You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This role installs and manages gitea or forgejo. A painless self-hosted Git service. Gitea is a community managed lightweight code hosting solution written in Go. Forgejo is a fork of it.
Source code & screenshots gitea.
Source code forgejo.
This role is also Part of the Ansible-Collection l3d.git. .
The following code has been tested with the latest Debian Stable, it should work on Ubuntu and RedHat as well.
# ansible-galaxy role install l3d.gitea
- name: "Install gitea"hosts: git.example.comroles:
- {role: l3d.gitea, tags: gitea}vars:
# Here we assume we are behind a reverse proxy that will# handle https for us, so we bind on localhost:3000 using HTTP# see https://docs.gitea.io/en-us/reverse-proxies/#nginxgitea_fqdn: 'git.example.com'gitea_root_url: 'https://git.example.com'gitea_protocol: httpgitea_start_ssh: true
Choosing between Gitea's built-in SSH and host SSH Server
Gitea has a built-in SSH server which is running on port 2222 (to not conflict with the host SSH server which usually running on port 22).
This one is used by default in this role and results in a SSH clone URL of gitea@<fqdn>:2222:<user>/<repo>.git because gitea is the default RUN_AS user.
Often enough, one wants to have a "clean" SSH URL like git@<fqdn>:<user>/<repo>.git.
This is possible by using the host SSH server with the following variable configuration:
gitea_ssh_port: 22# assuming the host SSH server is running on port 22gitea_user: git # otherwise there will be permission issuesgitea_start_ssh: false # to not start the built-in SSH server
The above configuration works out of the box for new installations.
When migrating from a running instance with existing SSH keys from the built-in SSH server to the host SSH server, you need to make sure that the host SSH server is running and that the gitea_user has the necessary permissions to access the repository data and the keys (stored in <gitea_home>/.ssh/)
NB: To use git@ as described above, gitea_user must be git and it does not suffice to set gitea_ssh_user: git.
See this issue for more information..
Variables
Here is a deeper insight into the variables of this gitea role. For the exact function of some variables and the possibility to add more options we recommend a look at this config cheat sheet.
Chose between gitea and forgejo
There is a fork of gitea called forgejo. Why? Read the forgejo FAQ.
You have the option to choose between gitea and forgejo by modifying the gitea_fork variable.
variable name
default value
description
gitea_fork
gitea
optional choose to install forgejo instead of gitea by setting this value to forgejo.
gitea update mechanism
To determine which gitea version to install, you can choose between two variants.
Either you define exactly which release you install. Or you use the option latest to always install the latest release from the gitea releases.
Forgejo update mechanism
It is advisable to define exactly which Forgejo release you want to install. See Forgejo releases for the correct value to use in gitea_version eg v1.21.5.
This is because the Forgejo project maintains both stable and old stable releases and the latest tag will refer to the most recent release regardless of whether it is stable or old stable. This can lead to a situation where latest refers to an older release than the version you have installed.
gitea update
variable name
default value
description
gitea_version
latest
Define either the exact release to install (eg. 1.16.0) or use latest(default) to install the latest release.
gitea_version_check
true
Check if installed version != gitea_version before initiating binary download
gitea_gpg_key
7C9E68152594688862D62AF62D9AE806EC1592E2
the gpg key the gitea binary is signed with
gitea_forgejo_gpg_key
EB114F5E6C0DC2BCDD183550A4B61A2DC5923710
the gpg key the forgejo binary is signed with
gitea_gpg_server
hkps://keys.openpgp.org
A gpg key server where this role can download the gpg key
gitea_backup_on_upgrade
false
Optionally a backup can be created with every update of gitea.
gitea_backup_location
{{ gitea_home }}/backups/
Where to store the gitea backup if one is created with this role.
submodules_versioncheck
false
a simple version check that can prevent you from accidentally running an older version of this role. (recomended)
gitea in the linux world
variable name
default value
description
gitea_group
gitea
Primary UNIX group used by Gitea
gitea_groups
null
Optionally a list of secondary UNIX groups used by Gitea
gitea_home
/var/lib/gitea
Base directory to work
gitea_user_home
{{ gitea_home }}
home of gitea user
gitea_executable_path
/usr/local/bin/gitea
Path for gitea executable
gitea_forgejo_executable_path
/usr/local/bin/forgejo
Path for forgejo executable
gitea_configuration_path
/etc/gitea
Where to put the gitea.ini config
gitea_shell
/bin/false
UNIX shell used by gitea. Set it to /bin/bash if you don't use the gitea built-in ssh server.
gitea_systemd_cap_net_bind_service
false
Adds AmbientCapabilities=CAP_NET_BIND_SERVICE to systemd service file
Whether issue and pull request attachments are enabled.
gitea_attachment_types
see Docs
Comma-separated list of allowed file extensions (.zip,.txt), mime types (text/plain) or wildcard type (image/*, audio/*, video/*). Empty value or */* allows all types.
gitea_attachment_max_size
4
Maximum size (MB).
gitea_attachment_extra_config
you can use this variable to pass additional config parameters in the [attachment] section of the config.
Show Gitea and Go version information in the footer.
gitea_other_show_footer_template_load_time
true
Show time of template execution in the footer.
gitea_other_enable_sitemap
true
Generate sitemap.
gitea_other_enable_feed
true
Enable/Disable RSS/Atom feed.
additional gitea config
variable name
default value
description
gitea_extra_config
Additional gitea configuration. Have a look at the config-cheat-sheet before using it!
Fail2Ban configuration
If enabled, this will deploy a fail2ban filter and jail config for Gitea as described in the Gitea Documentation.
As this will only deploy config files, fail2ban already has to be installed or otherwise the role will fail.
variable name
default value
description
gitea_fail2ban_enabled
false
Whether to deploy the fail2ban config or not
gitea_fail2ban_jail_maxretry
10
fail2ban jail maxretry setting.
gitea_fail2ban_jail_findtime
3600
fail2ban jail findtime setting.
gitea_fail2ban_jail_bantime
900
fail2ban jail bantime setting.
gitea_fail2ban_jail_action
iptables-allports
fail2ban jail action setting.
local gitea Users
variable
option
description
gitea_users
dict to create local gitea or forgejo users
name
name for local gitea/forgejo user
password
user for local git user
email
email for local git user
admin
give user admin permissions
must_change_password
user should change password after first login
state
set to absent to delete user
optional customisation
You can optionally customize your gitea using this ansible role. We got our information about customisation from docs.gitea.io/en-us/customizing-gitea.
To deploy multiple files we created the gitea_custom_search variable, that can point to the path where you put the custom gitea files ( default "files/host_files/{{ inventory_hostname }}/gitea").
LOGO:
Set gitea_customize_logo to true
We search for:
logo.svg - Used for favicon, site icon, app icon
logo.png - Used for Open Graph
favicon.png - Used as fallback for browsers that don’t support SVG favicons
apple-touch-icon.png - Used on iOS devices for bookmarks
Set gitea_themes variable and include the names of the new themes. To keep the existing ones, you need to pass all themes names, e.g. auto,gitea,arc-green,<custom-auto>,<custom-light>,<custom-dark>
Requirements
This role uses the ansible.builtin and community.general ansible Collections. To download the latest forgejo/gitea release we use json_query. This requires jmespath to be available.
Don't hesitate to create a pull request, and if in doubt you can reach me at
Mastodon @[email protected].
I'll be happy to fix any issues you raise, or even better, review your pull requests :)
History of this role
this ansible role was originally developed on github.com/thomas-maurice/ansible-role-gitea. Since the role there has some problems like default values for the location of the gitea repositories and the merging of pull requests usually takes several months, a fork of the role was created that offers the same. Only tidier and with the claim to react faster to issues and pull requests. It is now Part of the l3d.git Collection too.