:3000/
+    ProxyPassReverse        / http://localhost:3000/
+</VirtualHost>

roles/gitea/templates/etc_gitea_app_ini.j2

@@ -0,0 +1,47 @@
+; sovereign gitea config file
+; see https://github.com/go-gitea/gitea/blob/master/custom/conf/app.ini.sample
+
+APP_NAME = {{ domain }} Gitea
+RUN_MODE = prod
+
+[repository]
+ROOT = /data/gitea/repos
+
+[ui]
+DEFAULT_THEME = arc-green
+
+[server]
+PROTOCOL = http
+DOMAIN = {{ gitea_domain }}
+HTTP_ADDR = 127.0.0.1
+HTTP_PORT = 3000
+
+[database]
+DB_TYPE = postgres
+HOST = 127.0.0.1:5432
+NAME = {{ gitea_db_database }}
+USER = {{ gitea_db_username }}
+PASSWD = `{{ gitea_db_password }}`
+SSL_MODE = disable
+
+[security]
+INSTALL_LOCK = true
+SECRET_KEY = {{ gitea_secret }}
+
+[mailer]
+ENABLED = true
+FROM = gitea@{{ domain }}
+MAILER_TYPE = sendmail
+
+[log]
+ROOT_PATH = /data/gitea/log
+MODE = file
+LEVEL = Info
+
+[log.file]
+LEVEL = Info
+LOG_ROTATE = true
+MAX_LINES = 1000000
+MAX_SIZE_SHIFT = 28
+DAILY_ROTATE = true
+MAX_DAYS = 7

roles/monitoring/files/etc_monit_conf.d_gitea

@@ -0,0 +1,8 @@
+check process gitea matching gitea
+  group www
+  start program = "/bin/systemctl start gitea"
+  stop program = "/bin/systemctl stop gitea"
+  if failed port 3000 protocol http
+    with timeout 10 seconds
+    then restart
+  if 5 restarts within 5 cycles then timeout

roles/monitoring/tasks/monit.yml

@@ -36,6 +36,10 @@
   stat: path=/etc/rspamd/rspamd.conf
   register: rspamd_config_file
 
+- name: Determine if gitea is installed
+  stat: path=/etc/gitea/app.ini
+  register: gitea_config_file
+
 - name: Copy ZNC monit service config files into place
   copy: src=etc_monit_conf.d_znc dest=/etc/monit/conf.d/znc
   notify: restart monit
@@ -61,6 +65,11 @@
   notify: restart monit
   when: rspamd_config_file.stat.exists == True
 
+- name: Copy gitea monit service config files into place
+  copy: src=etc_monit_conf.d_gitea dest=/etc/monit/conf.d/gitea
+  notify: restart monit
+  when: gitea_config_file.stat.exists == True
+
 - name: Copy monit service config files into place
   copy: src=etc_monit_conf.d_{{ item }} dest=/etc/monit/conf.d/{{ item }}
   with_items:

site.yml

@@ -8,12 +8,13 @@
 
   roles:
     - common
+    - blog
     - mailserver
     - webmail
-    - blog
+    - news
     - nextcloud
+    - gitea
     - ircbouncer
     - xmpp
     - vpn
-    - news
     - monitoring  # Monitoring role should be last. See roles/monitoring/README.md