[fix] role:authelia-for-gitea

roles/authelia-for-gitea/defaults/main.json

@@ -0,0 +1,5 @@
+{
+	"var_authelia_for_gitea_gitea_url_base": "https://gitea.example.org",
+	"var_authelia_for_gitea_client_id": "gitea",
+	"var_authelia_for_gitea_client_secret": "REPLACE_ME"
+}

roles/authelia-for-gitea/info.md

@@ -0,0 +1,9 @@
+## Beschreibung
+
+Um [Gitea](../gitea) gegen [Authelia](../authelia) authentifizieren zu lassen
+
+
+## Verweise
+
+- [Gitea-Dokumentation | Configuration | OpenID](https://docs.gitea.com/administration/config-cheat-sheet#openid-openid)
+- [Authelia-Dokumentation | Gitea Integration](https://www.authelia.com/integration/openid-connect/gitea/)

roles/authelia-for-gitea/tasks/main.json

@@ -0,0 +1,25 @@
+[
+	{
+		"name": "configuration | emplace",
+		"become": true,
+		"ansible.builtin.template": {
+			"src": "authelia-client-conf.json.j2",
+			"dest": "/etc/authelia/conf.d/clients/gitea.json"
+		}
+	},
+	{
+		"name": "configuration | apply",
+		"become": true,
+		"ansible.builtin.command": {
+			"cmd": "/usr/bin/authelia-conf-compose"
+		}
+	},
+	{
+		"name": "restart service",
+		"become": true,
+		"ansible.builtin.systemd_service": {
+			"state": "restarted",
+			"name": "authelia"
+		}
+	}
+]

roles/authelia-for-gitea/templates/authelia-client-conf.json.j2

@@ -0,0 +1,17 @@
+{
+	"client_id": "{{var_authelia_for_gitea_client_id}}",
+	"client_secret": "{{var_authelia_for_gitea_client_secret}}",
+	"client_name": "Gitea",
+	"public": false,
+	"authorization_policy": "one_factor",
+	"redirect_uris": [
+		"{{var_authelia_for_gitea_gitea_url_base}}/user/oauth2/authelia/callback"
+	],
+	"scopes": [
+		"openid",
+		"email",
+		"profile"
+	],
+	"userinfo_signed_response_alg": "none",
+	"token_endpoint_auth_method": "client_secret_basic"
+}

roles/gitea-and-nginx/defaults/main.json

@@ -0,0 +1,5 @@
+{
+	"var_gitea_and_nginx_domain": "gitea.example.org",
+	"var_gitea_and_nginx_port": 2378,
+	"var_gitea_and_nginx_tls_mode": "enable"
+}

roles/gitea-and-nginx/info.md

@@ -0,0 +1,3 @@
+## Verweise
+
+- [Gitea-Dokumentation](https://docs.gitea.com/next/administration/reverse-proxies#nginx)

roles/gitea-and-nginx/tasks/main.json

@@ -0,0 +1,35 @@
+[
+	{
+		"name": "deactivate default site",
+		"become": true,
+		"ansible.builtin.file": {
+			"state": "absent",
+			"dest": "/etc/nginx/sites-enabled/default"
+		}
+	},
+	{
+		"name": "emplace configuration | data",
+		"become": true,
+		"ansible.builtin.template": {
+			"src": "conf.j2",
+			"dest": "/etc/nginx/sites-available/{{var_gitea_and_nginx_domain}}"
+		}
+	},
+	{
+		"name": "emplace configuration | link",
+		"become": true,
+		"ansible.builtin.file": {
+			"state": "link",
+			"src": "/etc/nginx/sites-available/{{var_gitea_and_nginx_domain}}",
+			"dest": "/etc/nginx/sites-enabled/{{var_gitea_and_nginx_domain}}"
+		}
+	},
+	{
+		"name": "restart nginx",
+		"become": true,
+		"ansible.builtin.systemd_service": {
+			"state": "restarted",
+			"name": "nginx"
+		}
+	}
+]

roles/gitea-and-nginx/templates/conf.j2

@@ -0,0 +1,34 @@
+{% macro gitea_common() %}
+	location / {
+		proxy_pass http://localhost:{{var_gitea_and_nginx_port | string}};
+		client_max_body_size 20M;
+	}
+{% endmacro %}
+
+server {
+	listen 80;
+	listen [::]:80;
+	
+	server_name {{var_gitea_and_nginx_domain}};
+	
+{% if var_gitea_and_nginx_tls_mode == 'force' %}
+	return 301 https://$http_host$request_uri;
+{% else %}
+{{ gitea_common() }}
+{% endif %}
+}
+
+{% if var_gitea_and_nginx_tls_mode != 'disable' %}
+server {
+	listen 443 ssl;
+	listen [::]:443 ssl;
+	
+	server_name {{var_gitea_and_nginx_domain}};
+	
+	ssl_certificate_key /etc/ssl/private/{{var_gitea_and_nginx_domain}}.pem;
+	ssl_certificate /etc/ssl/fullchains/{{var_gitea_and_nginx_domain}}.pem;
+	include /etc/nginx/ssl-hardening.conf;
+	
+{{ gitea_common() }}
+}
+{% endif %}

roles/gitea-and-nginx/vardef.json

@@ -0,0 +1,19 @@
+{
+	"domain": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"port": {
+		"mandatory": false,
+		"type": "integer"
+	},
+	"tls_mode": {
+		"mandatory": false,
+		"type": "string",
+		"options": [
+			"disable",
+			"enable",
+			"force"
+		]
+	}
+}

roles/gitea/defaults/main.json

@@ -0,0 +1,29 @@
+{
+	"var_gitea_user": "gitea",
+	"var_gitea_directory": "/opt/gitea",
+	"var_gitea_version": "1.22.1",
+	"var_gitea_platform": "linux-amd64",
+	"var_gitea_secret_key": "REPLACE_ME",
+	"var_gitea_internal_token": "REPLACE_ME",
+	"var_gitea_domain": "gitea.example.org",
+	"var_gitea_listen_address": "0.0.0.0",
+	"var_gitea_listen_port": 2378,
+	"var_gitea_database_kind": "sqlite",
+	"var_gitea_database_data_sqlite_path": "/var/gitea/data.sqlite",
+	"var_gitea_database_data_postgresql_host": "postgresql.example.org",
+	"var_gitea_database_data_postgresql_port": 5432,
+	"var_gitea_database_data_postgresql_username": "gitea_user",
+	"var_gitea_database_data_postgresql_password": "REPLACE_ME",
+	"var_gitea_database_data_postgresql_scheme": "gitea",
+	"var_gitea_authentication_kind": "internal",
+	"var_gitea_authentication_data_authelia_url_base": "https://authelia.example.org",
+	"var_gitea_authentication_data_authelia_client_id": "gitea",
+	"var_gitea_authentication_data_authelia_client_secret": "REPLACE_ME",
+	"var_gitea_smtp_host": "smtp.example.org",
+	"var_gitea_smtp_port": 465,
+	"var_gitea_smtp_username": "REPLACE_ME",
+	"var_gitea_smtp_password": "REPLACE_ME",
+	"var_gitea_email_sending_enabled": false,
+	"var_gitea_email_sending_sender": "gitea@example.org",
+	"var_gitea_email_sending_html": false
+}

roles/gitea/info.md

@@ -0,0 +1,10 @@
+## Beschreibung
+
+Zur Einrichtung der DevOps-Platform [Gitea](https://about.gitea.com/)
+
+
+## Verweise
+
+- [Gitea Homepage | self hosting](https://about.gitea.com/products/gitea/)
+- [Gitea Documentation | Installation from binary](https://docs.gitea.com/installation/install-from-binary)
+- [Gitea Documentation | Config Cheat Sheet](https://docs.gitea.com/administration/config-cheat-sheet)

roles/gitea/tasks/main.json

@@ -0,0 +1,99 @@
+[
+	{
+		"name": "packages",
+		"become": true,
+		"ansible.builtin.apt": {
+			"update_cache": true,
+			"pkg": [
+				"git"
+			]
+		}
+	},
+	{
+		"name": "user",
+		"become": true,
+		"ansible.builtin.user": {
+			"name": "{{var_gitea_user}}",
+			"create_home": true,
+			"home": "{{var_gitea_directory}}"
+		}
+	},
+	{
+		"name": "directories | database",
+		"become": true,
+		"loop": [
+			"{{var_gitea_database_data_sqlite_path | dirname}}"
+		],
+		"ansible.builtin.file": {
+			"path": "{{item}}",
+			"state": "directory"
+		}
+	},
+	{
+		"name": "directories | internal",
+		"become": true,
+		"become_user": "{{var_gitea_user}}",
+		"loop": [
+			"{{var_gitea_directory}}/custom/conf"
+		],
+		"ansible.builtin.file": {
+			"path": "{{item}}",
+			"state": "directory"
+		}
+	},
+	{
+		"name": "download",
+		"become": true,
+		"become_user": "{{var_gitea_user}}",
+		"ansible.builtin.get_url": {
+			"url": "https://dl.gitea.com/gitea/{{var_gitea_version}}/gitea-{{var_gitea_version}}-{{var_gitea_platform}}",
+			"dest": "{{var_gitea_directory}}/gitea",
+			"mode": "u+rx"
+		}
+	},
+	{
+		"name": "config | base",
+		"become": true,
+		"become_user": "{{var_gitea_user}}",
+		"ansible.builtin.template": {
+			"src": "config.ini.j2",
+			"dest": "{{var_gitea_directory}}/custom/conf/app.ini"
+		}
+	},
+	{
+		"name": "config | database",
+		"become": true,
+		"become_user": "{{var_gitea_user}}",
+		"ansible.builtin.command": {
+			"chdir": "{{var_gitea_directory}}",
+			"cmd": "./gitea migrate"
+		}
+	},
+	{
+		"name": "config | authelia",
+		"when": "var_gitea_authentication_kind == 'authelia'",
+		"become": true,
+		"become_user": "{{var_gitea_user}}",
+		"ansible.builtin.command": {
+			"chdir": "{{var_gitea_directory}}",
+			"cmd": "./gitea admin auth add-oauth --provider='openidConnect' --name='authelia' --key={{var_gitea_authentication_data_authelia_client_id}} --secret={{var_gitea_authentication_data_authelia_client_secret}} --auto-discover-url='{{var_gitea_authentication_data_authelia_url_base}}/.well-known/openid-configuration' --scopes='openid email profile'"
+		}
+	},
+	{
+		"name": "systemd unit",
+		"become": true,
+		"ansible.builtin.template": {
+			"src": "systemd-unit.j2",
+			"dest": "/etc/systemd/system/gitea.service"
+		}
+	},
+	{
+		"name": "start",
+		"become": true,
+		"ansible.builtin.systemd_service": {
+			"enabled": true,
+			"state": "restarted",
+			"name": "gitea"
+		}
+	}
+]

roles/gitea/templates/config.ini.j2

@@ -0,0 +1,120 @@
+APP_NAME = Gitea: Git with a cup of tea
+RUN_USER = {{var_gitea_user}}
+RUN_MODE = prod
+
+[server]
+DOMAIN = {{var_gitea_domain}}
+ROOT_URL = https://{{var_gitea_domain}}
+;HTTP_ADDR = {{var_gitea_listen_address}}
+HTTP_PORT = {{var_gitea_listen_port | string}}
+;LANDING_PAGE = home
+
+[database]
+{% if var_gitea_database_kind == 'sqlite' %}
+DB_TYPE = sqlite3
+PATH = {{var_gitea_database_data_sqlite_path}}
+{% endif %}
+{% if var_gitea_database_kind == 'postgresql' %}
+DB_TYPE = postgres
+HOST = {{var_gitea_database_data_postgresql_host}}:{{var_gitea_database_data_postgresql_port | string}}
+USER = {{var_gitea_database_data_postgresql_username}}
+PASSWD = {{var_gitea_database_data_postgresql_password}}
+NAME = {{var_gitea_database_data_postgresql_scheme}}
+{% endif %}
+
+[security]
+INSTALL_LOCK = true
+SECRET_KEY = {{var_gitea_secret_key}}
+INTERNAL_TOKEN = {{var_gitea_internal_token}}
+DISABLE_GIT_HOOKS = true
+
+[oauth2]
+ENABLED = false
+
+[log]
+MODE = console
+LEVEL = Info
+
+[git]
+HOME_PATH = {{var_gitea_directory}}
+
+[service]
+REGISTER_EMAIL_CONFIRM = false
+
+{% if var_gitea_authentication_kind == 'internal' %}
+DISABLE_REGISTRATION = false
+ALLOW_ONLY_INTERNAL_REGISTRATION = true
+ALLOW_ONLY_EXTERNAL_REGISTRATION = false
+SHOW_REGISTRATION_BUTTON = true
+{% else %}
+DISABLE_REGISTRATION = false
+ALLOW_ONLY_INTERNAL_REGISTRATION = false
+ALLOW_ONLY_EXTERNAL_REGISTRATION = true
+SHOW_REGISTRATION_BUTTON = false
+{% endif %}
+
+;REQUIRE_SIGNIN_VIEW = false
+ENABLE_NOTIFY_MAIL = true
+
+;ENABLE_BASIC_AUTHENTICATION = true
+;ENABLE_REVERSE_PROXY_AUTHENTICATION = false
+;ENABLE_REVERSE_PROXY_AUTHENTICATION_API = false
+;ENABLE_REVERSE_PROXY_AUTO_REGISTRATION = false
+;ENABLE_REVERSE_PROXY_EMAIL = false
+;ENABLE_REVERSE_PROXY_FULL_NAME = false
+
+;DEFAULT_KEEP_EMAIL_PRIVATE = false
+;DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+;DEFAULT_USER_IS_RESTRICTED = false
+;DEFAULT_USER_VISIBILITY = public
+;ALLOWED_USER_VISIBILITY_MODES = public,limited,private
+;DEFAULT_ORG_VISIBILITY = public
+;DEFAULT_ORG_MEMBER_VISIBLE = false
+;DEFAULT_ENABLE_DEPENDENCIES = true
+;ALLOW_CROSS_REPOSITORY_DEPENDENCIES = true
+ENABLE_USER_HEATMAP = false
+ENABLE_TIMETRACKING = false
+DEFAULT_ENABLE_TIMETRACKING = false
+
+{% if var_gitea_authentication_kind == 'internal' %}
+SHOW_REGISTRATION_BUTTON = true
+{% else %}
+SHOW_REGISTRATION_BUTTON = false
+{% endif %}
+
+AUTO_WATCH_NEW_REPOS = false
+AUTO_WATCH_ON_CHANGES = false
+
+{% if var_gitea_authentication_kind == 'internal' %}
+[openid]
+ENABLE_OPENID_SIGNIN = false
+ENABLE_OPENID_SIGNUP = false
+{% else %}
+[openid]
+ENABLE_OPENID_SIGNIN = false
+ENABLE_OPENID_SIGNUP = true
+WHITELISTED_URIS = {{var_gitea_authentication_data_authelia_url_base}}
+
+[oauth2_client]
+REGISTER_EMAIL_CONFIRM = false
+OPENID_CONNECT_SCOPES = openid email profile
+ENABLE_AUTO_REGISTRATION = true
+USERNAME = nickname
+{% endif %}
+
+[mailer]
+{% if var_gitea_email_sending_enabled %}
+ENABLED = true
+SMTP_ADDR = {{var_gitea_smtp_host}}
+SMTP_PORT = {{var_gitea_smtp_port | string}}
+FROM = {{var_gitea_email_sending_sender}}
+USER = {{var_gitea_smtp_username}}
+PASSWD = {{var_gitea_smtp_password}}
+{% if var_gitea_email_sending_html %}
+SEND_AS_PLAIN_TEXT = false
+{% else %}
+SEND_AS_PLAIN_TEXT = true
+{% endif %}
+{% else %}
+ENABLED = false
+{% endif %}

roles/gitea/templates/systemd-unit.j2

@@ -0,0 +1,21 @@
+[Unit]
+Description=Gitea (Git with a cup of tea)
+After=network.target
+{% if var_gitea_database_kind == 'postgresql' %}
+Wants=postgresql.service
+After=postgresql.service
+{% endif %}
+
+[Service]
+RestartSec=2s
+Type=simple
+User={{var_gitea_user}}
+Group={{var_gitea_user}}
+WorkingDirectory={{var_gitea_directory}}
+ExecStart={{var_gitea_directory}}/gitea web --config {{var_gitea_directory}}/custom/conf/app.ini
+Restart=always
+# Environment=USER=git HOME=/home/git GITEA_WORK_DIR=/var/lib/gitea
+# Environment=PATH=/path/to/git/bin:/bin:/sbin:/usr/bin:/usr/sbin
+
+[Install]
+WantedBy=multi-user.target

roles/gitea/vardef.json

@@ -0,0 +1,118 @@
+{
+	"user": {
+		"type": "string",
+		"mandatory": false
+	},
+	"directory": {
+		"type": "string",
+		"mandatory": false
+	},
+	"version": {
+		"type": "string",
+		"mandatory": false
+	},
+	"platform": {
+		"type": "string",
+		"mandatory": false
+	},
+	"secret_key": {
+		"type": "string",
+		"mandatory": true
+	},
+	"internal_token": {
+		"type": "string",
+		"mandatory": true
+	},
+	"domain": {
+		"type": "string",
+		"mandatory": false
+	},
+	"listen_address": {
+		"type": "string",
+		"mandatory": false
+	},
+	"listen_port": {
+		"type": "integer",
+		"mandatory": false
+	},
+	"database_kind": {
+		"mandatory": false,
+		"type": "string",
+		"options": [
+			"sqlite",
+			"postgresql"
+		]
+	},
+	"database_data_sqlite_path": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"database_data_postgresql_host": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"database_data_postgresql_port": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"database_data_postgresql_username": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"database_data_postgresql_password": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"database_data_postgresql_schema": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"authentication_kind": {
+		"mandatory": false,
+		"type": "string",
+		"options": [
+			"internal",
+			"authelia"
+		]
+	},
+	"authentication_data_authelia_url_base": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"authentication_data_authelia_client_id": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"authentication_data_authelia_client_secret": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"smtp_host": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"smtp_port": {
+		"mandatory": false,
+		"type": "integer"
+	},
+	"smtp_username": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"smtp_password": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"email_sending_enabled": {
+		"mandatory": false,
+		"type": "boolean"
+	},
+	"email_sending_sender": {
+		"mandatory": false,
+		"type": "string"
+	},
+	"email_sending_html": {
+		"mandatory": false,
+		"type": "boolean"
+	}
+}

roles/postgresql-for-gitea/defaults/main.json

@@ -0,0 +1,5 @@
+{
+	"var_postgresql_for_gitea_username": "gitea_user",
+	"var_postgresql_for_gitea_password": "REPLACE_ME",
+	"var_postgresql_for_gitea_schema": "gitea"
+}

roles/postgresql-for-gitea/tasks/main.json

@@ -0,0 +1,49 @@
+[
+	{
+		"name": "packages",
+		"become": true,
+		"ansible.builtin.apt": {
+			"update_cache": true,
+			"pkg": [
+				"acl",
+				"python3-psycopg2"
+			]
+		}
+	},
+	{
+		"name": "user",
+		"become": true,
+		"become_user": "postgres",
+		"community.postgresql.postgresql_user": {
+			"state": "present",
+			"name": "{{var_postgresql_for_gitea_username}}",
+			"password": "{{var_postgresql_for_gitea_password}}"
+		},
+		"environment": {
+			"PGOPTIONS": "-c password_encryption=scram-sha-256"
+		}
+	},
+	{
+		"name": "schema",
+		"become": true,
+		"become_user": "postgres",
+		"community.postgresql.postgresql_db": {
+			"state": "present",
+			"name": "{{var_postgresql_for_gitea_schema}}",
+			"owner": "{{var_postgresql_for_gitea_username}}"
+		}
+	},
+	{
+		"name": "rights",
+		"become": true,
+		"become_user": "postgres",
+		"community.postgresql.postgresql_privs": {
+			"state": "present",
+			"db": "{{var_postgresql_for_gitea_schema}}",
+			"objs": "ALL_IN_SCHEMA",
+			"roles": "{{var_postgresql_for_gitea_username}}",
+			"privs": "ALL",
+			"grant_option": true
+		}
+	}
+]