diff options
Diffstat (limited to 'custom/conf/app.example.ini')
| -rw-r--r-- | custom/conf/app.example.ini | 24 |
1 files changed, 23 insertions, 1 deletions
diff --git a/custom/conf/app.example.ini b/custom/conf/app.example.ini index bc678c1934..dc273ced80 100644 --- a/custom/conf/app.example.ini +++ b/custom/conf/app.example.ini @@ -297,6 +297,9 @@ SSH_ROOT_PATH = ; Gitea will create a authorized_keys file by default when it is not using the internal ssh server ; If you intend to use the AuthorizedKeysCommand functionality then you should turn this off. SSH_CREATE_AUTHORIZED_KEYS_FILE = true +; Gitea will create a authorized_principals file by default when it is not using the internal ssh server +; If you intend to use the AuthorizedPrincipalsCommand functionality then you should turn this off. +SSH_CREATE_AUTHORIZED_PRINCIPALS_FILE = true ; For the built-in SSH server, choose the ciphers to support for SSH connections, ; for system SSH this setting has no effect SSH_SERVER_CIPHERS = aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, arcfour256, arcfour128 @@ -312,7 +315,26 @@ SSH_KEY_TEST_PATH = ; Path to ssh-keygen, default is 'ssh-keygen' which means the shell is responsible for finding out which one to call. SSH_KEYGEN_PATH = ssh-keygen ; Enable SSH Authorized Key Backup when rewriting all keys, default is true -SSH_BACKUP_AUTHORIZED_KEYS = true +SSH_AUTHORIZED_KEYS_BACKUP = true +; Determines which principals to allow +; - empty: if SSH_TRUSTED_USER_CA_KEYS is empty this will default to off, otherwise will default to email, username. +; - off: Do not allow authorized principals +; - email: the principal must match the user's email +; - username: the principal must match the user's username +; - anything: there will be no checking on the content of the principal +SSH_AUTHORIZED_PRINCIPALS_ALLOW = email, username +; Enable SSH Authorized Principals Backup when rewriting all keys, default is true +SSH_AUTHORIZED_PRINCIPALS_BACKUP = true +; Specifies the public keys of certificate authorities that are trusted to sign user certificates for authentication. +; Multiple keys should be comma separated. +; E.g."ssh-<algorithm> <key>". or "ssh-<algorithm> <key1>, ssh-<algorithm> <key2>". +; For more information see "TrustedUserCAKeys" in the sshd config manpages. +SSH_TRUSTED_USER_CA_KEYS = +; Absolute path of the `TrustedUserCaKeys` file gitea will manage. +; Default this `RUN_USER`/.ssh/gitea-trusted-user-ca-keys.pem +; If you're running your own ssh server and you want to use the gitea managed file you'll also need to modify your +; sshd_config to point to this file. The official docker image will automatically work without further configuration. +SSH_TRUSTED_USER_CA_KEYS_FILENAME = ; Enable exposure of SSH clone URL to anonymous visitors, default is false SSH_EXPOSE_ANONYMOUS = false ; Indicate whether to check minimum key size with corresponding type |