From 85b600afc9b23383a18bc486d6ef60e8fe853f3c Mon Sep 17 00:00:00 2001 From: Trammell Hudson Date: Thu, 5 May 2022 09:32:07 +0000 Subject: [PATCH] gitea: automatically complete install and enable OIDC --- README.md | 2 -- gitea/README.md | 8 +----- gitea/add-auth | 66 ------------------------------------------------- gitea/setup | 42 ++----------------------------- 4 files changed, 3 insertions(+), 115 deletions(-) delete mode 100644 gitea/add-auth diff --git a/README.md b/README.md index 1123d5f..10df55f 100644 --- a/README.md +++ b/README.md @@ -17,5 +17,3 @@ apt install jq docker-compose ./nginx/setup ./start-all ``` - -* gitea requires some manual configuration; see [gitea/README][gitea/README.md] for more info diff --git a/gitea/README.md b/gitea/README.md index 3e56968..ef1b0be 100644 --- a/gitea/README.md +++ b/gitea/README.md @@ -1,9 +1,3 @@ # gitea -After the `setup` script has run, the website *still* requires a click to finish the installation. -Once that is done it will break since the OpenID login has not yet been configured. Run this to -fix it. - -``` -./add-auth -``` +OIDC setup is now automated diff --git a/gitea/add-auth b/gitea/add-auth deleted file mode 100644 index 0af8add..0000000 --- a/gitea/add-auth +++ /dev/null @@ -1,66 +0,0 @@ -#!/bin/bash -# run this *after* initializing the database by clicking on the ok -# issue filed https://github.com/go-gitea/gitea/issues/19616 -source ../env.production -source ./env.production -source ../data/gitea/env.secrets - - -true || curl "https://${GITEA_HOSTNAME}/" \ - -v \ - -X POST \ - -H 'Origin: null' \ - -H 'Connection: keep-alive' \ - -H 'Upgrade-Insecure-Requests: 1' \ - -H 'Sec-Fetch-Dest: document' \ - -H 'Sec-Fetch-Mode: navigate' \ - -H 'Sec-Fetch-Site: same-origin' \ - -H 'Sec-Fetch-User: ?1' \ - -H 'TE: trailers' \ - -H 'Cookie: i_like_gitea=ac81483e536b3641' \ - -F "db_type=postgres" \ - -F "db_host=db:5432" \ - -F "db_user=gitea" \ - -F "db_passwd=gitea" \ - -F "db_name=gitea" \ - -F "ssl_mode=disable" \ - -F "db_schema=" \ - -F "charset=utf8" \ - -F "db_path=/data/gitea/gitea.db" \ - -F "app_name=${REALM} Gitea" \ - -F "repo_root_path=/data/git/repositories" \ - -F "lfs_root_path=/data/git/lfs" \ - -F "run_user=git" \ - -F "domain=${GITEA_HOSTNAME}" \ - -F "ssh_port=22" \ - -F "http_port=3000" \ - -F "app_url=https://${GITEA_HOSTNAME}/" \ - -F "log_root_path=/data/gitea/log" \ - -F "smtp_host=" \ - -F "smtp_from=" \ - -F "smtp_user=" \ - -F "smtp_passwd=" \ - -F "enable_federated_avatar=on" \ - -F "enable_open_id_sign_in=on" \ - -F "allow_only_external_registration=on" \ - -F "default_allow_create_organization=on" \ - -F "default_enable_timetracking=on" \ - -F "no_reply_address=noreply.${GITEA_HOSTNAME}" \ - -F "password_algorithm=pbkdf2" \ - -F "admin_name=root" \ - -F "admin_passwd=${GITEA_ADMIN_PASSWORD}" \ - -F "admin_confirm_passwd=${GITEA_ADMIN_PASSWORD}" \ - -F "admin_email=" \ -|| die "unable to initiate install" - - -docker-compose exec -u git gitea \ - gitea admin auth add-oauth \ - --name "keycloak" \ - --provider "openidConnect" \ - --key "gitea" \ - --secret "$GITEA_CLIENT_SECRET" \ - --auto-discover-url "https://${KEYCLOAK_HOSTNAME}/realms/${REALM}/.well-known/openid-configuration" \ - --group-claim-name "groups" \ - --admin-group "admin" \ -|| die "unable to add oauth interface" diff --git a/gitea/setup b/gitea/setup index 87a2c3b..d05db79 100755 --- a/gitea/setup +++ b/gitea/setup @@ -29,6 +29,8 @@ cat < "$SECRETS" GITEA_CLIENT_SECRET=$GITEA_CLIENT_SECRET GITEA_ADMIN_PASSWORD=$GITEA_ADMIN_PASSWORD GITEA__server__ROOT_URL=https://$GITEA_HOSTNAME/ +GITEA__security__INSTALL_LOCK=true +GITEA__security__SECRET_KEY=$(openssl rand -hex 32) EOF @@ -52,46 +54,6 @@ docker-compose up -d || die "unable to start container" info "waiting for startup..." sleep 5 -info "attempting to finish install" -curl "https://${GITEA_HOSTNAME}/" \ - -X POST \ - -f "db_type=postgres" \ - -f "db_host=db:5432" \ - -f "db_user=gitea" \ - -f "db_passwd=gitea" \ - -f "db_name=gitea" \ - -f "ssl_mode=disable" \ - -f "db_schema=" \ - -f "charset=utf8" \ - -f "db_path=/data/gitea/gitea.db" \ - -f "app_name=${REALM} Gitea" \ - -f "repo_root_path=/data/git/repositories" \ - -f "lfs_root_path=/data/git/lfs" \ - -f "run_user=git" \ - -f "domain=${GITEA_HOSTNAME}" \ - -f "ssh_port=22" \ - -f "http_port=3000" \ - -f "app_url=https://${GITEA_HOSTNAME}/" \ - -f "log_root_path=/data/gitea/log" \ - -f "smtp_host=" \ - -f "smtp_from=" \ - -f "smtp_user=" \ - -f "smtp_passwd=" \ - -f "enable_federated_avatar=on" \ - -f "enable_open_id_sign_in=on" \ - -f "allow_only_external_registration=on" \ - -f "default_allow_create_organization=on" \ - -f "default_enable_timetracking=on" \ - -f "no_reply_address=noreply.${GITEA_HOSTNAME}" \ - -f "password_algorithm=pbkdf2" \ - -f "admin_name=root" \ - -f "admin_passwd=${GITEA_ADMIN_PASSWORD}" \ - -f "admin_confirm_passwd=${GITEA_ADMIN_PASSWORD}" \ - -f "admin_email=" \ -|| die "unable to initiate install" - -sleep 10 - info "adding oauth login" docker-compose exec -u git gitea \ gitea admin auth add-oauth \