gitea: document OIDC setup step

README.md

@@ -17,3 +17,5 @@ apt install jq docker-compose
 ./nginx/setup
 ./start-all
 ```
+
+* gitea requires some manual configuration; see [gitea/README][gitea/README.md] for more info

gitea/README.md

@@ -1,9 +1,9 @@
 # gitea
 
-OpenID setup doesn't work out of the box.  The open id provider must be configured:
+After the `setup` script has run, the website *still* requires a click to finish the installation.
+Once that is done it will break since the OpenID login has not yet been configured.  Run this to
+fix it.
 
-* Authentication name: `keycloak`
+```
-* OAuth2 Provider: `OpenID Connect`
+./add-auth
-* Client key: `gitea`
+```
-* Client secret: (copy from `../data/gitea/env.secrets`)
-* Discovery URL: https://login.hackerspace.zone/realms/hackerspace/.well-known/openid-configuration

gitea/add-auth

@@ -0,0 +1,66 @@
+#!/bin/bash
+# run this *after* initializing the database by clicking on the ok
+# issue filed https://github.com/go-gitea/gitea/issues/19616
+source ../env.production
+source ./env.production
+source ../data/gitea/env.secrets
+
+
+true || curl "https://${GITEA_HOSTNAME}/" \
+	-v \
+	-X POST \
+	-H 'Origin: null' \
+	-H 'Connection: keep-alive' \
+	-H 'Upgrade-Insecure-Requests: 1' \
+	-H 'Sec-Fetch-Dest: document' \
+	-H 'Sec-Fetch-Mode: navigate' \
+	-H 'Sec-Fetch-Site: same-origin' \
+	-H 'Sec-Fetch-User: ?1' \
+	-H 'TE: trailers' \
+	-H 'Cookie: i_like_gitea=ac81483e536b3641' \
+	-F "db_type=postgres" \
+	-F "db_host=db:5432" \
+	-F "db_user=gitea" \
+	-F "db_passwd=gitea" \
+	-F "db_name=gitea" \
+	-F "ssl_mode=disable" \
+	-F "db_schema=" \
+	-F "charset=utf8" \
+	-F "db_path=/data/gitea/gitea.db" \
+	-F "app_name=${REALM} Gitea" \
+	-F "repo_root_path=/data/git/repositories" \
+	-F "lfs_root_path=/data/git/lfs" \
+	-F "run_user=git" \
+	-F "domain=${GITEA_HOSTNAME}" \
+	-F "ssh_port=22" \
+	-F "http_port=3000" \
+	-F "app_url=https://${GITEA_HOSTNAME}/" \
+	-F "log_root_path=/data/gitea/log" \
+	-F "smtp_host=" \
+	-F "smtp_from=" \
+	-F "smtp_user=" \
+	-F "smtp_passwd=" \
+	-F "enable_federated_avatar=on" \
+	-F "enable_open_id_sign_in=on" \
+	-F "allow_only_external_registration=on" \
+	-F "default_allow_create_organization=on" \
+	-F "default_enable_timetracking=on" \
+	-F "no_reply_address=noreply.${GITEA_HOSTNAME}" \
+	-F "password_algorithm=pbkdf2" \
+	-F "admin_name=root" \
+	-F "admin_passwd=${GITEA_ADMIN_PASSWORD}" \
+	-F "admin_confirm_passwd=${GITEA_ADMIN_PASSWORD}" \
+	-F "admin_email=" \
+|| die "unable to initiate install"
+
+
+docker-compose exec -u git gitea \
+	gitea admin auth add-oauth \
+	--name "keycloak" \
+	--provider "openidConnect" \
+	--key "gitea" \
+	--secret "$GITEA_CLIENT_SECRET" \
+	--auto-discover-url "https://${KEYCLOAK_HOSTNAME}/realms/${REALM}/.well-known/openid-configuration" \
+	--group-claim-name "groups" \
+	--admin-group "admin" \
+|| die "unable to add oauth interface"

gitea/setup

@@ -19,6 +19,7 @@ fi
 
 
 GITEA_CLIENT_SECRET="$(openssl rand -hex 32)"
+GITEA_ADMIN_PASSWORD="$(openssl rand -hex 8)"
 
 info "creating new secrets $SECRETS"
 
@@ -26,6 +27,7 @@ mkdir -p "$DATA"
 cat <<EOF > "$SECRETS"
 # DO NOT CHECK IN
 GITEA_CLIENT_SECRET=$GITEA_CLIENT_SECRET
+GITEA_ADMIN_PASSWORD=$GITEA_ADMIN_PASSWORD
 GITEA__server__ROOT_URL=https://$GITEA_HOSTNAME/
 EOF
 
@@ -46,3 +48,58 @@ docker-compose down 2>/dev/null
 EOF
 
 docker-compose up -d || die "unable to start container"
+
+info "waiting for startup..."
+sleep 5
+
+info "attempting to finish install"
+curl "https://${GITEA_HOSTNAME}/" \
+	-X POST \
+	-f "db_type=postgres" \
+	-f "db_host=db:5432" \
+	-f "db_user=gitea" \
+	-f "db_passwd=gitea" \
+	-f "db_name=gitea" \
+	-f "ssl_mode=disable" \
+	-f "db_schema=" \
+	-f "charset=utf8" \
+	-f "db_path=/data/gitea/gitea.db" \
+	-f "app_name=${REALM} Gitea" \
+	-f "repo_root_path=/data/git/repositories" \
+	-f "lfs_root_path=/data/git/lfs" \
+	-f "run_user=git" \
+	-f "domain=${GITEA_HOSTNAME}" \
+	-f "ssh_port=22" \
+	-f "http_port=3000" \
+	-f "app_url=https://${GITEA_HOSTNAME}/" \
+	-f "log_root_path=/data/gitea/log" \
+	-f "smtp_host=" \
+	-f "smtp_from=" \
+	-f "smtp_user=" \
+	-f "smtp_passwd=" \
+	-f "enable_federated_avatar=on" \
+	-f "enable_open_id_sign_in=on" \
+	-f "allow_only_external_registration=on" \
+	-f "default_allow_create_organization=on" \
+	-f "default_enable_timetracking=on" \
+	-f "no_reply_address=noreply.${GITEA_HOSTNAME}" \
+	-f "password_algorithm=pbkdf2" \
+	-f "admin_name=root" \
+	-f "admin_passwd=${GITEA_ADMIN_PASSWORD}" \
+	-f "admin_confirm_passwd=${GITEA_ADMIN_PASSWORD}" \
+	-f "admin_email=" \
+|| die "unable to initiate install"
+
+sleep 10
+
+info "adding oauth login"
+docker-compose exec -u git gitea \
+	gitea admin auth add-oauth \
+	--name "keycloak" \
+	--provider "openidConnect" \
+	--key "gitea" \
+	--secret "$GITEA_CLIENT_SECRET" \
+	--auto-discover-url "https://${KEYCLOAK_HOSTNAME}/realms/${REALM}/.well-known/openid-configuration" \
+	--group-claim-name "groups" \
+	--admin-group "admin" \
+|| die "unable to add oauth interface"