commit 141f5af4fc994eb0cef235c279111fe6c508d0e6 Author: John Date: Thu Oct 1 20:39:32 2026 +0200 initial commit diff --git a/ansible.cfg b/ansible.cfg new file mode 100644 index 0000000..a8a8c13 --- /dev/null +++ b/ansible.cfg @@ -0,0 +1,6 @@ +[defaults] +inventory = inventory.yml +remote_user = maintenance + +[diff] +always = True diff --git a/group_vars/gitea/main.yml b/group_vars/gitea/main.yml new file mode 100644 index 0000000..4b8298e --- /dev/null +++ b/group_vars/gitea/main.yml @@ -0,0 +1,3 @@ +--- +gitea_mail: git@cosmosim.dev +gitea_domain: git.cosmosim.dev diff --git a/group_vars/gitea/vault.yml b/group_vars/gitea/vault.yml new file mode 100644 index 0000000..120ab01 --- /dev/null +++ b/group_vars/gitea/vault.yml @@ -0,0 +1,26 @@ +$ANSIBLE_VAULT;1.1;AES256 +31376133613563626561663930366365366265343839633831633539363237306530623939336364 +3464323531333363336564623364633938373331306432650a393763376366343763366336623966 +30323234623034366162636264366266666434616161656237623333386636313566663038393932 +3635653666346231370a363539313138333239303535346434373237636134383231376661633365 +38383232666532333937643135366537316337623436613639616366393362356231323138373934 +36643532363066303535626138663434393135376131363236363731383963346538316532303361 +37393738343666373230666433316364386535303666623632336536313032366531353636646531 +63303432303439323031326336353962666461623438336132343133363235303831653037653331 +62366262636534303765653032343637656563366364356162393961623466623161646261316633 +64636265393034636263373764363632356564333063316463633737306362316239306562376663 +30363662653039393431353766346439303064616133633362353231383834333166373437656135 +35363266336361636563616436393963653765636362386239623430333738383964336264363837 +64643239623732643632303466333361333638376438646532653435323235396361343830363939 +33333833323735333435353762646634663933313631333661643439363262376632333336303534 +64636134346533356535656163386631656634353033306431653966333232393662626165336463 +63656333323535643334643532623037386166353464366365303635326266333235353034396336 +33323434336130626630656536656565616162626164363263613231316361623866376234313835 +31653263373363363535346539356135313664323966653163633337326462633661663232663637 +30386433373263393065306632346161666166376536633035613332636332663865343465393036 +63366338656437396231643338356631616362643265323930643064343430393733303935633363 +30643033666133616431306637643765303435353331353966636638613032333864333563343135 +35613033666136333962643163643163663566306534623933363066316432373331396261666433 +36353130313064333261663439396432613839663964623831323035653139633035613136316263 +37613766373962663465636136353066323236333435636537656263306137303934333165303636 +3961 diff --git a/group_vars/prod/main.yml b/group_vars/prod/main.yml new file mode 100644 index 0000000..2f2cf06 --- /dev/null +++ b/group_vars/prod/main.yml @@ -0,0 +1,10 @@ +$ANSIBLE_VAULT;1.1;AES256 +30356431313463623663633263383937323038616432616538373538346436656465313234376334 +6639323566623432346462356261383165326462393738660a323365643736383437366434656635 +66633733623830656332623264636466383761346337666565376435323833313361643862616436 +3861326137363236350a643030666431316632383561613638363330356230663234623863366533 +65373135636239376636393435363139333066326435656431333039653161306365616464333261 +66373564623266356638363930356366376563373864396165626562333339636139633032643464 +30626666373137613362303734616462303938313236323238373665656434303132383636383131 +32313434336561653065633334316661303535333261343031303433653535626465633534323235 +37656435326636326262363665303238643631353235633434393964616436356539 diff --git a/inventory.yml b/inventory.yml new file mode 100644 index 0000000..774aab1 --- /dev/null +++ b/inventory.yml @@ -0,0 +1,5 @@ +[prod] +cosmosim.dev + +[gitea] +cosmosim.dev diff --git a/roles/gitea/handlers/main.yml b/roles/gitea/handlers/main.yml new file mode 100644 index 0000000..dc1b9a2 --- /dev/null +++ b/roles/gitea/handlers/main.yml @@ -0,0 +1,5 @@ +--- +- name: Restart gitea + runit: + name: gitea + state: restarted diff --git a/roles/gitea/tasks/main.yml b/roles/gitea/tasks/main.yml new file mode 100644 index 0000000..24c64ff --- /dev/null +++ b/roles/gitea/tasks/main.yml @@ -0,0 +1,75 @@ +--- +- name: Install gitea package + ansible.builtin.xbps: + pkg: + - gitea + - python3-dnspython + - python3-psycopg2 + state: present + +- name: add dns entry + community.general.nsupdate: + key_name: "ansible" + key_secret: "{{ dns_tsig_key }}" + key_algorithm: "hmac-sha512" + server: "127.0.0.1" + zone: "cosmosim.dev" + record: "{{ gitea_domain }}." + type: "CNAME" + value: "cosmosim.dev." + state: present + +- name: Create _gitea role + community.postgresql.postgresql_user: + name: _gitea + state: present + become: true + become_user: postgres + +- name: Create postgres database + community.postgresql.postgresql_db: + name: gitea + owner: _gitea + state: present + become: true + become_user: postgres + +- name: Create run directory + ansible.builtin.file: + path: /run/gitea + owner: _gitea + group: _gitea + mode: 0750 + state: directory + +- name: Set run dir acl + ansible.posix.acl: + path: /run/gitea + entity: caddy + etype: user + permissions: rX + state: present + +- name: Set run dir acl + ansible.posix.acl: + path: /run/gitea + entity: caddy + etype: user + permissions: rw + default: true + state: present + +- name: Upload gitea.conf + ansible.builtin.template: + src: templates/gitea.conf.j2 + dest: /etc/gitea.conf + owner: root + group: _gitea + mode: 0640 + notify: + - Restart gitea + +- name: Enable gitea Service + runit: + name: gitea + enabled: true diff --git a/roles/gitea/templates/gitea.conf.j2 b/roles/gitea/templates/gitea.conf.j2 new file mode 100644 index 0000000..39765b8 --- /dev/null +++ b/roles/gitea/templates/gitea.conf.j2 @@ -0,0 +1,65 @@ +;; see https://docs.gitea.com/administration/config-cheat-sheet for additional documentation. + +RUN_USER = _gitea +APP_NAME = gitea +[server] +PROTOCOL = fcgi+unix +DOMAIN = {{ gitea_domain }} +ROOT_URL = https://{{ gitea_domain }}/ +HTTP_ADDR = /run/gitea/gitea.sock +UNIX_SOCKET_PERMISSION = 660 +SSH_ROOT_PATH = /var/lib/gitea/.ssh +STATIC_ROOT_PATH = /var/lib/gitea +LFS_JWT_SECRET = {{ gitea_lfs_jwt_secret }} +[database] +DB_TYPE = postgres +HOST = /tmp/ +NAME = gitea +USER = _gitea +PASSWD = +[security] +INSTALL_LOCK = true +SECRET_KEY = {{ gitea_secret_key }} +INTERNAL_TOKEN = {{ gitea_internal_token }} +[camo] +[oauth2] +ENABLED = true +JWT_SECRET = {{ gitea_jwt_secret }} +[log] +ROOT_PATH = /var/log/gitea +MODE = console +LEVEL = Info +[mailer] +ENABLED = true +PROTOCOL = smtps +SMTP_ADDR = mail.johnnynator.de +SMTP_PORT = 465 +FROM = "Gitea <{{gitea_mail }}>" +USER = {{ gitea_mail }} +PASSWD = {{ gitea_mail_password }} +[email.incoming] +ENABLED = true +HOST = mail.johnnynator.de +PORT = 993 +USERNAME = {{ gitea_mail }} +PASSWORD = {{ gitea_mail_password }} +USE_TLS = true +REPLY_TO_ADDRESS = git+%{token}@cosmosim.dev +[session] +COOKIE_SECURE = true +[git] +[service] +REGISTER_EMAIL_CONFIRM = true +ENABLE_NOTIFY_MAIL = true +DISABLE_REGISTRATION = true +[service.explore] +DISABLE_USERS_PAGE = true +[repository] +ROOT = /var/lib/gitea/repositories +[repository.upload] +[indexer] +ISSUE_INDEXER_PATH = /var/lib/gitea/indexers/issues.bleve +[picture] +AVATAR_UPLOAD_PATH = /var/lib/gitea/data/avatars +[lfs] +PATH = /var/lib/gitea/lfs diff --git a/site.yml b/site.yml new file mode 100644 index 0000000..b208d06 --- /dev/null +++ b/site.yml @@ -0,0 +1,9 @@ +--- +- hosts: gitea + become: yes + become_method: sudo + become_user: root + roles: + - gitea + tags: + - gitea