Add gitea container

containers/gitea/files/mariadb/log_level.cnf

@@ -0,0 +1,2 @@
+[mariadb]
+log_warnings = 3

containers/gitea/files/mariadb/name_resolve.cnf

@@ -0,0 +1,2 @@
+[mariadb]
+skip-name-resolve = ON

containers/gitea/tasks.yml

@@ -0,0 +1,152 @@
+---
+- hosts: all
+  name: Gitea web server
+  tasks:
+    - name: Create podman volumes
+      containers.podman.podman_volume:
+        state: present
+        name: "{{ item }}"
+      become_user: containers
+      become: true
+      loop:
+        - gitea
+        - gitea-db
+
+    - name: Create podman networks
+      containers.podman.podman_network:
+        name: "{{ item }}"
+        recreate: false
+        state: "present"
+      become_user: containers
+      become: true
+      loop:
+        - traefik-gitea
+        - mariadb-gitea
+        - gitea-drone
+
+    - name: Pull container images
+      become_user: containers
+      become: true
+      containers.podman.podman_image:
+        name: docker.io/{{ item }}
+      loop:
+        - gitea/gitea:latest
+        - mariadb:latest
+
+    - name: Copy mariadb config directory
+      become: true
+      ansible.builtin.copy:
+        src: files/mariadb/
+        dest: /etc/gitea/mariadb/
+        owner: containers
+        group: containers
+        mode: 0600
+
+    - name: Create mariadb instance
+      become_user: containers
+      become: true
+      containers.podman.podman_container:
+        name: db_gitea
+        image: docker.io/mariadb:latest
+        state: present
+        command:
+          - "--transaction-isolation=READ-COMMITTED"
+          - "--binlog-format=ROW"
+        volume:
+          - gitea-db:/var/lib/mysql:Z
+          - /etc/gitea/mariadb/:/etc/mysql/conf.d:Z
+        network:
+          - mariadb-gitea
+        env:
+          MARIADB_ROOT_PASSWORD: "{{ vault_gitea_mariadb_root_password }}"
+          MARIADB_DATABASE: "{{ vault_gitea_mariadb_database }}"
+          MARIADB_USER: "{{ vault_gitea_mariadb_user }}"
+          MARIADB_PASSWORD: "{{ vault_gitea_mariadb_password }}"
+          MARIADB_AUTO_UPGRADE: "true"
+        generate_systemd:
+          path: /home/containers/.config/systemd/user/
+          restart_policy: on-failure
+          names: true
+          new: true
+
+    - name: Add a gitea container
+      become_user: containers
+      become: true
+      containers.podman.podman_container:
+        name: gitea
+        image: docker.io/gitea/gitea:latest
+        state: present
+        expose:
+          - 24
+        network:
+          - traefik-gitea
+          - mariadb-gitea
+          - gitea-drone
+        volume:
+          - gitea:/data:Z
+          - /etc/localtime:/etc/localtime:ro
+        label:
+          io.containers.autoupdate: "registry"
+          traefik.enable: "true"
+          traefik.http.routers.gitea.entrypoints: "https"
+          traefik.http.routers.gitea.rule: "PathPrefix(`/git`)"
+          traefik.http.routers.gitea.tls: "true"
+          traefik.http.routers.gitea.tls.certresolver: "wildcard"
+          traefik.http.routers.gitea.service: "gitea"
+          traefik.http.routers.gitea.middlewares: "authelia@file"
+          traefik.http.services.gitea.loadbalancer.server.port: "3000"
+          traefik.docker.network: "traefik-gitea"
+        env:
+          APP_NAME: "Git server"
+          RUN_MODE: "prod"
+          RUN_USER: "git"
+          DOMAIN: "{{ inventory_hostname }}"
+          SSH_DOMAIN: "{{ inventory_hostname }}"
+          ROOT_URL: "https://{{ inventory_hostname }}/git"
+          SSH_PORT: 24
+          DISABLE_REGISTRATION: true
+          # REQUIRE_SIGNIN_VIEW: true
+          REGISTER_EMAIL_CONFIRM: true
+          ENABLE_CAPTCHA: true
+          DEFAULT_KEEP_EMAIL_PRIVATE: true
+          DEFAULT_BRANCH: "main"
+          ALLOWED_HOST_LIST: "{{ inventory_hostname }}/drone"
+          GITEA__database__DB_TYPE: mysql
+          GITEA__database__HOST: db_gitea:3306
+          GITEA__database__NAME: "{{ vault_gitea_mariadb_database }}"
+          GITEA__database__USER: "{{ vault_gitea_mariadb_user }}"
+          GITEA__database__PASSWD: "{{ vault_gitea_mariadb_password }}"
+          GITEA__mailer__ENABLED: true
+          GITEA__mailer__FROM: "{{ vault_smtp_user }}"
+          GITEA__mailer__MAILER_TYPE: "smtp"
+          GITEA__mailer__SMTP_ADDR: "{{ vault_smtp_host }}"
+          GITEA__mailer__SMTP_PORT: "{{ vault_smtp_port }}"
+          GITEA__mailer__IS_TLS_ENABLED: true
+          GITEA__mailer__USER: "{{ vault_smtp_user }}"
+          GITEA__mailer__PASSWD: "{{ vault_smtp_password }}"
+          GITEA__log__MODE: "console"
+          GITEA__log__LEVEL: "info"
+          GITEA__service__DISABLE_REGISTRATION: true
+          GITEA__service__SIGNIN_VIEW: false
+          GITEA__service__REGISTER_EMAIL_CONFIRM: true
+          GITEA__service__ENABLE_CAPTCHA: true
+          GITEA__service__DEFAULT_KEEP_EMAIL_PRIVATE: true
+          GITEA__ui__THEMES: "auto,gitea,arc-green,gitea-modern"
+        generate_systemd:
+          path: /home/containers/.config/systemd/user/
+          restart_policy: on-failure
+          names: true
+          new: true
+
+    - name: Start containers at boot
+      become_user: containers
+      become: true
+      ansible.builtin.systemd:
+        scope: user
+        name: container-{{ item }}.service
+        enabled: true
+        state: started
+        daemon_reload: true
+      loop:
+        - gitea
+        - db_gitea

containers/traefik/tasks.yml

@@ -2,123 +2,125 @@
 - hosts: all
   name: Traefik reverse proxy
   tasks:
-  - name: Get containers UID
-    ansible.builtin.command: "id -u containers"
-    register: uid_containers
-    changed_when: uid_containers.rc != 0
+    - name: Get containers UID
+      ansible.builtin.command: "id -u containers"
+      register: uid_containers
+      changed_when: uid_containers.rc != 0
 
-  - name: Permit traffic from any IP to http port
-    become: true
+    - name: Permit traffic from any IP to http port
+      become: true
       community.general.ufw:
-      direction: in
-      from_ip: any
-      proto: tcp
-      to_port: 80
-      rule: allow
+        direction: in
+        from_ip: any
+        proto: tcp
+        to_port: 80
+        rule: allow
 
-  - name: Permit traffic from any IP to https port
-    become: true
+    - name: Permit traffic from any IP to https port
+      become: true
       community.general.ufw:
-      direction: in
-      from_ip: any
-      proto: tcp
-      to_port: 443
-      rule: allow
+        direction: in
+        from_ip: any
+        proto: tcp
+        to_port: 443
+        rule: allow
 
-  - name: Pull traefik image
-    become_user: containers
-    become: true
-    containers.podman.podman_image:
-      name: docker.io/traefik:latest
+    - name: Pull traefik image
+      become_user: containers
+      become: true
+      containers.podman.podman_image:
+        name: docker.io/traefik:latest
 
-  - name: Change permission to traefik folder
-    become: true
-    ansible.builtin.file:
-      path: /etc/traefik
-      owner: containers
-      group: containers
-      mode: 0700
-      state: directory
+    - name: Change permission to traefik folder
+      become: true
+      ansible.builtin.file:
+        path: /etc/traefik
+        owner: containers
+        group: containers
+        mode: 0700
+        state: directory
 
-  - name: Copy config directory
-    become: true
-    ansible.builtin.copy:
-      src: files/
-      dest: /etc/traefik/
-      owner: containers
-      group: containers
-      mode: 0600
+    - name: Copy config directory
+      become: true
+      ansible.builtin.copy:
+        src: files/
+        dest: /etc/traefik/
+        owner: containers
+        group: containers
+        mode: 0600
 
-  - name: Copy config files from templates
-    become: true
-    ansible.builtin.template:
-      src: "templates/{{ item }}.j2"
-      dest: "/etc/traefik/{{ item }}"
-      owner: containers
-      group: containers
-      mode: 0600
-    loop:
-      - traefik.yml
-      - conf/cockpit.yml
+    - name: Copy config files from templates
+      become: true
+      ansible.builtin.template:
+        src: "templates/{{ item }}.j2"
+        dest: "/etc/traefik/{{ item }}"
+        owner: containers
+        group: containers
+        mode: 0600
+      loop:
+        - traefik.yml
+        - conf/cockpit.yml
 
-  - name: Create podman networks
-    containers.podman.podman_network:
-      name: "{{ item }}"
-      recreate: false
-      state: "present"
-    become_user: containers
-    become: true
-    loop:
-      - traefik
-      - traefik-portainer
-      - traefik-nextcloud
-
-  - name: Create traefik instance
-    become_user: containers
-    become: true
-    containers.podman.podman_container:
-      name: traefik
-      image: docker.io/traefik:latest
-      state: present
-      ports:
-        - 80:80
-        - 443:443
-      security_opt:
-        - label=type:container_runtime_t
-      volume:
-        - /run/user/{{ uid_containers.stdout }}/podman/podman.sock:/var/run/docker.sock:z
-        - /etc/traefik/:/etc/traefik:Z
-      network:
+    - name: Create podman networks
+      containers.podman.podman_network:
+        name: "{{ item }}"
+        recreate: false
+        state: "present"
+      become_user: containers
+      become: true
+      loop:
         - traefik
         - traefik-portainer
         - traefik-nextcloud
-      cap_add:
-        - NET_ADMIN
-      label:
-        io.containers.autoupdate: "registry"
-        traefik.enable: "true"
-        traefik.http.middlewares.traefik-auth.basicauth.users: "{{ vault_traefik_basic_auth }}"
-        traefik.http.routers.traefik.entrypoints: "https"
-          traefik.http.routers.traefik.rule: "PathPrefix(`/traefik`)"
-        traefik.http.routers.traefik.middlewares: "traefik-auth@docker"
-        traefik.http.routers.traefik.tls: "true"
-        traefik.http.routers.traefik.tls.certresolver: "wildcard"
-        traefik.http.routers.traefik.tls.domains[0].main: "{{ inventory_hostname }}"
-        traefik.http.routers.traefik.service: "api@internal"
-      generate_systemd:
-        path: /home/containers/.config/systemd/user/
-        restart_policy: on-failure
-        names: true
-        new: true
+        - traefik-gitea
 
-  - name: Start containers at boot
-    become_user: containers
-    become: true
-    ansible.builtin.systemd:
-      scope: user
-      name: container-{{ item }}.service
-      enabled: true
-      state: started
-      daemon_reload: true
-    loop:
-      - traefik
+    - name: Create traefik instance
+      become_user: containers
+      become: true
+      containers.podman.podman_container:
+        name: traefik
+        image: docker.io/traefik:latest
+        state: present
+        ports:
+          - 80:80
+          - 443:443
+        security_opt:
+          - label=type:container_runtime_t
+        volume:
+          - /run/user/{{ uid_containers.stdout }}/podman/podman.sock:/var/run/docker.sock:z
+          - /etc/traefik/:/etc/traefik:Z
+        network:
+          - traefik
+          - traefik-portainer
+          - traefik-nextcloud
+          - traefik-gitea
+        cap_add:
+          - NET_ADMIN
+        label:
+          io.containers.autoupdate: "registry"
+          traefik.enable: "true"
+          traefik.http.middlewares.traefik-auth.basicauth.users: "{{ vault_traefik_basic_auth }}"
+          traefik.http.routers.traefik.entrypoints: "https"
+          traefik.http.routers.traefik.rule: "PathPrefix(`/traefik`)"
+          traefik.http.routers.traefik.middlewares: "traefik-auth@docker"
+          traefik.http.routers.traefik.tls: "true"
+          traefik.http.routers.traefik.tls.certresolver: "wildcard"
+          traefik.http.routers.traefik.tls.domains[0].main: "{{ inventory_hostname }}"
+          traefik.http.routers.traefik.service: "api@internal"
+        generate_systemd:
+          path: /home/containers/.config/systemd/user/
+          restart_policy: on-failure
+          names: true
+          new: true
+
+    - name: Start containers at boot
+      become_user: containers
+      become: true
+      ansible.builtin.systemd:
+        scope: user
+        name: container-{{ item }}.service
+        enabled: true
+        state: started
+        daemon_reload: true
+      loop:
+        - traefik