aboutsummaryrefslogtreecommitdiffstats
path: root/docker
Commit message (Collapse)AuthorAgeFilesLines
* Expanded minimum RSA Keylength to 3072 (#26604)mainboarder2023-08-281-1/+1
| | | | | | | | | | | | | | | German Federal Office for Information Security requests in its technical guideline BSI TR-02102-1 RSA Keylength not shorter than 3000bits starting 2024, in the year 2023 3000bits as a recommendation. Gitea should request longer RSA Keys by default in favor of security and drop old clients which do not support longer keys. https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Publikationen/TechnischeRichtlinien/TR02102/BSI-TR-02102.pdf?__blob=publicationFile&v=9 - Page 19, Table 1.2 --------- Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Use docs.gitea.com instead of docs.gitea.io (#26739)Lunny Xiao2023-08-271-1/+1
|
* Do not use deprecated log config options by default (#26592)wxiaoguang2023-08-201-1/+0
| | | | | | Simplify the log config * Remove unnecessary `ROUTER` config, it defaults to the `MODE`. * `XORM` config was deprecated
* Fix WORK_DIR for docker (root) image (#25738)wxiaoguang2023-07-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix #25726 #17846 chose an incorrect WORK_DIR path for docker root image. Gitea's work-path was already used as the base path for various paths (like AppDataPath), so, the work-path should be mounted to a volume in a docker image. Now, for docker root image, it's unavoidable to mix the WorkPath/CustomPath/AppDataPath in the same directory ("/data/gitea"), because some of them have already been mixed. Some directories in the screenshot are for "CustomPath" , while others are for "AppDataPath", due to the technical debts in old code: ``` CUSTOM_PATH="/data/gitea" APP_DATA_PATH = /data/gitea ``` <details> ![image](https://github.com/go-gitea/gitea/assets/2114189/9f0648ac-f731-4a08-9f26-1af01a1824b1) </details> This PR is breaking but this is the only way at the moment to avoid users losing their data accidently Co-authored-by: Giteabot <teabot@gitea.io>
* Correct permissions for `.ssh` and `authorized_keys` (#25721)Jason Song2023-07-061-1/+9
| | | | | | | | | | | | Set the correct permissions on the .ssh directory and authorized_keys file, or sshd will refuse to use them and lead to clone/push/pull failures. It could happen when users have copied their data to a new volume and changed the file permission by accident, and it would be very hard to troubleshoot unless users know how to check the logs of sshd which is started by s6. Co-authored-by: Giteabot <teabot@gitea.io>
* Do not publish docker release images on `-dev` tags (#25471)delvh2023-06-232-0/+4
| | | | | | | | | | | Try to prevent what happened with tag `v1.21.0-dev` as outlined in #25193. Unfortunately, we cannot really test if it works as intended as we would need to release a new `dev` tag for that. Fixes #25193 (or at least attempts to). --------- Co-authored-by: jolheiser <john.olheiser@gmail.com>
* Unify nightly naming across binaries and docker images (#24116)techknowlogick2023-04-242-6/+6
| | | | | | | | Proposal found here: https://github.com/go-gitea/gitea/issues/23654 TODO: make non-breaking (can we publish docker image using dev and nightly prefix? at same time). if anyone has advice please comment :) If this PR is merged, then I can add redirects to the downloads site.
* Wrap unless-check in docker manifests (#23079)John Olheiser2023-02-222-2/+2
| | | | | | | Should fix the following: > failed to render template: Evaluation error: Helper 'unless' called with wrong number of arguments, needed 2 but got 3 Signed-off-by: jolheiser <john.olheiser@gmail.com>
* Adjust manifest to prevent tagging latest on rcs (#22811)zeripath2023-02-192-0/+4
|
* Rootless Docker - Mistake with the repo-avatars parent folder name (#22637)Melroy van den Berg2023-01-311-1/+1
| | | | | | | | | | | | There was a mistake when choosing the structure for the repo avatars parent folder and it added a spurious /gitea. The `data` directory should contain folders like: - `attachments/` - `avatars/` - `log/` - `repo-avatars/`
* Remove deprecated DSA host key from Docker Container (#21522)Xinyu Zhou2022-11-032-12/+0
| | | | | | | | | | | | | | | Since OpenSSH 7.0 and greater similarly disable the ssh-dss (DSA) public key algorithm, and recommend against its use. http://www.openssh.com/legacy.html ## :warning: BREAKING :warning: This patch will remove DSA host key form OpenSSH daemon configuration file. Signed-off-by: baronbunny <its@baronbunny.cn> Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
* Fix the mode of custom dir to 0700 in docker-rootless (#20861)wxiaoguang2022-08-191-1/+1
|
* feat: Add support for extra sshd_config parameters via 'Include' file (#19842)Thomas Andrade2022-05-312-0/+3
| | | Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Update document to use FHS `/usr/local/bin/gitea` instead of `/app/...` for ↵wxiaoguang2022-05-241-2/+0
| | | | | | | Docker (#19794) * Update document to use FHS `/usr/local/bin/gitea` instead of `/app/...` in Docker * Update docs/content/doc/installation/with-docker.zh-cn.md
* Configure OpenSSH log level via Environment in Docker (#19274)Gusted2022-03-312-1/+2
| | | Introduce a new environment variable: SSH_LOG_LEVEL
* Fix issue with docker-rootless shimming script (#18690)zeripath2022-02-101-4/+2
|
* Fix pushing to 1-x-dev docker tag (#18578)zeripath2022-02-032-6/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | * Fix pushing to 1-x-dev docker tag It appears that #18551 and #18573 have a mistake in that raymond does not have an {{else}} on {{#equal}}. This PR notes that Sprig has a hasPrefix function and so we use this with another if. Signed-off-by: Andrew Thornton <art27@cantab.net> * Fix pushing to 1-x-dev docker tag (part 2) Although we now have the manifest working, we need to create the images. Here we adjust the .drone.yml to force building of the images Signed-off-by: Andrew Thornton <art27@cantab.net> * Fix pushing to 1-x-dev docker tag OK now we have the images building we should make sure that the main ones stays dev and the release/v* ones become *-dev-* Signed-off-by: Andrew Thornton <art27@cantab.net> * Apply suggestions from code review
* Fix manifest.tmpl (#18573)zeripath2022-02-031-1/+1
| | | | | | A spurious {{/if}} appeared on the manifest.tmpl - this PR simply removes this. Signed-off-by: Andrew Thornton <art27@cantab.net>
* Make docker gitea/gitea:v1.16-dev etc refer to the latest build on that ↵zeripath2022-02-032-7/+7
| | | | | | | | | | | | | | | | branch (#18551) * Make docker gitea/gitea:v1.16-dev etc refer to the latest build on that branch One of the problems with our current docker tagging is that although we have strict version tags, latest and dev we do not have a way for docker users to track the current release branch. This PR simply suggests that we use the 1.x-dev tag for these and we build and push these. This will give users who want or need unreleased bug fixes the option of tracking the pre-release version instead of simply jumping to dev. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: KN4CK3R <admin@oldschoolhack.me> Co-authored-by: Lunny Xiao <xiaolunwen@gmail.com>
* In docker rootless use $GITEA_APP_INI if provided (#18524)Michael Kriese2022-02-011-1/+1
|
* Switch to non-deprecation setting (#18358)Gusted2022-01-232-2/+6
| | | | | | * Switch to non-deprecation setting (Avoid by-default: "Deprecated fallback `[server]` `LFS_CONTENT_PATH` present. Use `[lfs]` `PATH` instead. This fallback will be removed in v1.18.0") * Update all references
* Upgrade Alpine from 3.13 to 3.15 (#18050)v1.17.0-devGrzegorz Alibożek2022-01-192-0/+12
| | | | | | | | | | | * Upgrade alpine to 3.15 * Add executability test to entrypoint for too old dockers Signed-off-by: Andrew Thornton <art27@cantab.net> * Update docker/rootless/usr/local/bin/docker-entrypoint.sh Co-authored-by: zeripath <art27@cantab.net>
* Use shadowing script for docker (#17846)zeripath2021-12-013-1/+60
| | | | | | | | | | | | | | | | | | | | Too many docker users are caught out by the default location for the app.ini file being environment dependent so that when they docker exec into the container the gitea commands do not work properly and require additional -c arguments to correctly pick up the configuration. This PR simply shadows the gitea binary using variants of the FHS compatible script to make the command gitea have the default locations by default. Fix #14468 Reference #17497 Reference #12082 Reference #8941 ... amongst others ... Replace #17501 Signed-off-by: Andrew Thornton <art27@cantab.net>
* Change docker tag logic (#16421)techknowlogick2021-07-142-7/+9
| | | | | | | | | | | | | * Change docker logic * Apply suggestions from code review Co-authored-by: Kyle D. <kdumontnu@gmail.com> * docs Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: Kyle D. <kdumontnu@gmail.com>
* Fix various documentation, user-facing, and source comment typos (#16367)luzpaz2021-07-082-2/+2
| | | | | * Fix various doc, user-facing, and source comment typos Found via `codespell -q 3 -S ./options/locale,./vendor -L ba,pullrequest,pullrequests,readby`
* Fix bug due to missing MaxStartups and MaxSessions (#16046)zeripath2021-06-012-2/+4
| | | | | | | | | | Unforunately #16009 makes these settings mandatory. This PR uses the same technique as used for the certificates to make these settings non-mandatory. Fix #16044 Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: 6543 <6543@obermui.de>
* Make sshd_config more flexible regarding connections (#16009)Dario Louzado2021-05-311-0/+3
| | | | | | | | | | | | * Make sshd_config more flexible regarding MaxStartups and MaxSessions. See https://man.openbsd.org/sshd_config for more information. * make property prefix equals other existing Gitea SSH properties. Co-authored-by: dlouzado <dlouzado@senado.leg.br>
* Only offer hostcertificates if they exist (#15849)zeripath2021-05-132-4/+24
| | | | | | | | | | | | | | | | | A common bug report is the otherwise harmless sshd logging: ``` Could not load host certificate "/data/ssh/ssh_host_ed25519_cert": No such file or directory ``` This PR simply checks if these files exist before creation of sshd_config and if they do not exist, doesn't add a reference to them. Fix #14110 amongst others. Signed-off-by: Andrew Thornton <art27@cantab.net> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: Lauris BH <lauris@nix.lv>
* Add reverse proxy configuration support for remote IP address (#14959)Lauris BH2021-03-162-0/+4
| | | | | | | | | * Add reverse proxy configuration support for remote IP address validation * Trust all IP addresses in containerized environments by default * Use single option to specify networks and proxy IP addresses. By default trust all loopback IPs Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Add environment-to-ini to docker image (#14762)Kyle D2021-02-232-0/+6
| | | | | | | | | | | * Add environment-to-app.ini routine * Call environment-to-ini in docker setup scripts * Automatically convert section vars to lower case to match documentation * Remove git patch instructions * Add env variable documentation to Install Docker
* Update docs and comments to remove macaron (#14491)Lunny Xiao2021-01-291-2/+0
|
* Set RUN_MODE prod by default (#13765)silverwind2020-11-302-2/+2
| | | | | | | I think it's a bad default to have "dev" as the default run mode which enables debugging and now also disables HTTP caching. It's better to just default to a value suitable for general deployments. Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Format files (#13698)65432020-11-282-4/+4
| | | | | | | | | | | | | | | | * align "make help" * format * untouch build/generate-svg.js * untouch .eslintrc * combine editorconfig's * rm editorconfig Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* fix docker rootless manifest (#13386)Antoine GIRARD2020-11-021-1/+1
|
* Remove specific indexer path (#13388)Antoine GIRARD2020-11-011-3/+0
| | | Co-authored-by: Lauris BH <lauris@nix.lv>
* docker: rootless image (#10154)Antoine GIRARD2020-10-314-0/+136
| | | | | | | | | * docker: rootless image * improve docs + remove check for write perm on custom * add more info on ssh passtrough * Add comment for internal ssh server in container config
* Update sshd_config (#13143)Anders Eurenius Runvald2020-10-141-0/+4
| | | | | Afaik, adding these lines does nothing unless the file(s) are present. Having them in let's admins supply certs instead of relying on TOFU. Co-authored-by: zeripath <art27@cantab.net>
* Add ssh certificate support (#12281)Wim2020-10-101-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Add ssh certificate support * Add ssh certificate support to builtin ssh * Write trusted-user-ca-keys.pem based on configuration * Update app.example.ini * Update templates/user/settings/keys_principal.tmpl Co-authored-by: silverwind <me@silverwind.io> * Remove unused locale string * Update options/locale/locale_en-US.ini Co-authored-by: silverwind <me@silverwind.io> * Update options/locale/locale_en-US.ini Co-authored-by: silverwind <me@silverwind.io> * Update models/ssh_key.go Co-authored-by: silverwind <me@silverwind.io> * Add missing creation of SSH.Rootpath * Update cheatsheet, example and locale strings * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go Co-authored-by: zeripath <art27@cantab.net> * Update models/ssh_key.go * Optimizations based on feedback * Validate CA keys for external sshd * Add filename option and change default filename Add a SSH_TRUSTED_USER_CA_KEYS_FILENAME option which default is RUN_USER/.ssh/gitea-trusted-user-ca-keys.pem Do not write a file when SSH_TRUSTED_USER_CA_KEYS is empty. Add some more documentation. * Remove unneeded principalkey functions * Add blank line * Apply suggestions from code review Co-authored-by: zeripath <art27@cantab.net> * Add SSH_AUTHORIZED_PRINCIPALS_ALLOW option This adds a SSH_AUTHORIZED_PRINCIPALS_ALLOW which is default email,username this means that users only can add the principals that match their email or username. To allow anything the admin need to set the option anything. This allows for a safe default in gitea which protects against malicious users using other user's prinicipals. (before that user could set it). This commit also has some small other fixes from the last code review. * Rewrite principal keys file on user deletion * Use correct rewrite method * Set correct AuthorizedPrincipalsBackup default setting * Rewrite principalsfile when adding principals * Add update authorized_principals option to admin dashboard * Handle non-primary emails Signed-off-by: Andrew Thornton <art27@cantab.net> * Add the command actually to the dashboard template * Update models/ssh_key.go Co-authored-by: silverwind <me@silverwind.io> * By default do not show principal options unless there are CA keys set or they are explicitly set Signed-off-by: Andrew Thornton <art27@cantab.net> * allow settings when enabled * Fix typos in TrustedUserCAKeys path * Allow every CASignatureAlgorithms algorithm As this depends on the content of TrustedUserCAKeys we should allow all signature algorithms as admins can choose the specific algorithm on their signing CA * Update models/ssh_key.go Co-authored-by: Lauris BH <lauris@nix.lv> * Fix linting issue Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: zeripath <art27@cantab.net> Co-authored-by: Lauris BH <lauris@nix.lv> Co-authored-by: techknowlogick <matti@mdranta.net> Co-authored-by: techknowlogick <techknowlogick@gitea.io>
* Change default log configuration (#13088)zeripath2020-10-101-0/+6
| | | | | | | | | | | | | | | * Change default log configuration This PR changes the install page and the docker default logging configuration to match the suggested configuration that I repeatedly end up suggesting on issues. It further improves the logging configuration docs to recommend specific instructions for how to configure logs for posting to issues. Signed-off-by: Andrew Thornton <art27@cantab.net> * Update docs/content/doc/advanced/logging-documentation.en-us.md
* Disable DSA ssh keys by default (#13056)zeripath2020-10-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * Disable DSA ssh keys by default OpenSSH has disabled DSA keys since version 7.0 As the docker runs openssh > v7.0 we should just disable DSA keys by default. Refers to #11417 Signed-off-by: Andrew Thornton <art27@cantab.net> * Just disable DSA keys by default Signed-off-by: Andrew Thornton <art27@cantab.net> * Appears we need to set the minimum key sizes too Signed-off-by: Andrew Thornton <art27@cantab.net> * Appears we need to set the minimum key sizes too Signed-off-by: Andrew Thornton <art27@cantab.net> * Remove DSA type * Fix Tests Co-authored-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: Lauris BH <lauris@nix.lv>
* Fix typo in README.md (#12369)Kevin Schweikert2020-07-291-2/+2
| | | Changed Dockefile to Dockerfile
* merge docker makefile into main one (#12289)techknowlogick2020-07-212-14/+7
| | | | | | | | | * merge docker makefile into main one * add readme for docker folder * don't include a file that doesn't exist anymore Co-authored-by: Lauris BH <lauris@nix.lv>
* Fix missing CGO_EXTRA_FLAGS build arg for docker (#11782)Cirno the Strongest2020-06-061-1/+1
| | | Co-authored-by: zeripath <art27@cantab.net>
* Fix; declare DOMAIN variable for docker setup (#10780)Adrian POIGET2020-05-042-0/+2
| | | | | | | | In the /install form, the value for SSH Server Domain is taken form the DOMAIN variable and overwrites SSH_DOMAIN environment variable set the first time if nothing done Co-authored-by: Adrian POIGET <adrian.poiget@viveris.fr>
* Fix latest docker image haven't include static files. (#9252)Lunny Xiao2019-12-051-1/+1
| | | | | | * add warnging on docs * fix docs
* docker: ask s6 to stop all service when gitea stop (#9171)Antoine GIRARD2019-11-271-1/+1
| | | | | | | | * fix: ask s6 to stop all service when gitea stop https://github.com/just-containers/s6-overlay#writing-an-optional-finish-script * change service folder
* Fix #8453 by making openssh listen on SSH_LISTEN_PORT not SSH_PORT (#8477)zeripath2019-10-122-2/+3
|
* Make AllowedUsers configurable in sshd_config (#8094)jpellegrini2019-09-052-3/+1
| | | | | | | | docker/root/usr/bin/entrypoint already allows for the specification of USER, USER_UID, USER_GID. But since AllowedUsers is hardcoded in sshd_config, one cannot log in as a user different ftom git. This change substitutes ${USER} for git in the sshd_config template. Signed-off-by: Jeronimo Pellegrini <j_p@aleph0.info>
* Support SSH_LISTEN_PORT env var in docker app.ini template (#7829)leigh capili2019-08-242-0/+2
| | | Signed-off-by: leigh capili <leigh@null.net>
* drone/docker: prepare multi-arch release + provide arm64 image (#7571)Antoine GIRARD2019-07-241-0/+19
| | | | | | | | | | | | * drone/docker: prepare multi-arch release * Add docker-linux-arm64 pipeline * add arm 64 build to manifest * tag dry-run + indent * Fix notify dependency
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-26 18:07:09 +0000