commit 655f6de7ccb3e43433ddd74748eec7465c561369 Author: Michael Krause Date: Sun Feb 8 01:31:24 2026 -0600 Initial commit: Phase 0.5 Gitea deployment configs diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..ba3ff1f --- /dev/null +++ b/.gitignore @@ -0,0 +1,6 @@ +# Sensitive configuration files +management/app.ini + +# Backup files +*.backup +*.bak diff --git a/management/app.ini.template b/management/app.ini.template new file mode 100644 index 0000000..5ca0acb --- /dev/null +++ b/management/app.ini.template @@ -0,0 +1,79 @@ +APP_NAME = Firefrost Gaming - Git Repository +RUN_MODE = prod +RUN_USER = gitea +WORK_PATH = /var/lib/gitea + +[repository] +ROOT = /var/lib/gitea/repositories + +[server] +DOMAIN = git.firefrostgaming.com +HTTP_ADDR = 127.0.0.1 +HTTP_PORT = 3000 +ROOT_URL = https://git.firefrostgaming.com/ +DISABLE_SSH = false +SSH_DOMAIN = git.firefrostgaming.com +SSH_PORT = 2222 +LFS_START_SERVER = true +LFS_JWT_SECRET = REPLACE_WITH_GENERATED_LFS_JWT_SECRET +APP_DATA_PATH = /var/lib/gitea/data +OFFLINE_MODE = true + +[database] +DB_TYPE = sqlite3 +PATH = /var/lib/gitea/data/gitea.db +LOG_SQL = false +HOST = +NAME = +USER = +PASSWD = +SCHEMA = +SSL_MODE = disable + +[security] +INSTALL_LOCK = true +SECRET_KEY = REPLACE_WITH_GENERATED_SECRET_KEY +INTERNAL_TOKEN = REPLACE_WITH_GENERATED_INTERNAL_TOKEN +PASSWORD_HASH_ALGO = pbkdf2 + +[lfs] +PATH = /var/lib/gitea/data/lfs + +[mailer] +ENABLED = false + +[service] +REGISTER_EMAIL_CONFIRM = false +ENABLE_NOTIFY_MAIL = false +DISABLE_REGISTRATION = true +ALLOW_ONLY_EXTERNAL_REGISTRATION = false +ENABLE_CAPTCHA = false +REQUIRE_SIGNIN_VIEW = true +DEFAULT_KEEP_EMAIL_PRIVATE = false +DEFAULT_ALLOW_CREATE_ORGANIZATION = true +DEFAULT_ENABLE_TIMETRACKING = true +NO_REPLY_ADDRESS = noreply.git.firefrostgaming.com + +[openid] +ENABLE_OPENID_SIGNIN = true +ENABLE_OPENID_SIGNUP = false + +[cron.update_checker] +ENABLED = false + +[session] +PROVIDER = file + +[log] +MODE = console +LEVEL = info +ROOT_PATH = /var/lib/gitea/log + +[repository.pull-request] +DEFAULT_MERGE_STYLE = merge + +[repository.signing] +DEFAULT_TRUST_MODEL = committer + +[oauth2] +JWT_SECRET = REPLACE_WITH_GENERATED_JWT_SECRET diff --git a/management/gitea.service b/management/gitea.service new file mode 100644 index 0000000..a404892 --- /dev/null +++ b/management/gitea.service @@ -0,0 +1,16 @@ +[Unit] +Description=Gitea (Git with a cup of tea) +After=network.target +Wants=network.target + +[Service] +Type=simple +User=gitea +Group=gitea +WorkingDirectory=/var/lib/gitea +ExecStart=/usr/local/bin/gitea web -c /etc/gitea/app.ini +Restart=always +Environment=USER=gitea HOME=/var/lib/gitea GITEA_WORK_DIR=/var/lib/gitea + +[Install] +WantedBy=multi-user.target diff --git a/nodes/50-cloud-init.yaml b/nodes/50-cloud-init.yaml new file mode 100644 index 0000000..1cd21d7 --- /dev/null +++ b/nodes/50-cloud-init.yaml @@ -0,0 +1,29 @@ +network: + version: 2 + ethernets: + ens3: + match: + macaddress: "00:09:bf:19:f9:04" + addresses: + - "63.143.34.217/27" + - "74.63.218.202/29" + - "74.63.218.203/29" + - "74.63.218.204/29" + - "74.63.218.205/29" + - "74.63.218.206/29" + - "2607:ff68:9:23::7/128" + nameservers: + addresses: + - 1.1.1.1 + - 8.8.8.8 + - 2606:4700:4700::1111 + - 2001:4860:4860::8888 + gateway4: 63.143.34.193 + gateway6: 2607:ff68:9:23::1 + routes: + - scope: "link" + to: "63.143.34.193" + via: "0.0.0.0" + - scope: "link" + to: "2607:ff68:9:23::1" + via: "::0" diff --git a/web/default b/web/default new file mode 100644 index 0000000..c5af914 --- /dev/null +++ b/web/default @@ -0,0 +1,91 @@ +## +# You should look at the following URL's in order to grasp a solid understanding +# of Nginx configuration files in order to fully unleash the power of Nginx. +# https://www.nginx.com/resources/wiki/start/ +# https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/ +# https://wiki.debian.org/Nginx/DirectoryStructure +# +# In most cases, administrators will remove this file from sites-enabled/ and +# leave it as reference inside of sites-available where it will continue to be +# updated by the nginx packaging team. +# +# This file will automatically load configuration files provided by other +# applications, such as Drupal or Wordpress. These applications will be made +# available underneath a path with that package name, such as /drupal8. +# +# Please see /usr/share/doc/nginx-doc/examples/ for more detailed examples. +## + +# Default server configuration +# +server { + listen 80 default_server; + listen [::]:80 default_server; + + # SSL configuration + # + # listen 443 ssl default_server; + # listen [::]:443 ssl default_server; + # + # Note: You should disable gzip for SSL traffic. + # See: https://bugs.debian.org/773332 + # + # Read up on ssl_ciphers to ensure a secure configuration. + # See: https://bugs.debian.org/765782 + # + # Self signed certs generated by the ssl-cert package + # Don't use them in a production server! + # + # include snippets/snakeoil.conf; + + root /var/www/html; + + # Add index.php to the list if you are using PHP + index index.html index.htm index.nginx-debian.html; + + server_name _; + + location / { + # First attempt to serve request as file, then + # as directory, then fall back to displaying a 404. + try_files $uri $uri/ =404; + } + + # pass PHP scripts to FastCGI server + # + #location ~ \.php$ { + # include snippets/fastcgi-php.conf; + # + # # With php-fpm (or other unix sockets): + # fastcgi_pass unix:/run/php/php7.4-fpm.sock; + # # With php-cgi (or other tcp sockets): + # fastcgi_pass 127.0.0.1:9000; + #} + + # deny access to .htaccess files, if Apache's document root + # concurs with nginx's one + # + #location ~ /\.ht { + # deny all; + #} +} + + +# Virtual Host configuration for example.com +# +# You can move that to a different file under sites-available/ and symlink that +# to sites-enabled/ to enable it. +# +#server { +# listen 80; +# listen [::]:80; +# +# server_name example.com; +# +# root /var/www/example.com; +# index index.html; +# +# location / { +# try_files $uri $uri/ =404; +# } +#} diff --git a/web/git.firefrostgaming.com b/web/git.firefrostgaming.com new file mode 100644 index 0000000..15aab93 --- /dev/null +++ b/web/git.firefrostgaming.com @@ -0,0 +1,33 @@ +server { + if ($host = git.firefrostgaming.com) { + return 301 https://$host$request_uri; + } # managed by Certbot + + + listen 74.63.218.202:80; + server_name git.firefrostgaming.com; + return 301 https://$host$request_uri; + + +} + +server { + listen 74.63.218.202:443 ssl http2; + server_name git.firefrostgaming.com; + + client_max_body_size 512M; + + # Temporary self-signed cert (will be replaced by Let's Encrypt) + ssl_certificate /etc/letsencrypt/live/git.firefrostgaming.com/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/git.firefrostgaming.com/privkey.pem; # managed by Certbot + + + location / { + proxy_pass http://127.0.0.1:3000; + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + } + +}