From e8433b7fe6dd1dfa5ecf0633568cc3e34caeb0f9 Mon Sep 17 00:00:00 2001 From: Lunny Xiao Date: Thu, 23 Mar 2023 23:18:24 +0800 Subject: Restructure documentation. Now the documentation has installation, administration, usage, development, contributing the 5 main parts (#23629) - **Installation**: includes how to install Gitea and related other tools, also includes upgrade Gitea - **Administration**: includes how to configure Gitea, customize Gitea and manage Gitea instance out of Gitea admin UI - **Usage**: includes how to use Gitea's functionalities. A sub documentation is about packages, in future we could also include CI/CD and others. - **Development**: includes how to integrate with Gitea's API, how to develop new features within Gitea - **Contributing**: includes how to contribute code to Gitea repositories. After this is merged, I think we can have a sub-documentation of `Usage` part named `Actions` to describe how to use Gitea actions --------- Co-authored-by: John Olheiser --- .../doc/advanced/adding-legal-pages.en-us.md | 38 - docs/content/doc/advanced/clone-filter.en-us.md | 37 - docs/content/doc/advanced/cmd-embedded.en-us.md | 121 -- .../doc/advanced/config-cheat-sheet.en-us.md | 1395 -------------------- .../doc/advanced/config-cheat-sheet.zh-cn.md | 487 ------- .../doc/advanced/customizing-gitea.en-us.md | 372 ------ .../doc/advanced/customizing-gitea.zh-cn.md | 88 -- .../doc/advanced/environment-variables.en-us.md | 63 - .../doc/advanced/environment-variables.zh-cn.md | 55 - .../doc/advanced/external-renderers.en-us.md | 196 --- .../doc/advanced/logging-documentation.en-us.md | 522 -------- docs/content/doc/advanced/mail-templates.en-us.md | 280 ---- docs/content/doc/advanced/protected-tags.en-us.md | 57 - docs/content/doc/advanced/repo-indexer.en-us.md | 62 - docs/content/doc/advanced/repo-mirror.en-us.md | 92 -- .../advanced/search-engines-indexation.en-us.md | 38 - docs/content/doc/advanced/signing.en-us.md | 177 --- 17 files changed, 4080 deletions(-) delete mode 100644 docs/content/doc/advanced/adding-legal-pages.en-us.md delete mode 100644 docs/content/doc/advanced/clone-filter.en-us.md delete mode 100644 docs/content/doc/advanced/cmd-embedded.en-us.md delete mode 100644 docs/content/doc/advanced/config-cheat-sheet.en-us.md delete mode 100644 docs/content/doc/advanced/config-cheat-sheet.zh-cn.md delete mode 100644 docs/content/doc/advanced/customizing-gitea.en-us.md delete mode 100644 docs/content/doc/advanced/customizing-gitea.zh-cn.md delete mode 100644 docs/content/doc/advanced/environment-variables.en-us.md delete mode 100644 docs/content/doc/advanced/environment-variables.zh-cn.md delete mode 100644 docs/content/doc/advanced/external-renderers.en-us.md delete mode 100644 docs/content/doc/advanced/logging-documentation.en-us.md delete mode 100644 docs/content/doc/advanced/mail-templates.en-us.md delete mode 100644 docs/content/doc/advanced/protected-tags.en-us.md delete mode 100644 docs/content/doc/advanced/repo-indexer.en-us.md delete mode 100644 docs/content/doc/advanced/repo-mirror.en-us.md delete mode 100644 docs/content/doc/advanced/search-engines-indexation.en-us.md delete mode 100644 docs/content/doc/advanced/signing.en-us.md (limited to 'docs/content/doc/advanced') diff --git a/docs/content/doc/advanced/adding-legal-pages.en-us.md b/docs/content/doc/advanced/adding-legal-pages.en-us.md deleted file mode 100644 index 5816fdbf3f..0000000000 --- a/docs/content/doc/advanced/adding-legal-pages.en-us.md +++ /dev/null @@ -1,38 +0,0 @@ ---- -date: "2019-12-28" -title: "Adding Legal Pages" -slug: adding-legal-pages -weight: 9 -toc: false -draft: false -menu: - sidebar: - parent: "advanced" - name: "Adding Legal Pages" - identifier: "adding-legal-pages" - weight: 9 ---- - -Some jurisdictions (such as EU), requires certain legal pages (e.g. Privacy Policy) to be added to website. Follow these steps to add them to your Gitea instance. - -## Getting Pages - -Gitea source code ships with sample pages, available in `contrib/legal` directory. Copy them to `custom/public/`. For example, to add Privacy Policy: - -``` -wget -O /path/to/custom/public/privacy.html https://raw.githubusercontent.com/go-gitea/gitea/main/contrib/legal/privacy.html.sample -``` - -Now you need to edit the page to meet your requirements. In particular you must change the email addresses, web addresses and references to "Your Gitea Instance" to match your situation. - -You absolutely must not place a general ToS or privacy statement that implies that the Gitea project is responsible for your server. - -## Make it Visible - -Create or append to `/path/to/custom/templates/custom/extra_links_footer.tmpl`: - -```go -Privacy Policy -``` - -Restart Gitea to see the changes. diff --git a/docs/content/doc/advanced/clone-filter.en-us.md b/docs/content/doc/advanced/clone-filter.en-us.md deleted file mode 100644 index 58675d2e94..0000000000 --- a/docs/content/doc/advanced/clone-filter.en-us.md +++ /dev/null @@ -1,37 +0,0 @@ ---- -date: "2021-02-02" -title: "Clone filters (partial clone)" -slug: "clone-filters" -weight: 25 -draft: false -toc: false -menu: - sidebar: - parent: "advanced" - name: "Clone filters" - weight: 25 - identifier: "clone-filters" ---- - -# Clone filters (partial clone) - -Git introduces `--filter` option to `git clone` command, which filters out -large files and objects (such as blobs) to create partial clone of a repo. -Clone filters are especially useful for large repo and/or metered connection, -where full clone (without `--filter`) can be expensive (as all history data -must be downloaded). - -This requires Git version 2.22 or later, both on the Gitea server and on the -client. For clone filters to work properly, make sure that Git version -on the client is at least the same as on the server (or later). Login to -Gitea server as admin and head to Site Administration -> Configuration to -see Git version of the server. - -By default, clone filters are enabled, unless `DISABLE_PARTIAL_CLONE` under -`[git]` is set to `true`. - -See [GitHub blog post: Get up to speed with partial clone](https://github.blog/2020-12-21-get-up-to-speed-with-partial-clone-and-shallow-clone/) -for common use cases of clone filters (blobless and treeless clones), and -[GitLab docs for partial clone](https://docs.gitlab.com/ee/topics/git/partial_clone.html) -for more advanced use cases (such as filter by file size and remove -filters to turn partial clone into full clone). diff --git a/docs/content/doc/advanced/cmd-embedded.en-us.md b/docs/content/doc/advanced/cmd-embedded.en-us.md deleted file mode 100644 index 63ab83bd36..0000000000 --- a/docs/content/doc/advanced/cmd-embedded.en-us.md +++ /dev/null @@ -1,121 +0,0 @@ ---- -date: "2020-01-25T21:00:00-03:00" -title: "Embedded data extraction tool" -slug: "cmd-embedded" -weight: 40 -toc: false -draft: false -menu: - sidebar: - parent: "advanced" - name: "Embedded data extraction tool" - weight: 40 - identifier: "cmd-embedded" ---- - -# Embedded data extraction tool - -**Table of Contents** - -{{< toc >}} - -Gitea's executable contains all the resources required to run: templates, images, style-sheets -and translations. Any of them can be overridden by placing a replacement in a matching path -inside the `custom` directory (see [Customizing Gitea]({{< relref "doc/advanced/customizing-gitea.en-us.md" >}})). - -To obtain a copy of the embedded resources ready for editing, the `embedded` command from the CLI -can be used from the OS shell interface. - -**NOTE:** The embedded data extraction tool is included in Gitea versions 1.12 and above. - -## Listing resources - -To list resources embedded in Gitea's executable, use the following syntax: - -```sh -gitea embedded list [--include-vendored] [patterns...] -``` - -The `--include-vendored` flag makes the command include vendored files, which are -normally excluded; that is, files from external libraries that are required for Gitea -(e.g. [font-awesome](https://fontawesome.com/), [octicons](https://octicons.github.com/), etc). - -A list of file search patterns can be provided. Gitea uses [gobwas/glob](https://github.com/gobwas/glob) -for its glob syntax. Here are some examples: - -- List all template files, in any virtual directory: `**.tmpl` -- List all mail template files: `templates/mail/**.tmpl` -- List all files inside `public/img`: `public/img/**` - -Don't forget to use quotes for the patterns, as spaces, `*` and other characters might have -a special meaning for your command shell. - -If no pattern is provided, all files are listed. - -### Example - -Listing all embedded files with `openid` in their path: - -```sh -$ gitea embedded list '**openid**' -public/img/auth/openid_connect.svg -public/img/openid-16x16.png -templates/user/auth/finalize_openid.tmpl -templates/user/auth/signin_openid.tmpl -templates/user/auth/signup_openid_connect.tmpl -templates/user/auth/signup_openid_navbar.tmpl -templates/user/auth/signup_openid_register.tmpl -templates/user/settings/security_openid.tmpl -``` - -## Extracting resources - -To extract resources embedded in Gitea's executable, use the following syntax: - -```sh -gitea [--config {file}] embedded extract [--destination {dir}|--custom] [--overwrite|--rename] [--include-vendored] {patterns...} -``` - -The `--config` option tells Gitea the location of the `app.ini` configuration file if -it's not in its default location. This option is only used with the `--custom` flag. - -The `--destination` option tells Gitea the directory where the files must be extracted to. -The default is the current directory. - -The `--custom` flag tells Gitea to extract the files directly into the `custom` directory. -For this to work, the command needs to know the location of the `app.ini` configuration -file (`--config`) and, depending of the configuration, be ran from the directory where -Gitea normally starts. See [Customizing Gitea]({{< relref "doc/advanced/customizing-gitea.en-us.md" >}}) for details. - -The `--overwrite` flag allows any existing files in the destination directory to be overwritten. - -The `--rename` flag tells Gitea to rename any existing files in the destination directory -as `filename.bak`. Previous `.bak` files are overwritten. - -At least one file search pattern must be provided; see `list` subcomand above for pattern -syntax and examples. - -### Important notice - -Make sure to **only extract those files that require customization**. Files that -are present in the `custom` directory are not upgraded by Gitea's upgrade process. -When Gitea is upgraded to a new version (by replacing the executable), many of the -embedded files will suffer changes. Gitea will honor and use any files found -in the `custom` directory, even if they are old and incompatible. - -### Example - -Extracting mail templates to a temporary directory: - -```sh -$ mkdir tempdir -$ gitea embedded extract --destination tempdir 'templates/mail/**.tmpl' -Extracting to tempdir: -tempdir/templates/mail/auth/activate.tmpl -tempdir/templates/mail/auth/activate_email.tmpl -tempdir/templates/mail/auth/register_notify.tmpl -tempdir/templates/mail/auth/reset_passwd.tmpl -tempdir/templates/mail/issue/assigned.tmpl -tempdir/templates/mail/issue/default.tmpl -tempdir/templates/mail/notify/collaborator.tmpl -``` diff --git a/docs/content/doc/advanced/config-cheat-sheet.en-us.md b/docs/content/doc/advanced/config-cheat-sheet.en-us.md deleted file mode 100644 index aca591787e..0000000000 --- a/docs/content/doc/advanced/config-cheat-sheet.en-us.md +++ /dev/null @@ -1,1395 +0,0 @@ ---- -date: "2016-12-26T16:00:00+02:00" -title: "Config Cheat Sheet" -slug: "config-cheat-sheet" -weight: 20 -toc: false -draft: false -menu: - sidebar: - parent: "advanced" - name: "Config Cheat Sheet" - weight: 20 - identifier: "config-cheat-sheet" ---- - -# Configuration Cheat Sheet - -This is a cheat sheet for the Gitea configuration file. It contains most of the settings -that can be configured as well as their default values. - -Any changes to the Gitea configuration file should be made in `custom/conf/app.ini` -or any corresponding location. When installing from a distribution, this will -typically be found at `/etc/gitea/conf/app.ini`. - -The defaults provided here are best-effort (not built automatically). They are -accurately recorded in [app.example.ini](https://github.com/go-gitea/gitea/blob/main/custom/conf/app.example.ini) -(s/main/\). Any string in the format `%(X)s` is a feature powered -by [ini](https://github.com/go-ini/ini/#recursive-values), for reading values recursively. - -In the default values below, a value in the form `$XYZ` refers to an environment variable. (However, see `environment-to-ini`.) Values in the form _`XxYyZz`_ refer to values listed as part of the default configuration. These notation forms will not work in your own `app.ini` file and are only listed here as documentation. - -Values containing `#` or `;` must be quoted using `` ` `` or `"""`. - -**Note:** A full restart is required for Gitea configuration changes to take effect. - -{{< toc >}} - -## Default Configuration (non-`app.ini` configuration) - -These values are environment-dependent but form the basis of a lot of values. They will be -reported as part of the default configuration when running `gitea --help` or on start-up. The order they are emitted there is slightly different but we will list them here in the order they are set-up. - -- _`AppPath`_: This is the absolute path of the running gitea binary. -- _`AppWorkPath`_: This refers to "working path" of the `gitea` binary. It is determined by using the first set thing in the following hierarchy: - - The `--work-path` flag passed to the binary - - The environment variable `$GITEA_WORK_DIR` - - A built-in value set at build time (see building from source) - - Otherwise it defaults to the directory of the _`AppPath`_ - - If any of the above are relative paths then they are made absolute against -the directory of the _`AppPath`_ -- _`CustomPath`_: This is the base directory for custom templates and other options. -It is determined by using the first set thing in the following hierarchy: - - The `--custom-path` flag passed to the binary - - The environment variable `$GITEA_CUSTOM` - - A built-in value set at build time (see building from source) - - Otherwise it defaults to _`AppWorkPath`_`/custom` - - If any of the above are relative paths then they are made absolute against the -the directory of the _`AppWorkPath`_ -- _`CustomConf`_: This is the path to the `app.ini` file. - - The `--config` flag passed to the binary - - A built-in value set at build time (see building from source) - - Otherwise it defaults to _`CustomPath`_`/conf/app.ini` - - If any of the above are relative paths then they are made absolute against the -the directory of the _`CustomPath`_ - -In addition there is _`StaticRootPath`_ which can be set as a built-in at build time, but will otherwise default to _`AppWorkPath`_ - -## Overall (`DEFAULT`) - -- `APP_NAME`: **Gitea: Git with a cup of tea**: Application name, used in the page title. -- `RUN_USER`: **_current OS username_/`$USER`/`$USERNAME` e.g. git**: The user Gitea will run as. - This should be a dedicated system (non-user) account. Setting this incorrectly will cause Gitea - to not start. -- `RUN_MODE`: **prod**: Application run mode, affects performance and debugging. Either "dev", "prod" or "test". - -## Repository (`repository`) - -- `ROOT`: **%(APP_DATA_PATH)s/gitea-repositories**: Root path for storing all repository data. - A relative path is interpreted as **_`AppWorkPath`_/%(ROOT)s**. -- `SCRIPT_TYPE`: **bash**: The script type this server supports. Usually this is `bash`, - but some users report that only `sh` is available. -- `DETECTED_CHARSETS_ORDER`: **UTF-8, UTF-16BE, UTF-16LE, UTF-32BE, UTF-32LE, ISO-8859, windows-1252, ISO-8859, windows-1250, ISO-8859, ISO-8859, ISO-8859, windows-1253, ISO-8859, windows-1255, ISO-8859, windows-1251, windows-1256, KOI8-R, ISO-8859, windows-1254, Shift_JIS, GB18030, EUC-JP, EUC-KR, Big5, ISO-2022, ISO-2022, ISO-2022, IBM424_rtl, IBM424_ltr, IBM420_rtl, IBM420_ltr**: Tie-break order of detected charsets - if the detected charsets have equal confidence, charsets earlier in the list will be chosen in preference to those later. Adding `defaults` will place the unnamed charsets at that point. -- `ANSI_CHARSET`: **\**: Default ANSI charset to override non-UTF-8 charsets to. -- `FORCE_PRIVATE`: **false**: Force every new repository to be private. -- `DEFAULT_PRIVATE`: **last**: Default private when creating a new repository. - \[last, private, public\] -- `DEFAULT_PUSH_CREATE_PRIVATE`: **true**: Default private when creating a new repository with push-to-create. -- `MAX_CREATION_LIMIT`: **-1**: Global maximum creation limit of repositories per user, - `-1` means no limit. -- `PULL_REQUEST_QUEUE_LENGTH`: **1000**: Length of pull request patch test queue, make it. **DEPRECATED** use `LENGTH` in `[queue.pr_patch_checker]`. - as large as possible. Use caution when editing this value. -- `MIRROR_QUEUE_LENGTH`: **1000**: Patch test queue length, increase if pull request patch - testing starts hanging. **DEPRECATED** use `LENGTH` in `[queue.mirror]`. -- `PREFERRED_LICENSES`: **Apache License 2.0,MIT License**: Preferred Licenses to place at - the top of the list. Name must match file name in options/license or custom/options/license. -- `DISABLE_HTTP_GIT`: **false**: Disable the ability to interact with repositories over the - HTTP protocol. -- `USE_COMPAT_SSH_URI`: **false**: Force ssh:// clone url instead of scp-style uri when - default SSH port is used. -- `ACCESS_CONTROL_ALLOW_ORIGIN`: **\**: Value for Access-Control-Allow-Origin header, - default is not to present. **WARNING**: This maybe harmful to you website if you do not - give it a right value. -- `DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH`: **false**: Close an issue if a commit on a non default branch marks it as closed. -- `ENABLE_PUSH_CREATE_USER`: **false**: Allow users to push local repositories to Gitea and have them automatically created for a user. -- `ENABLE_PUSH_CREATE_ORG`: **false**: Allow users to push local repositories to Gitea and have them automatically created for an org. -- `DISABLED_REPO_UNITS`: **_empty_**: Comma separated list of globally disabled repo units. Allowed values: \[repo.issues, repo.ext_issues, repo.pulls, repo.wiki, repo.ext_wiki, repo.projects\] -- `DEFAULT_REPO_UNITS`: **repo.code,repo.releases,repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages**: Comma separated list of default new repo units. Allowed values: \[repo.code, repo.releases, repo.issues, repo.pulls, repo.wiki, repo.projects\]. Note: Code and Releases can currently not be deactivated. If you specify default repo units you should still list them for future compatibility. External wiki and issue tracker can't be enabled by default as it requires additional settings. Disabled repo units will not be added to new repositories regardless if it is in the default list. -- `DEFAULT_FORK_REPO_UNITS`: **repo.code,repo.pulls**: Comma separated list of default forked repo units. The set of allowed values and rules is the same as `DEFAULT_REPO_UNITS`. -- `PREFIX_ARCHIVE_FILES`: **true**: Prefix archive files by placing them in a directory named after the repository. -- `DISABLE_MIGRATIONS`: **false**: Disable migrating feature. -- `DISABLE_STARS`: **false**: Disable stars feature. -- `DEFAULT_BRANCH`: **main**: Default branch name of all repositories. -- `ALLOW_ADOPTION_OF_UNADOPTED_REPOSITORIES`: **false**: Allow non-admin users to adopt unadopted repositories -- `ALLOW_DELETION_OF_UNADOPTED_REPOSITORIES`: **false**: Allow non-admin users to delete unadopted repositories -- `DISABLE_DOWNLOAD_SOURCE_ARCHIVES`: **false**: Don't allow download source archive files from UI -- `ALLOW_FORK_WITHOUT_MAXIMUM_LIMIT`: **true**: Allow fork repositories without maximum number limit - -### Repository - Editor (`repository.editor`) - -- `LINE_WRAP_EXTENSIONS`: **.txt,.md,.markdown,.mdown,.mkd,**: List of file extensions for which lines should be wrapped in the Monaco editor. Separate extensions with a comma. To line wrap files without an extension, just put a comma -- `PREVIEWABLE_FILE_MODES`: **markdown**: Valid file modes that have a preview API associated with them, such as `api/v1/markdown`. Separate the values by commas. The preview tab in edit mode won't be displayed if the file extension doesn't match. - -### Repository - Pull Request (`repository.pull-request`) - -- `WORK_IN_PROGRESS_PREFIXES`: **WIP:,\[WIP\]**: List of prefixes used in Pull Request - title to mark them as Work In Progress. These are matched in a case-insensitive manner. -- `CLOSE_KEYWORDS`: **close**, **closes**, **closed**, **fix**, **fixes**, **fixed**, **resolve**, **resolves**, **resolved**: List of - keywords used in Pull Request comments to automatically close a related issue -- `REOPEN_KEYWORDS`: **reopen**, **reopens**, **reopened**: List of keywords used in Pull Request comments to automatically reopen - a related issue -- `DEFAULT_MERGE_STYLE`: **merge**: Set default merge style for repository creating, valid options: `merge`, `rebase`, `rebase-merge`, `squash` -- `DEFAULT_MERGE_MESSAGE_COMMITS_LIMIT`: **50**: In the default merge message for squash commits include at most this many commits. Set to `-1` to include all commits -- `DEFAULT_MERGE_MESSAGE_SIZE`: **5120**: In the default merge message for squash commits limit the size of the commit messages. Set to `-1` to have no limit. Only used if `POPULATE_SQUASH_COMMENT_WITH_COMMIT_MESSAGES` is `true`. -- `DEFAULT_MERGE_MESSAGE_ALL_AUTHORS`: **false**: In the default merge message for squash commits walk all commits to include all authors in the Co-authored-by otherwise just use those in the limited list -- `DEFAULT_MERGE_MESSAGE_MAX_APPROVERS`: **10**: In default merge messages limit the number of approvers listed as `Reviewed-by:`. Set to `-1` to include all. -- `DEFAULT_MERGE_MESSAGE_OFFICIAL_APPROVERS_ONLY`: **true**: In default merge messages only include approvers who are officially allowed to review. -- `POPULATE_SQUASH_COMMENT_WITH_COMMIT_MESSAGES`: **false**: In default squash-merge messages include the commit message of all commits comprising the pull request. -- `ADD_CO_COMMITTER_TRAILERS`: **true**: Add co-authored-by and co-committed-by trailers to merge commit messages if committer does not match author. -- `TEST_CONFLICTING_PATCHES_WITH_GIT_APPLY`: **false**: PR patches are tested using a three-way merge method to discover if there are conflicts. If this setting is set to **true**, conflicting patches will be retested using `git apply` - This was the previous behaviour in 1.18 (and earlier) but is somewhat inefficient. Please report if you find that this setting is required. - -### Repository - Issue (`repository.issue`) - -- `LOCK_REASONS`: **Too heated,Off-topic,Resolved,Spam**: A list of reasons why a Pull Request or Issue can be locked - -### Repository - Upload (`repository.upload`) - -- `ENABLED`: **true**: Whether repository file uploads are enabled -- `TEMP_PATH`: **data/tmp/uploads**: Path for uploads (content gets deleted on Gitea restart) -- `ALLOWED_TYPES`: **\**: Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types. -- `FILE_MAX_SIZE`: **3**: Max size of each file in megabytes. -- `MAX_FILES`: **5**: Max number of files per upload - -### Repository - Release (`repository.release`) - -- `ALLOWED_TYPES`: **\**: Comma-separated list of allowed file extensions (`.zip`), mime types (`text/plain`) or wildcard type (`image/*`, `audio/*`, `video/*`). Empty value or `*/*` allows all types. -- `DEFAULT_PAGING_NUM`: **10**: The default paging number of releases user interface -- For settings related to file attachments on releases, see the `attachment` section. - -### Repository - Signing (`repository.signing`) - -- `SIGNING_KEY`: **default**: \[none, KEYID, default \]: Key to sign with. -- `SIGNING_NAME` & `SIGNING_EMAIL`: if a KEYID is provided as the `SIGNING_KEY`, use these as the Name and Email address of the signer. These should match publicized name and email address for the key. -- `INITIAL_COMMIT`: **always**: \[never, pubkey, twofa, always\]: Sign initial commit. - - `never`: Never sign - - `pubkey`: Only sign if the user has a public key - - `twofa`: Only sign if the user is logged in with twofa - - `always`: Always sign - - Options other than `never` and `always` can be combined as a comma separated list. -- `DEFAULT_TRUST_MODEL`: **collaborator**: \[collaborator, committer, collaboratorcommitter\]: The default trust model used for verifying commits. - - `collaborator`: Trust signatures signed by keys of collaborators. - - `committer`: Trust signatures that match committers (This matches GitHub and will force Gitea signed commits to have Gitea as the committer). - - `collaboratorcommitter`: Trust signatures signed by keys of collaborators which match the committer. -- `WIKI`: **never**: \[never, pubkey, twofa, always, parentsigned\]: Sign commits to wiki. -- `CRUD_ACTIONS`: **pubkey, twofa, parentsigned**: \[never, pubkey, twofa, parentsigned, always\]: Sign CRUD actions. - - Options as above, with the addition of: - - `parentsigned`: Only sign if the parent commit is signed. -- `MERGES`: **pubkey, twofa, basesigned, commitssigned**: \[never, pubkey, twofa, approved, basesigned, commitssigned, always\]: Sign merges. - - `approved`: Only sign approved merges to a protected branch. - - `basesigned`: Only sign if the parent commit in the base repo is signed. - - `headsigned`: Only sign if the head commit in the head branch is signed. - - `commitssigned`: Only sign if all the commits in the head branch to the merge point are signed. - -## Repository - Local (`repository.local`) - -- `LOCAL_COPY_PATH`: **tmp/local-repo**: Path for temporary local repository copies. Defaults to `tmp/local-repo` (content gets deleted on Gitea restart) - -## Repository - MIME type mapping (`repository.mimetype_mapping`) - -Configuration for set the expected MIME type based on file extensions of downloadable files. Configuration presents in key-value pairs and file extensions starts with leading `.`. - -The following configuration set `Content-Type: application/vnd.android.package-archive` header when downloading files with `.apk` file extension. - -```ini -.apk=application/vnd.android.package-archive -``` - -## CORS (`cors`) - -- `ENABLED`: **false**: enable cors headers (disabled by default) -- `SCHEME`: **http**: scheme of allowed requests -- `ALLOW_DOMAIN`: **\***: list of requesting domains that are allowed -- `ALLOW_SUBDOMAIN`: **false**: allow subdomains of headers listed above to request -- `METHODS`: **GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS**: list of methods allowed to request -- `MAX_AGE`: **10m**: max time to cache response -- `ALLOW_CREDENTIALS`: **false**: allow request with credentials -- `HEADERS`: **Content-Type,User-Agent**: additional headers that are permitted in requests -- `X_FRAME_OPTIONS`: **SAMEORIGIN**: Set the `X-Frame-Options` header value. - -## UI (`ui`) - -- `EXPLORE_PAGING_NUM`: **20**: Number of repositories that are shown in one explore page. -- `ISSUE_PAGING_NUM`: **20**: Number of issues that are shown in one page (for all pages that list issues, milestones, projects). -- `MEMBERS_PAGING_NUM`: **20**: Number of members that are shown in organization members. -- `FEED_MAX_COMMIT_NUM`: **5**: Number of maximum commits shown in one activity feed. -- `FEED_PAGING_NUM`: **20**: Number of items that are displayed in home feed. -- `SITEMAP_PAGING_NUM`: **20**: Number of items that are displayed in a single subsitemap. -- `GRAPH_MAX_COMMIT_NUM`: **100**: Number of maximum commits shown in the commit graph. -- `CODE_COMMENT_LINES`: **4**: Number of line of codes shown for a code comment. -- `DEFAULT_THEME`: **auto**: \[auto, gitea, arc-green\]: Set the default theme for the Gitea install. -- `SHOW_USER_EMAIL`: **true**: Whether the email of the user should be shown in the Explore Users page. -- `THEMES`: **auto,gitea,arc-green**: All available themes. Allow users select personalized themes. - regardless of the value of `DEFAULT_THEME`. -- `THEME_COLOR_META_TAG`: **#6cc644**: Value of `theme-color` meta tag, used by Android >= 5.0. An invalid color like "none" or "disable" will have the default style. More info: https://developers.google.com/web/updates/2014/11/Support-for-theme-color-in-Chrome-39-for-Android -- `MAX_DISPLAY_FILE_SIZE`: **8388608**: Max size of files to be displayed (default is 8MiB) -- `REACTIONS`: All available reactions users can choose on issues/prs and comments - Values can be emoji alias (:smile:) or a unicode emoji. - For custom reactions, add a tightly cropped square image to public/img/emoji/reaction_name.png -- `CUSTOM_EMOJIS`: **gitea, codeberg, gitlab, git, github, gogs**: Additional Emojis not defined in the utf8 standard. - By default we support Gitea (:gitea:), to add more copy them to public/img/emoji/emoji_name.png and - add it to this config. -- `DEFAULT_SHOW_FULL_NAME`: **false**: Whether the full name of the users should be shown where possible. If the full name isn't set, the username will be used. -- `SEARCH_REPO_DESCRIPTION`: **true**: Whether to search within description at repository search on explore page. -- `USE_SERVICE_WORKER`: **false**: Whether to enable a Service Worker to cache frontend assets. - -### UI - Admin (`ui.admin`) - -- `USER_PAGING_NUM`: **50**: Number of users that are shown in one page. -- `REPO_PAGING_NUM`: **50**: Number of repos that are shown in one page. -- `NOTICE_PAGING_NUM`: **25**: Number of notices that are shown in one page. -- `ORG_PAGING_NUM`: **50**: Number of organizations that are shown in one page. - -### UI - User (`ui.user`) - -- `REPO_PAGING_NUM`: **15**: Number of repos that are shown in one page. - -### UI - Metadata (`ui.meta`) - -- `AUTHOR`: **Gitea - Git with a cup of tea**: Author meta tag of the homepage. -- `DESCRIPTION`: **Gitea (Git with a cup of tea) is a painless self-hosted Git service written in Go**: Description meta tag of the homepage. -- `KEYWORDS`: **go,git,self-hosted,gitea**: Keywords meta tag of the homepage. - -### UI - Notification (`ui.notification`) - -- `MIN_TIMEOUT`: **10s**: These options control how often notification endpoint is polled to update the notification count. On page load the notification count will be checked after `MIN_TIMEOUT`. The timeout will increase to `MAX_TIMEOUT` by `TIMEOUT_STEP` if the notification count is unchanged. Set MIN_TIMEOUT to -1 to turn off. -- `MAX_TIMEOUT`: **60s**. -- `TIMEOUT_STEP`: **10s**. -- `EVENT_SOURCE_UPDATE_TIME`: **10s**: This setting determines how often the database is queried to update notification counts. If the browser client supports `EventSource` and `SharedWorker`, a `SharedWorker` will be used in preference to polling notification endpoint. Set to **-1** to disable the `EventSource`. - -### UI - SVG Images (`ui.svg`) - -- `ENABLE_RENDER`: **true**: Whether to render SVG files as images. If SVG rendering is disabled, SVG files are displayed as text and cannot be embedded in markdown files as images. - -### UI - CSV Files (`ui.csv`) - -- `MAX_FILE_SIZE`: **524288** (512kb): Maximum allowed file size in bytes to render CSV files as table. (Set to 0 for no limit). - -## Markdown (`markdown`) - -- `ENABLE_HARD_LINE_BREAK_IN_COMMENTS`: **true**: Render soft line breaks as hard line breaks in comments, which - means a single newline character between paragraphs will cause a line break and adding - trailing whitespace to paragraphs is not necessary to force a line break. -- `ENABLE_HARD_LINE_BREAK_IN_DOCUMENTS`: **false**: Render soft line breaks as hard line breaks in documents, which - means a single newline character between paragraphs will cause a line break and adding - trailing whitespace to paragraphs is not necessary to force a line break. -- `CUSTOM_URL_SCHEMES`: Use a comma separated list (ftp,git,svn) to indicate additional - URL hyperlinks to be rendered in Markdown. URLs beginning in http and https are - always displayed -- `ENABLE_MATH`: **true**: Enables detection of `\(...\)`, `\[...\]`, `$...$` and `$$...$$` blocks as math blocks. - -## Server (`server`) - -- `APP_DATA_PATH`: **_`AppWorkPath`_/data**: This is the default root path for storing data. -- `PROTOCOL`: **http**: \[http, https, fcgi, http+unix, fcgi+unix\] -- `USE_PROXY_PROTOCOL`: **false**: Expect PROXY protocol headers on connections -- `PROXY_PROTOCOL_TLS_BRIDGING`: **false**: When protocol is https, expect PROXY protocol headers after TLS negotiation. -- `PROXY_PROTOCOL_HEADER_TIMEOUT`: **5s**: Timeout to wait for PROXY protocol header (set to 0 to have no timeout) -- `PROXY_PROTOCOL_ACCEPT_UNKNOWN`: **false**: Accept PROXY protocol headers with Unknown type. -- `DOMAIN`: **localhost**: Domain name of this server. -- `ROOT_URL`: **%(PROTOCOL)s://%(DOMAIN)s:%(HTTP\_PORT)s/**: - Overwrite the automatically generated public URL. - This is useful if the internal and the external URL don't match (e.g. in Docker). -- `STATIC_URL_PREFIX`: **\**: - Overwrite this option to request static resources from a different URL. - This includes CSS files, images, JS files and web fonts. - Avatar images are dynamic resources and still served by Gitea. - The option can be just a different path, as in `/static`, or another domain, as in `https://cdn.example.com`. - Requests are then made as `%(ROOT_URL)s/static/assets/css/index.css` or `https://cdn.example.com/assets/css/index.css` respectively. - The static files are located in the `public/` directory of the Gitea source repository. - You can proxy the STATIC_URL_PREFIX requests to Gitea server to serve the static - assets, or copy the manually built Gitea assets from `$GITEA_BUILD/public` to - the assets location, eg: `/var/www/assets`, make sure `$STATIC_URL_PREFIX/assets/css/index.css` - points to `/var/www/assets/css/index.css`. - -- `HTTP_ADDR`: **0.0.0.0**: HTTP listen address. - - If `PROTOCOL` is set to `fcgi`, Gitea will listen for FastCGI requests on TCP socket - defined by `HTTP_ADDR` and `HTTP_PORT` configuration settings. - - If `PROTOCOL` is set to `http+unix` or `fcgi+unix`, this should be the name of the Unix socket file to use. Relative paths will be made absolute against the _`AppWorkPath`_. -- `HTTP_PORT`: **3000**: HTTP listen port. - - If `PROTOCOL` is set to `fcgi`, Gitea will listen for FastCGI requests on TCP socket - defined by `HTTP_ADDR` and `HTTP_PORT` configuration settings. -- `UNIX_SOCKET_PERMISSION`: **666**: Permissions for the Unix socket. -- `LOCAL_ROOT_URL`: **%(PROTOCOL)s://%(HTTP_ADDR)s:%(HTTP_PORT)s/**: Local - (DMZ) URL for Gitea workers (such as SSH update) accessing web service. In - most cases you do not need to change the default value. Alter it only if - your SSH server node is not the same as HTTP node. Do not set this variable - if `PROTOCOL` is set to `http+unix`. -- `LOCAL_USE_PROXY_PROTOCOL`: **%(USE_PROXY_PROTOCOL)s**: When making local connections pass the PROXY protocol header. - This should be set to false if the local connection will go through the proxy. -- `PER_WRITE_TIMEOUT`: **30s**: Timeout for any write to the connection. (Set to -1 to - disable all timeouts.) -- `PER_WRITE_PER_KB_TIMEOUT`: **10s**: Timeout per Kb written to connections. - -- `DISABLE_SSH`: **false**: Disable SSH feature when it's not available. -- `START_SSH_SERVER`: **false**: When enabled, use the built-in SSH server. -- `SSH_SERVER_USE_PROXY_PROTOCOL`: **false**: Expect PROXY protocol header on connections to the built-in SSH Server. -- `BUILTIN_SSH_SERVER_USER`: **%(RUN_USER)s**: Username to use for the built-in SSH Server. -- `SSH_USER`: **%(BUILTIN_SSH_SERVER_USER)s**: SSH username displayed in clone URLs. This is only for people who configure the SSH server themselves; in most cases, you want to leave this blank and modify the `BUILTIN_SSH_SERVER_USER`. -- `SSH_DOMAIN`: **%(DOMAIN)s**: Domain name of this server, used for displayed clone URL. -- `SSH_PORT`: **22**: SSH port displayed in clone URL. -- `SSH_LISTEN_HOST`: **0.0.0.0**: Listen address for the built-in SSH server. -- `SSH_LISTEN_PORT`: **%(SSH\_PORT)s**: Port for the built-in SSH server. -- `SSH_ROOT_PATH`: **~/.ssh**: Root path of SSH directory. -- `SSH_CREATE_AUTHORIZED_KEYS_FILE`: **true**: Gitea will create a authorized_keys file by default when it is not using the internal ssh server. If you intend to use the AuthorizedKeysCommand functionality then you should turn this off. -- `SSH_AUTHORIZED_KEYS_BACKUP`: **true**: Enable SSH Authorized Key Backup when rewriting all keys, default is true. -- `SSH_TRUSTED_USER_CA_KEYS`: **\**: Specifies the public keys of certificate authorities that are trusted to sign user certificates for authentication. Multiple keys should be comma separated. E.g.`ssh- ` or `ssh- , ssh- `. For more information see `TrustedUserCAKeys` in the sshd config man pages. When empty no file will be created and `SSH_AUTHORIZED_PRINCIPALS_ALLOW` will default to `off`. -- `SSH_TRUSTED_USER_CA_KEYS_FILENAME`: **`RUN_USER`/.ssh/gitea-trusted-user-ca-keys.pem**: Absolute path of the `TrustedUserCaKeys` file Gitea will manage. If you're running your own ssh server and you want to use the Gitea managed file you'll also need to modify your sshd_config to point to this file. The official docker image will automatically work without further configuration. -- `SSH_AUTHORIZED_PRINCIPALS_ALLOW`: **off** or **username, email**: \[off, username, email, anything\]: Specify the principals values that users are allowed to use as principal. When set to `anything` no checks are done on the principal string. When set to `off` authorized principal are not allowed to be set. -- `SSH_CREATE_AUTHORIZED_PRINCIPALS_FILE`: **false/true**: Gitea will create a authorized_principals file by default when it is not using the internal ssh server and `SSH_AUTHORIZED_PRINCIPALS_ALLOW` is not `off`. -- `SSH_AUTHORIZED_PRINCIPALS_BACKUP`: **false/true**: Enable SSH Authorized Principals Backup when rewriting all keys, default is true if `SSH_AUTHORIZED_PRINCIPALS_ALLOW` is not `off`. -- `SSH_AUTHORIZED_KEYS_COMMAND_TEMPLATE`: **{{.AppPath}} --config={{.CustomConf}} serv key-{{.Key.ID}}**: Set the template for the command to passed on authorized keys. Possible keys are: AppPath, AppWorkPath, CustomConf, CustomPath, Key - where Key is a `models/asymkey.PublicKey` and the others are strings which are shellquoted. -- `SSH_SERVER_CIPHERS`: **chacha20-poly1305@openssh.com, aes128-ctr, aes192-ctr, aes256-ctr, aes128-gcm@openssh.com, aes256-gcm@openssh.com**: For the built-in SSH server, choose the ciphers to support for SSH connections, for system SSH this setting has no effect. -- `SSH_SERVER_KEY_EXCHANGES`: **curve25519-sha256, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1**: For the built-in SSH server, choose the key exchange algorithms to support for SSH connections, for system SSH this setting has no effect. -- `SSH_SERVER_MACS`: **hmac-sha2-256-etm@openssh.com, hmac-sha2-256, hmac-sha1**: For the built-in SSH server, choose the MACs to support for SSH connections, for system SSH this setting has no effect -- `SSH_SERVER_HOST_KEYS`: **ssh/gitea.rsa, ssh/gogs.rsa**: For the built-in SSH server, choose the keypairs to offer as the host key. The private key should be at `SSH_SERVER_HOST_KEY` and the public `SSH_SERVER_HOST_KEY.pub`. Relative paths are made absolute relative to the `APP_DATA_PATH`. If no key exists a 4096 bit RSA key will be created for you. -- `SSH_KEY_TEST_PATH`: **/tmp**: Directory to create temporary files in when testing public keys using ssh-keygen, default is the system temporary directory. -- `SSH_KEYGEN_PATH`: **ssh-keygen**: Path to ssh-keygen, default is 'ssh-keygen' which means the shell is responsible for finding out which one to call. -- `SSH_EXPOSE_ANONYMOUS`: **false**: Enable exposure of SSH clone URL to anonymous visitors, default is false. -- `SSH_PER_WRITE_TIMEOUT`: **30s**: Timeout for any write to the SSH connections. (Set to - -1 to disable all timeouts.) -- `SSH_PER_WRITE_PER_KB_TIMEOUT`: **10s**: Timeout per Kb written to SSH connections. -- `MINIMUM_KEY_SIZE_CHECK`: **true**: Indicate whether to check minimum key size with corresponding type. - -- `OFFLINE_MODE`: **false**: Disables use of CDN for static files and Gravatar for profile pictures. -- `CERT_FILE`: **https/cert.pem**: Cert file path used for HTTPS. When chaining, the server certificate must come first, then intermediate CA certificates (if any). This is ignored if `ENABLE_ACME=true`. Paths are relative to `CUSTOM_PATH`. -- `KEY_FILE`: **https/key.pem**: Key file path used for HTTPS. This is ignored if `ENABLE_ACME=true`. Paths are relative to `CUSTOM_PATH`. -- `STATIC_ROOT_PATH`: **_`StaticRootPath`_**: Upper level of template and static files path. -- `APP_DATA_PATH`: **data** (**/data/gitea** on docker): Default path for application data. Relative paths will be made absolute against _`AppWorkPath`_. -- `STATIC_CACHE_TIME`: **6h**: Web browser cache time for static resources on `custom/`, `public/` and all uploaded avatars. Note that this cache is disabled when `RUN_MODE` is "dev". -- `ENABLE_GZIP`: **false**: Enable gzip compression for runtime-generated content, static resources excluded. -- `ENABLE_PPROF`: **false**: Application profiling (memory and cpu). For "web" command it listens on `localhost:6060`. For "serv" command it dumps to disk at `PPROF_DATA_PATH` as `(cpuprofile|memprofile)__` -- `PPROF_DATA_PATH`: **_`AppWorkPath`_/data/tmp/pprof**: `PPROF_DATA_PATH`, use an absolute path when you start Gitea as service -- `LANDING_PAGE`: **home**: Landing page for unauthenticated users \[home, explore, organizations, login, **custom**\]. Where custom would instead be any URL such as "/org/repo" or even `https://anotherwebsite.com` -- `LFS_START_SERVER`: **false**: Enables Git LFS support. -- `LFS_CONTENT_PATH`: **%(APP_DATA_PATH)s/lfs**: Default LFS content path. (if it is on local storage.) **DEPRECATED** use settings in `[lfs]`. -- `LFS_JWT_SECRET`: **\**: LFS authentication secret, change this a unique string. -- `LFS_HTTP_AUTH_EXPIRY`: **20m**: LFS authentication validity period in time.Duration, pushes taking longer than this may fail. -- `LFS_MAX_FILE_SIZE`: **0**: Maximum allowed LFS file size in bytes (Set to 0 for no limit). -- `LFS_LOCKS_PAGING_NUM`: **50**: Maximum number of LFS Locks returned per page. - -- `REDIRECT_OTHER_PORT`: **false**: If true and `PROTOCOL` is https, allows redirecting http requests on `PORT_TO_REDIRECT` to the https port Gitea listens on. -- `REDIRECTOR_USE_PROXY_PROTOCOL`: **%(USE_PROXY_PROTOCOL)s**: expect PROXY protocol header on connections to https redirector. -- `PORT_TO_REDIRECT`: **80**: Port for the http redirection service to listen on. Used when `REDIRECT_OTHER_PORT` is true. -- `SSL_MIN_VERSION`: **TLSv1.2**: Set the minimum version of ssl support. -- `SSL_MAX_VERSION`: **\**: Set the maximum version of ssl support. -- `SSL_CURVE_PREFERENCES`: **X25519,P256**: Set the preferred curves, -- `SSL_CIPHER_SUITES`: **ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305**: Set the preferred cipher suites. - - If there is no hardware support for AES suites, by default the ChaCha suites will be preferred over the AES suites. - - supported suites as of Go 1.18 are: - - TLS 1.0 - 1.2 cipher suites - - "rsa_with_rc4_128_sha" - - "rsa_with_3des_ede_cbc_sha" - - "rsa_with_aes_128_cbc_sha" - - "rsa_with_aes_256_cbc_sha" - - "rsa_with_aes_128_cbc_sha256" - - "rsa_with_aes_128_gcm_sha256" - - "rsa_with_aes_256_gcm_sha384" - - "ecdhe_ecdsa_with_rc4_128_sha" - - "ecdhe_ecdsa_with_aes_128_cbc_sha" - - "ecdhe_ecdsa_with_aes_256_cbc_sha" - - "ecdhe_rsa_with_rc4_128_sha" - - "ecdhe_rsa_with_3des_ede_cbc_sha" - - "ecdhe_rsa_with_aes_128_cbc_sha" - - "ecdhe_rsa_with_aes_256_cbc_sha" - - "ecdhe_ecdsa_with_aes_128_cbc_sha256" - - "ecdhe_rsa_with_aes_128_cbc_sha256" - - "ecdhe_rsa_with_aes_128_gcm_sha256" - - "ecdhe_ecdsa_with_aes_128_gcm_sha256" - - "ecdhe_rsa_with_aes_256_gcm_sha384" - - "ecdhe_ecdsa_with_aes_256_gcm_sha384" - - "ecdhe_rsa_with_chacha20_poly1305_sha256" - - "ecdhe_ecdsa_with_chacha20_poly1305_sha256" - - TLS 1.3 cipher suites - - "aes_128_gcm_sha256" - - "aes_256_gcm_sha384" - - "chacha20_poly1305_sha256" - - Aliased names - - "ecdhe_rsa_with_chacha20_poly1305" is an alias for "ecdhe_rsa_with_chacha20_poly1305_sha256" - - "ecdhe_ecdsa_with_chacha20_poly1305" is alias for "ecdhe_ecdsa_with_chacha20_poly1305_sha256" -- `ENABLE_ACME`: **false**: Flag to enable automatic certificate management via an ACME capable Certificate Authority (CA) server (default: Lets Encrypt). If enabled, `CERT_FILE` and `KEY_FILE` are ignored, and the CA must resolve `DOMAIN` to this gitea server. Ensure that DNS records are set and either port `80` or port `443` are accessible by the CA server (the public internet by default), and redirected to the appropriate ports `PORT_TO_REDIRECT` or `HTTP_PORT` respectively. -- `ACME_URL`: **\**: The CA's ACME directory URL, e.g. for a self-hosted [smallstep CA server](https://github.com/smallstep/certificates), it can look like `https://ca.example.com/acme/acme/directory`. If left empty, it defaults to using Let's Encerypt's production CA (check `LETSENCRYPT_ACCEPTTOS` as well). -- `ACME_ACCEPTTOS`: **false**: This is an explicit check that you accept the terms of service of the ACME provider. The default is Lets Encrypt [terms of service](https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf). -- `ACME_DIRECTORY`: **https**: Directory that the certificate manager will use to cache information such as certs and private keys. -- `ACME_EMAIL`: **\**: Email used for the ACME registration. Usually it is to notify about problems with issued certificates. -- `ACME_CA_ROOT`: **\**: The CA's root certificate. If left empty, it defaults to using the system's trust chain. -- `ALLOW_GRACEFUL_RESTARTS`: **true**: Perform a graceful restart on SIGHUP -- `GRACEFUL_HAMMER_TIME`: **60s**: After a restart the parent process will stop accepting new connections and will allow requests to finish before stopping. Shutdown will be forced if it takes longer than this time. -- `STARTUP_TIMEOUT`: **0**: Shutsdown the server if startup takes longer than the provided time. On Windows setting this sends a waithint to the SVC host to tell the SVC host startup may take some time. Please note startup is determined by the opening of the listeners - HTTP/HTTPS/SSH. Indexers may take longer to startup and can have their own timeouts. - -## Database (`database`) - -- `DB_TYPE`: **mysql**: The database type in use \[mysql, postgres, mssql, sqlite3\]. -- `HOST`: **127.0.0.1:3306**: Database host address and port or absolute path for unix socket \[mysql, postgres\] (ex: /var/run/mysqld/mysqld.sock). -- `NAME`: **gitea**: Database name. -- `USER`: **root**: Database username. -- `PASSWD`: **\**: Database user password. Use \`your password\` or """your password""" for quoting if you use special characters in the password. -- `SCHEMA`: **\**: For PostgreSQL only, schema to use if different from "public". The schema must exist beforehand, - the user must have creation privileges on it, and the user search path must be set to the look into the schema first - (e.g. `ALTER USER user SET SEARCH_PATH = schema_name,"$user",public;`). -- `SSL_MODE`: **disable**: SSL/TLS encryption mode for connecting to the database. This option is only applied for PostgreSQL and MySQL. - - Valid values for MySQL: - - `true`: Enable TLS with verification of the database server certificate against its root certificate. When selecting this option make sure that the root certificate required to validate the database server certificate (e.g. the CA certificate) is on the system certificate store of both the database and Gitea servers. See your system documentation for instructions on how to add a CA certificate to the certificate store. - - `false`: Disable TLS. - - `disable`: Alias for `false`, for compatibility with PostgreSQL. - - `skip-verify`: Enable TLS without database server certificate verification. Use this option if you have self-signed or invalid certificate on the database server. - - `prefer`: Enable TLS with fallback to non-TLS connection. - - Valid values for PostgreSQL: - - `disable`: Disable TLS. - - `require`: Enable TLS without any verifications. - - `verify-ca`: Enable TLS with verification of the database server certificate against its root certificate. - - `verify-full`: Enable TLS and verify the database server name matches the given certificate in either the `Common Name` or `Subject Alternative Name` fields. -- `SQLITE_TIMEOUT`: **500**: Query timeout for SQLite3 only. -- `SQLITE_JOURNAL_MODE`: **""**: Change journal mode for SQlite3. Can be used to enable [WAL mode](https://www.sqlite.org/wal.html) when high load causes write congestion. See [SQlite3 docs](https://www.sqlite.org/pragma.html#pragma_journal_mode) for possible values. Defaults to the default for the database file, often DELETE. -- `ITERATE_BUFFER_SIZE`: **50**: Internal buffer size for iterating. -- `CHARSET`: **utf8mb4**: For MySQL only, either "utf8" or "utf8mb4". NOTICE: for "utf8mb4" you must use MySQL InnoDB > 5.6. Gitea is unable to check this. -- `PATH`: **data/gitea.db**: For SQLite3 only, the database file path. -- `LOG_SQL`: **true**: Log the executed SQL. -- `DB_RETRIES`: **10**: How many ORM init / DB connect attempts allowed. -- `DB_RETRY_BACKOFF`: **3s**: time.Duration to wait before trying another ORM init / DB connect attempt, if failure occurred. -- `MAX_OPEN_CONNS` **0**: Database maximum open connections - default is 0, meaning there is no limit. -- `MAX_IDLE_CONNS` **2**: Max idle database connections on connection pool, default is 2 - this will be capped to `MAX_OPEN_CONNS`. -- `CONN_MAX_LIFETIME` **0 or 3s**: Sets the maximum amount of time a DB connection may be reused - default is 0, meaning there is no limit (except on MySQL where it is 3s - see #6804 & #7071). -- `AUTO_MIGRATION` **true**: Whether execute database models migrations automatically. - -Please see #8540 & #8273 for further discussion of the appropriate values for `MAX_OPEN_CONNS`, `MAX_IDLE_CONNS` & `CONN_MAX_LIFETIME` and their -relation to port exhaustion. - -## Indexer (`indexer`) - -- `ISSUE_INDEXER_TYPE`: **bleve**: Issue indexer type, currently supported: `bleve`, `db` or `elasticsearch`. -- `ISSUE_INDEXER_CONN_STR`: ****: Issue indexer connection string, available when ISSUE_INDEXER_TYPE is elasticsearch. i.e. http://elastic:changeme@localhost:9200 -- `ISSUE_INDEXER_NAME`: **gitea_issues**: Issue indexer name, available when ISSUE_INDEXER_TYPE is elasticsearch -- `ISSUE_INDEXER_PATH`: **indexers/issues.bleve**: Index file used for issue search; available when ISSUE_INDEXER_TYPE is bleve and elasticsearch. Relative paths will be made absolute against _`AppWorkPath`_. -- The next 4 configuration values are deprecated and should be set in `queue.issue_indexer` however are kept for backwards compatibility: -- `ISSUE_INDEXER_QUEUE_TYPE`: **levelqueue**: Issue indexer queue, currently supports:`channel`, `levelqueue`, `redis`. **DEPRECATED** use settings in `[queue.issue_indexer]`. -- `ISSUE_INDEXER_QUEUE_DIR`: **queues/common**: When `ISSUE_INDEXER_QUEUE_TYPE` is `levelqueue`, this will be the path where the queue will be saved. **DEPRECATED** use settings in `[queue.issue_indexer]`. Relative paths will be made absolute against `%(APP_DATA_PATH)s`. -- `ISSUE_INDEXER_QUEUE_CONN_STR`: **addrs=127.0.0.1:6379 db=0**: When `ISSUE_INDEXER_QUEUE_TYPE` is `redis`, this will store the redis connection string. When `ISSUE_INDEXER_QUEUE_TYPE` is `levelqueue`, this is a directory or additional options of the form `leveldb://path/to/db?option=value&....`, and overrides `ISSUE_INDEXER_QUEUE_DIR`. **DEPRECATED** use settings in `[queue.issue_indexer]`. -- `ISSUE_INDEXER_QUEUE_BATCH_NUMBER`: **20**: Batch queue number. **DEPRECATED** use settings in `[queue.issue_indexer]`. - -- `REPO_INDEXER_ENABLED`: **false**: Enables code search (uses a lot of disk space, about 6 times more than the repository size). -- `REPO_INDEXER_TYPE`: **bleve**: Code search engine type, could be `bleve` or `elasticsearch`. -- `REPO_INDEXER_PATH`: **indexers/repos.bleve**: Index file used for code search. -- `REPO_INDEXER_CONN_STR`: ****: Code indexer connection string, available when `REPO_INDEXER_TYPE` is elasticsearch. i.e. http://elastic:changeme@localhost:9200 -- `REPO_INDEXER_NAME`: **gitea_codes**: Code indexer name, available when `REPO_INDEXER_TYPE` is elasticsearch - -- `REPO_INDEXER_INCLUDE`: **empty**: A comma separated list of glob patterns (see https://github.com/gobwas/glob) to **include** in the index. Use `**.txt` to match any files with .txt extension. An empty list means include all files. -- `REPO_INDEXER_EXCLUDE`: **empty**: A comma separated list of glob patterns (see https://github.com/gobwas/glob) to **exclude** from the index. Files that match this list will not be indexed, even if they match in `REPO_INDEXER_INCLUDE`. -- `REPO_INDEXER_EXCLUDE_VENDORED`: **true**: Exclude vendored files from index. -- `UPDATE_BUFFER_LEN`: **20**: Buffer length of index request. **DEPRECATED** use settings in `[queue.issue_indexer]`. -- `MAX_FILE_SIZE`: **1048576**: Maximum size in bytes of files to be indexed. -- `STARTUP_TIMEOUT`: **30s**: If the indexer takes longer than this timeout to start - fail. (This timeout will be added to the hammer time above for child processes - as bleve will not start until the previous parent is shutdown.) Set to -1 to never timeout. - -## Queue (`queue` and `queue.*`) - -Configuration at `[queue]` will set defaults for queues with overrides for individual queues at `[queue.*]`. (However see below.) - -- `TYPE`: **persistable-channel**: General queue type, currently support: `persistable-channel` (uses a LevelDB internally), `channel`, `level`, `redis`, `dummy` -- `DATADIR`: **queues/**: Base DataDir for storing persistent and level queues. `DATADIR` for individual queues can be set in `queue.name` sections but will default to `DATADIR/`**`common`**. (Previously each queue would default to `DATADIR/`**`name`**.) Relative paths will be made absolute against `%(APP_DATA_PATH)s`. -- `LENGTH`: **20**: Maximal queue size before channel queues block -- `BATCH_LENGTH`: **20**: Batch data before passing to the handler -- `CONN_STR`: **redis://127.0.0.1:6379/0**: Connection string for the redis queue type. Options can be set using query params. Similarly LevelDB options can also be set using: **leveldb://relative/path?option=value** or **leveldb:///absolute/path?option=value**, and will override `DATADIR` -- `QUEUE_NAME`: **_queue**: The suffix for default redis and disk queue name. Individual queues will default to **`name`**`QUEUE_NAME` but can be overridden in the specific `queue.name` section. -- `SET_NAME`: **_unique**: The suffix that will be added to the default redis and disk queue `set` name for unique queues. Individual queues will default to - **`name`**`QUEUE_NAME`_`SET_NAME`_ but can be overridden in the specific `queue.name` section. -- `WRAP_IF_NECESSARY`: **true**: Will wrap queues with a timeoutable queue if the selected queue is not ready to be created - (Only relevant for the level queue.) -- `MAX_ATTEMPTS`: **10**: Maximum number of attempts to create the wrapped queue -- `TIMEOUT`: **GRACEFUL_HAMMER_TIME + 30s**: Timeout the creation of the wrapped queue if it takes longer than this to create. -- Queues by default come with a dynamically scaling worker pool. The following settings configure this: -- `WORKERS`: **0**: Number of initial workers for the queue. -- `MAX_WORKERS`: **10**: Maximum number of worker go-routines for the queue. -- `BLOCK_TIMEOUT`: **1s**: If the queue blocks for this time, boost the number of workers - the `BLOCK_TIMEOUT` will then be doubled before boosting again whilst the boost is ongoing. -- `BOOST_TIMEOUT`: **5m**: Boost workers will timeout after this long. -- `BOOST_WORKERS`: **1**: This many workers will be added to the worker pool if there is a boost. - -Gitea creates the following non-unique queues: - -- `code_indexer` -- `issue_indexer` -- `notification-service` -- `task` -- `mail` -- `push_update` - -And the following unique queues: - -- `repo_stats_update` -- `repo-archive` -- `mirror` -- `pr_patch_checker` - -Certain queues have defaults that override the defaults set in `[queue]` (this occurs mostly to support older configuration): - -- `[queue.issue_indexer]` - - `TYPE` this will default to `[queue]` `TYPE` if it is set but if not it will appropriately convert `[indexer]` `ISSUE_INDEXER_QUEUE_TYPE` if that is set. - - `LENGTH` will default to `[indexer]` `UPDATE_BUFFER_LEN` if that is set. - - `BATCH_LENGTH` will default to `[indexer]` `ISSUE_INDEXER_QUEUE_BATCH_NUMBER` if that is set. - - `DATADIR` will default to `[indexer]` `ISSUE_INDEXER_QUEUE_DIR` if that is set. - - `CONN_STR` will default to `[indexer]` `ISSUE_INDEXER_QUEUE_CONN_STR` if that is set. -- `[queue.mailer]` - - `LENGTH` will default to **100** or whatever `[mailer]` `SEND_BUFFER_LEN` is. -- `[queue.pr_patch_checker]` - - `LENGTH` will default to **1000** or whatever `[repository]` `PULL_REQUEST_QUEUE_LENGTH` is. -- `[queue.mirror]` - - `LENGTH` will default to **1000** or whatever `[repository]` `MIRROR_QUEUE_LENGTH` is. - -## Admin (`admin`) - -- `DEFAULT_EMAIL_NOTIFICATIONS`: **enabled**: Default configuration for email notifications for users (user configurable). Options: enabled, onmention, disabled -- `DISABLE_REGULAR_ORG_CREATION`: **false**: Disallow regular (non-admin) users from creating organizations. - -## Security (`security`) - -- `INSTALL_LOCK`: **false**: Controls access to the installation page. When set to "true", the installation page is not accessible. -- `SECRET_KEY`: **\**: Global secret key. This key is VERY IMPORTANT, if you lost it, the data encrypted by it (like 2FA secret) can't be decrypted anymore. -- `SECRET_KEY_URI`: ****: Instead of defining SECRET_KEY, this option can be used to use the key stored in a file (example value: `file:/etc/gitea/secret_key`). It shouldn't be lost like SECRET_KEY. -- `LOGIN_REMEMBER_DAYS`: **7**: Cookie lifetime, in days. -- `COOKIE_USERNAME`: **gitea\_awesome**: Name of the cookie used to store the current username. -- `COOKIE_REMEMBER_NAME`: **gitea\_incredible**: Name of cookie used to store authentication - information. -- `REVERSE_PROXY_AUTHENTICATION_USER`: **X-WEBAUTH-USER**: Header name for reverse proxy - authentication. -- `REVERSE_PROXY_AUTHENTICATION_EMAIL`: **X-WEBAUTH-EMAIL**: Header name for reverse proxy - authentication provided email. -- `REVERSE_PROXY_AUTHENTICATION_FULL_NAME`: **X-WEBAUTH-FULLNAME**: Header name for reverse proxy - authentication provided full name. -- `REVERSE_PROXY_LIMIT`: **1**: Interpret X-Forwarded-For header or the X-Real-IP header and set this as the remote IP for the request. - Number of trusted proxy count. Set to zero to not use these headers. -- `REVERSE_PROXY_TRUSTED_PROXIES`: **127.0.0.0/8,::1/128**: List of IP addresses and networks separated by comma of trusted proxy servers. Use `*` to trust all. -- `DISABLE_GIT_HOOKS`: **true**: Set to `false` to enable users with Git Hook privilege to create custom Git Hooks. - WARNING: Custom Git Hooks can be used to perform arbitrary code execution on the host operating system. - This enables the users to access and modify this config file and the Gitea database and interrupt the Gitea service. - By modifying the Gitea database, users can gain Gitea administrator privileges. - It also enables them to access other resources available to the user on the operating system that is running the - Gitea instance and perform arbitrary actions in the name of the Gitea OS user. - This maybe harmful to you website or your operating system. - Setting this to true does not change existing hooks in git repos; adjust it before if necessary. -- `DISABLE_WEBHOOKS`: **false**: Set to `true` to disable webhooks feature. -- `ONLY_ALLOW_PUSH_IF_GITEA_ENVIRONMENT_SET`: **true**: Set to `false` to allow local users to push to gitea-repositories without setting up the Gitea environment. This is not recommended and if you want local users to push to Gitea repositories you should set the environment appropriately. -- `IMPORT_LOCAL_PATHS`: **false**: Set to `false` to prevent all users (including admin) from importing local path on server. -- `INTERNAL_TOKEN`: **\**: Secret used to validate communication within Gitea binary. -- `INTERNAL_TOKEN_URI`: ****: Instead of defining INTERNAL_TOKEN in the configuration, this configuration option can be used to give Gitea a path to a file that contains the internal token (example value: `file:/etc/gitea/internal_token`) -- `PASSWORD_HASH_ALGO`: **pbkdf2**: The hash algorithm to use \[argon2, pbkdf2, pbkdf2_v1, pbkdf2_hi, scrypt, bcrypt\], argon2 and scrypt will spend significant amounts of memory. - - Note: The default parameters for `pbkdf2` hashing have changed - the previous settings are available as `pbkdf2_v1` but are not recommended. - - The hash functions may be tuned by using `$` after the algorithm: - - `argon2$