Initial version of the Forgejo via. Cloudflare
This commit is contained in:
parent
8cfd9751e2
commit
9e3a8d6395
4 changed files with 201 additions and 1 deletions
10
README.md
10
README.md
|
@ -1 +1,9 @@
|
||||||
# Hello, World!
|
# Docker Sample Repository
|
||||||
|
|
||||||
|
This repository is a collection of Docker Compose examples for various self-hosted services. Installing/configuring internet-facing systems is complex and comes with risk. These samples strive to be self-contained and give a good starting point to get you up and running quickly. They are not intended to be bullet-proof production grade ready-to-rock examples. As such, these are provided without any warranty / use at your own risk.
|
||||||
|
|
||||||
|
To make services easier to manage (backup, restore, move to a different host, etc.), they typically use bind-mounts to store data in a subdirectory (typically `./data`) alongside the `docker-compose.yml` and `.env` files, rather than Docker Volumes.
|
||||||
|
|
||||||
|
Similarly, many examples here rely on Cloudflare Tunnels for publicly exposing services, and Tailscale for internal services.
|
||||||
|
|
||||||
|
In most cases, minimal changes should be required to the `docker-compose.yml` file, while the bulk of the changes will be to the `.env` file.
|
||||||
|
|
36
forgejo_cloudflare/.env
Normal file
36
forgejo_cloudflare/.env
Normal file
|
@ -0,0 +1,36 @@
|
||||||
|
FORGEJO_TAG=8
|
||||||
|
FORGEJO_RUNNER_TAG=4.0.1
|
||||||
|
|
||||||
|
# Instance Settings
|
||||||
|
APP_NAME="My Git Server"
|
||||||
|
FORGEJO_HOSTNAME=git.yourdomain.com
|
||||||
|
SSH_DOMAIN=git-ssh.yourdomain.com
|
||||||
|
DISABLE_REGISTRATION=true
|
||||||
|
|
||||||
|
ROOT_URL=https://${FORGEJO_HOSTNAME}
|
||||||
|
|
||||||
|
# Cloudflare Tunnel Token
|
||||||
|
TUNNEL_TOKEN= ##REQUIRED##
|
||||||
|
|
||||||
|
# Database
|
||||||
|
FORGEJO_DB_PASSWORD= ##REQUIRED##
|
||||||
|
|
||||||
|
# Mail
|
||||||
|
MAIL_ENABLED=true
|
||||||
|
MAIL_FROM='"Git Server" <noreply@mg.yourdomain.com>'
|
||||||
|
MAIL_SMTP_USER=forgejo@mg.yourdomain.com
|
||||||
|
MAIL_SMTP_PASSWD= ##REQUIRED##
|
||||||
|
MAIL_SMTP_PROTOCOL=smtps
|
||||||
|
MAIL_SMTP_ADDR=smtp.mailgun.org
|
||||||
|
MAIL_SMTP_PORT=465
|
||||||
|
|
||||||
|
# Initial user
|
||||||
|
ROOT_USER=admin
|
||||||
|
ROOT_EMAIL=admin@yourdomain.com
|
||||||
|
ROOT_PASSWORD= ##REQUIRED##
|
||||||
|
|
||||||
|
# Token for runner (generate with `openssl rand -hex 20`)
|
||||||
|
SHARED_SECRET= ##REQUIRED##
|
||||||
|
|
||||||
|
# Runner name / labels
|
||||||
|
RUNNER_NAME=runner
|
32
forgejo_cloudflare/README.md
Normal file
32
forgejo_cloudflare/README.md
Normal file
|
@ -0,0 +1,32 @@
|
||||||
|
# Forgejo via. Cloudflare Tunnel
|
||||||
|
|
||||||
|
This example is a quick start to running an instance of the excellent Forgejo git server under Docker.
|
||||||
|
|
||||||
|
* Publicly exposed via. Cloudflare Tunnel
|
||||||
|
* Pre-configured Github Action-style Runners
|
||||||
|
* Mail delivery (assuming Mailgun, but adjustable to any SMTP server)
|
||||||
|
* Pre-configured (no installation wizard) including admin account
|
||||||
|
|
||||||
|
See the full blog post on this here:
|
||||||
|
https://www.straybits.ca/2014/self-hosted-git-server/
|
||||||
|
|
||||||
|
## Steps:
|
||||||
|
|
||||||
|
0. Create a Tunnel on Cloudflare and grab the Tunnel Token
|
||||||
|
1. Copy `docker-compose.yml` and `.env` to a new folder
|
||||||
|
2. Update variables in `.env` making sure to generate random secrets for the various secrets marked with `##REQUIRED##`
|
||||||
|
3. Make sure to update the `yourdomain.com` to match your name
|
||||||
|
4. Add end points to your Tunnel
|
||||||
|
1. `git.yourdomain.com` >> `http://server:3000`
|
||||||
|
2. `git-ssh.yourdomain.com` >> `ssh://server:22`
|
||||||
|
5. `docker compose up -d`
|
||||||
|
6. Wait...
|
||||||
|
7. Wait a bit more
|
||||||
|
8. Visit `https://git.yourdomain.com` in your browser and login with the admin credentials in your `.env` file.
|
||||||
|
9. Verify settings. (i.e. do you want to disable user signups, etc.)
|
||||||
|
|
||||||
|
## Known Issue
|
||||||
|
|
||||||
|
### Disappearing Runner Labels
|
||||||
|
|
||||||
|
If your runner labels disappear after a restart, you may need to update your runner's `config.yml` to have the same list of runners as found in your `.runner` file.
|
124
forgejo_cloudflare/docker-compose.yml
Normal file
124
forgejo_cloudflare/docker-compose.yml
Normal file
|
@ -0,0 +1,124 @@
|
||||||
|
services:
|
||||||
|
|
||||||
|
tunnel:
|
||||||
|
image: cloudflare/cloudflared
|
||||||
|
command: tunnel --no-autoupdate run
|
||||||
|
restart: unless-stopped
|
||||||
|
environment:
|
||||||
|
- TUNNEL_TOKEN=${TUNNEL_TOKEN}
|
||||||
|
|
||||||
|
server:
|
||||||
|
image: codeberg.org/forgejo/forgejo:${FORGEJO_TAG}
|
||||||
|
command: >-
|
||||||
|
bash -c '
|
||||||
|
/bin/s6-svscan /etc/s6 &
|
||||||
|
sleep 10 ;
|
||||||
|
su -c "forgejo forgejo-cli actions register --secret ${SHARED_SECRET}" git ;
|
||||||
|
su -c "forgejo admin user create --admin --username ${ROOT_USER} --password ${ROOT_PASSWORD} --email ${ROOT_EMAIL}" git ;
|
||||||
|
sleep infinity
|
||||||
|
'
|
||||||
|
environment:
|
||||||
|
# https://forgejo.org/docs/latest/admin/config-cheat-sheet/
|
||||||
|
- RUN_MODE=prod
|
||||||
|
- USER_UID=1000
|
||||||
|
- USER_GID=1000
|
||||||
|
- APP_NAME=${APP_NAME}
|
||||||
|
- FORGEJO__server__ROOT_URL=${ROOT_URL}
|
||||||
|
# Because we're using Cloudflare, we need the SSH domain
|
||||||
|
# to be on a different name, like `git-ssh.yourname.com` so
|
||||||
|
# we override the SSH Domain
|
||||||
|
- FORGEJO__server__SSH_DOMAIN=${SSH_DOMAIN}
|
||||||
|
# Prevent the installation wizard from running
|
||||||
|
- FORGEJO__security__INSTALL_LOCK=true
|
||||||
|
# Do we allow new signups?
|
||||||
|
- FORGEJO__service__DISABLE_REGISTRATION=${DISABLE_REGISTRATION}
|
||||||
|
# DB Setup
|
||||||
|
- FORGEJO__database__DB_TYPE=postgres
|
||||||
|
- FORGEJO__database__HOST=db:5432
|
||||||
|
- FORGEJO__database__NAME=gitea
|
||||||
|
- FORGEJO__database__USER=gitea
|
||||||
|
- FORGEJO__database__PASSWD=${FORGEJO_DB_PASSWORD}
|
||||||
|
# Mail Setup
|
||||||
|
- FORGEJO__mailer__ENABLED=${MAIL_ENABLED}
|
||||||
|
- FORGEJO__mailer__FROM=${MAIL_FROM}
|
||||||
|
- FORGEJO__mailer__PROTOCOL=${MAIL_SMTP_PROTOCOL}
|
||||||
|
- FORGEJO__mailer__SMTP_ADDR=${MAIL_SMTP_ADDR}
|
||||||
|
- FORGEJO__mailer__SMTP_PORT=${MAIL_SMTP_PORT}
|
||||||
|
- FORGEJO__mailer__USER=${MAIL_SMTP_USER}
|
||||||
|
- FORGEJO__mailer__PASSWD=${MAIL_SMTP_PASSWD}
|
||||||
|
# Git rid of the splash screen and just show a project listing
|
||||||
|
# on the homepage
|
||||||
|
- FORGEJO__server__LANDING_PAGE=explore
|
||||||
|
restart: always
|
||||||
|
volumes:
|
||||||
|
- ./data/data:/data
|
||||||
|
- /etc/timezone:/etc/timezone:ro
|
||||||
|
- /etc/localtime:/etc/localtime:ro
|
||||||
|
depends_on:
|
||||||
|
- db
|
||||||
|
|
||||||
|
db:
|
||||||
|
image: postgres:13
|
||||||
|
restart: always
|
||||||
|
environment:
|
||||||
|
- POSTGRES_USER=gitea
|
||||||
|
- POSTGRES_PASSWORD=${FORGEJO_DB_PASSWORD}
|
||||||
|
- POSTGRES_DB=gitea
|
||||||
|
volumes:
|
||||||
|
- ./data/postgres:/var/lib/postgresql/data
|
||||||
|
|
||||||
|
# Runner configuration is fairly complex and uses Docker-in-Docker
|
||||||
|
# Pulled from this example:
|
||||||
|
# https://code.forgejo.org/forgejo/runner/src/branch/main/examples/docker-compose/compose-forgejo-and-runner.yml
|
||||||
|
|
||||||
|
runner-register:
|
||||||
|
image: code.forgejo.org/forgejo/runner:${FORGEJO_RUNNER_TAG}
|
||||||
|
links:
|
||||||
|
- docker-in-docker
|
||||||
|
- server
|
||||||
|
environment:
|
||||||
|
DOCKER_HOST: tcp://docker-in-docker:2376
|
||||||
|
volumes:
|
||||||
|
- ./data/runner-data:/data
|
||||||
|
user: 0:0
|
||||||
|
command: >-
|
||||||
|
bash -ec '
|
||||||
|
while : ; do
|
||||||
|
forgejo-runner create-runner-file --connect --instance http://server:3000 --name ${RUNNER_NAME} --secret ${SHARED_SECRET} && break ;
|
||||||
|
sleep 1 ;
|
||||||
|
done ;
|
||||||
|
sed -i -e "s|\"labels\": null|\"labels\": [\"docker:docker://code.forgejo.org/oci/node:20-bookworm\", \"ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04\"]|" .runner ;
|
||||||
|
forgejo-runner generate-config > config.yml ;
|
||||||
|
sed -i -e "s|network: .*|network: host|" config.yml ;
|
||||||
|
sed -i -e "s|^ envs:$$| envs:\n DOCKER_HOST: tcp://docker:2376\n DOCKER_TLS_VERIFY: 1\n DOCKER_CERT_PATH: /certs/client|" config.yml ;
|
||||||
|
sed -i -e "s|^ options:| options: -v /certs/client:/certs/client|" config.yml ;
|
||||||
|
sed -i -e "s| valid_volumes: \[\]$$| valid_volumes:\n - /certs/client|" config.yml ;
|
||||||
|
chown -R 1000:1000 /data
|
||||||
|
'
|
||||||
|
|
||||||
|
runner-daemon:
|
||||||
|
image: code.forgejo.org/forgejo/runner:4.0.1
|
||||||
|
links:
|
||||||
|
- docker-in-docker
|
||||||
|
- server
|
||||||
|
environment:
|
||||||
|
DOCKER_HOST: tcp://docker:2376
|
||||||
|
DOCKER_CERT_PATH: /certs/client
|
||||||
|
DOCKER_TLS_VERIFY: "1"
|
||||||
|
volumes:
|
||||||
|
- ./data/runner-data:/data
|
||||||
|
- ./data/docker_certs:/certs
|
||||||
|
command: >-
|
||||||
|
bash -c '
|
||||||
|
while : ; do test -w .runner && forgejo-runner --config config.yml daemon ; sleep 1 ; done
|
||||||
|
'
|
||||||
|
|
||||||
|
docker-in-docker:
|
||||||
|
image: docker:dind
|
||||||
|
hostname: docker # Must set hostname as TLS certificates are only valid for docker or localhost
|
||||||
|
privileged: true
|
||||||
|
environment:
|
||||||
|
DOCKER_TLS_CERTDIR: /certs
|
||||||
|
DOCKER_HOST: docker-in-docker
|
||||||
|
volumes:
|
||||||
|
- ./data/docker_certs:/certs
|
Loading…
Reference in a new issue