Mark
a9554f3e5d
Merged from veridion-gitea and veridion-act-runner-gitea repos. nult (Null-T) - instant teleportation from Strugatsky's Noon Universe. Like Null-T, this toolkit instantly deploys infrastructure. Roles: - gitea: Gitea server with PostgreSQL (Docker Compose) - act_runner: Gitea Actions runner Playbooks: - gitea.yml: Deploy Gitea server - act-runner.yml: Deploy Act Runner - site.yml: Deploy all services Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
152 lines
5.5 KiB
YAML
152 lines
5.5 KiB
YAML
---
|
|
# =============================================================================
|
|
# Gitea Role Defaults
|
|
# =============================================================================
|
|
#
|
|
# Default values for Gitea role variables.
|
|
# These have the LOWEST precedence and can be overridden by:
|
|
# - group_vars/all/vars.yml
|
|
# - inventory host_vars
|
|
# - command line --extra-vars
|
|
#
|
|
# Reference: https://docs.ansible.com/ansible/latest/playbook_guide/playbooks_variables.html#variable-precedence-where-should-i-put-a-variable
|
|
# Reference: https://docs.gitea.com/administration/config-cheat-sheet
|
|
# =============================================================================
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Version Configuration
|
|
# -----------------------------------------------------------------------------
|
|
# Using major.minor pinning for automatic security patch updates.
|
|
# Reference: https://hub.docker.com/r/gitea/gitea
|
|
# Reference: https://hub.docker.com/_/postgres
|
|
|
|
gitea_version: "1.25"
|
|
gitea_postgres_version: "17-alpine"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Container Configuration
|
|
# -----------------------------------------------------------------------------
|
|
# Service names for docker compose commands
|
|
gitea_service_name: "server"
|
|
gitea_db_service_name: "db"
|
|
|
|
# Container names for docker exec commands (may differ from service names)
|
|
gitea_container_name: "gitea"
|
|
gitea_db_container_name: "gitea-db-1"
|
|
|
|
# User/Group IDs for container processes
|
|
# These should match existing volume ownership
|
|
gitea_user_uid: 1002
|
|
gitea_user_gid: 1004
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Database Configuration
|
|
# -----------------------------------------------------------------------------
|
|
|
|
gitea_db_type: "postgres"
|
|
gitea_db_host: "db:5432"
|
|
gitea_db_name: "gitea"
|
|
gitea_db_user: "gitea"
|
|
# gitea_db_password: MUST be set via vault mapping in group_vars/all/vars.yml
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Network Configuration
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# HTTP port inside container (external 443 maps to this via ACME)
|
|
gitea_http_port: 3000
|
|
|
|
# SSH port configuration
|
|
gitea_ssh_port: 22
|
|
gitea_ssh_listen_port: 22
|
|
gitea_ssh_external_port: 2222
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Security Hardening - Password & Authentication
|
|
# -----------------------------------------------------------------------------
|
|
# Reference: https://docs.gitea.com/administration/config-cheat-sheet#security-security
|
|
# Reference: https://onappsec.com/gitea-configuration-hardening/
|
|
|
|
# Password hashing algorithm
|
|
# Options: argon2, pbkdf2, pbkdf2_v1, pbkdf2_hi, scrypt, bcrypt
|
|
# argon2 is the strongest and recommended choice
|
|
gitea_password_hash_algo: "argon2"
|
|
|
|
# Password complexity requirements
|
|
# Options: off, lower, upper, digit, spec (comma-separated)
|
|
gitea_password_complexity: "lower,upper,digit,spec"
|
|
|
|
# Minimum password length (NIST SP 800-63B recommends 8+)
|
|
gitea_min_password_length: 12
|
|
|
|
# Check passwords against HaveIBeenPwned database
|
|
gitea_password_check_pwn: true
|
|
|
|
# Two-factor authentication is enabled by default in Gitea 1.25+
|
|
# No configuration needed - users can enable 2FA in their account settings
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Security Hardening - API & Features
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# Disable Git hooks (prevents arbitrary code execution via hooks)
|
|
gitea_disable_git_hooks: true
|
|
|
|
# Reject API tokens passed in URL query strings (header-based only)
|
|
# Prevents token leakage in server logs and browser history
|
|
gitea_disable_query_auth_token: true
|
|
|
|
# Webhook allowed destination hosts
|
|
# Options: loopback, private, external, *, or CIDR list
|
|
gitea_webhook_allowed_hosts: "external"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Security Hardening - Session & Cookies
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# Force HTTPS for session cookies
|
|
gitea_cookie_secure: true
|
|
|
|
# SameSite cookie policy (strict prevents CSRF)
|
|
# Options: lax, strict, none
|
|
gitea_same_site: "strict"
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Security Hardening - TLS
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# Minimum TLS version (disable older vulnerable protocols)
|
|
gitea_ssl_min_version: "TLSv1.2"
|
|
|
|
# ACME/Let's Encrypt automatic certificate provisioning
|
|
gitea_enable_acme: true
|
|
gitea_acme_accept_tos: true
|
|
gitea_acme_directory: "https"
|
|
# gitea_acme_email: SHOULD be set via vault mapping in group_vars/all/vars.yml
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Service Configuration
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# Disable public registration (admin-only account creation)
|
|
gitea_disable_registration: true
|
|
|
|
# Require sign-in to view any content
|
|
gitea_require_signin_view: false
|
|
|
|
# LFS (Large File Storage) support
|
|
gitea_lfs_enabled: true
|
|
|
|
# Offline mode (don't fetch external resources like Gravatar)
|
|
gitea_offline_mode: true
|
|
|
|
# -----------------------------------------------------------------------------
|
|
# Backup Configuration
|
|
# -----------------------------------------------------------------------------
|
|
|
|
# Backup directory (relative to gitea_install_dir)
|
|
gitea_backup_dir: "backups"
|
|
|
|
# Number of backup sets to retain
|
|
gitea_backup_retention: 5
|