78 lines
3.0 KiB
YAML
78 lines
3.0 KiB
YAML
# =====================================================================
|
|
# Gitea - where the VM sub-agent publishes what it built.
|
|
#
|
|
# ONLY vm_agent NEEDS THIS. Every other tool works without it, and so
|
|
# does vm_agent itself: without Gitea a session still runs, still keeps
|
|
# its files in the project folder on the array, and simply returns no
|
|
# link. If you are not using the VM sub-agent, skip this file entirely.
|
|
#
|
|
# WHAT THE SUB-AGENT NEEDS FROM IT
|
|
# * an organisation to create repositories in (OWUITOOLS_GITEA_ORG)
|
|
# * a bot account with write access to it (OWUITOOLS_GITEA_BOT)
|
|
# * an access token for that account (OWUITOOLS_GITEA_TOKEN)
|
|
#
|
|
# All three go in /etc/owuivm/vmd.env, from configs/vmd.env. The token
|
|
# NEVER enters the guest or the agent container: vmd clones, commits and
|
|
# pushes on the host and supplies the credential at push time through
|
|
# GIT_ASKPASS. See docs/setup/gitea.md.
|
|
#
|
|
# WHY TWO URLs
|
|
# vmd pushes to the LAN address and gives the user the public one. The
|
|
# daemon's systemd unit has an address allowlist with exactly this
|
|
# destination on it, and a public name behind a CDN would not match.
|
|
# =====================================================================
|
|
# Pinned so the project and its volume have the same names wherever this
|
|
# file is run from - see the note in open-webui.compose.yml.
|
|
name: gitea
|
|
|
|
services:
|
|
gitea:
|
|
image: gitea/gitea:1
|
|
container_name: gitea
|
|
restart: unless-stopped
|
|
|
|
environment:
|
|
USER_UID: 1000
|
|
USER_GID: 1000
|
|
|
|
GITEA__server__PROTOCOL: http
|
|
GITEA__server__HTTP_ADDR: 0.0.0.0
|
|
GITEA__server__HTTP_PORT: 3000
|
|
GITEA__server__DOMAIN: git.example.com
|
|
GITEA__server__ROOT_URL: https://git.example.com/
|
|
GITEA__server__LOCAL_ROOT_URL: http://localhost:3000/
|
|
|
|
# The agent creates repositories through the API as its bot user.
|
|
# Registration stays closed; the bot is made by hand, once.
|
|
GITEA__service__DISABLE_REGISTRATION: "true"
|
|
|
|
GITEA__server__DISABLE_SSH: "false"
|
|
GITEA__server__START_SSH_SERVER: "false"
|
|
GITEA__server__SSH_USER: git
|
|
GITEA__server__SSH_DOMAIN: git.example.com
|
|
GITEA__server__SSH_PORT: 7222
|
|
|
|
# Only if you front this with a reverse proxy. Naming the proxy
|
|
# rather than "*" is what stops a client forging its own source IP.
|
|
GITEA__security__REVERSE_PROXY_LIMIT: 1
|
|
GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: "192.168.1.0/24"
|
|
|
|
GITEA__repository__ROOT: /data/git/repositories
|
|
|
|
ports:
|
|
# Bind to the LAN address rather than 0.0.0.0 if this machine has
|
|
# one; plain "7200:3000" is fine otherwise. Whatever you choose
|
|
# here is what OWUITOOLS_GITEA_URL must say, and what
|
|
# owuivmd.service's IPAddressAllow must permit.
|
|
- "7200:3000"
|
|
- "7222:22"
|
|
|
|
volumes:
|
|
- /srv/gitea/repositories:/data/git/repositories
|
|
- gitea-data:/data
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
|
|
volumes:
|
|
gitea-data:
|