first sync

.env

@@ -1 +1,34 @@
-# Template
+
+# Postgre Variables
+POSTGRES_IMAGE_TAG=postgres:15.6-alpine
+POSTGRE_DB_NAME=gitea_db
+POSTGRE_DB_USER=gitea_user
+POSTGRE_DB_PASSWORD=P@ssword!Here!123456
+POSTGRE_DB_DATA=/var/lib/postgresql/data/gitea
+
+# Gitea Variables
+GITEA_IMAGE_TAG=gitea/gitea:latest
+GITEA_ADMIN_USERNAME=giteaadmin
+GITEA_ADMIN_PASSWORD=P@ssword!Here!123456
+GITEA_ADMIN_EMAIL=admin@tips-of-mine.fr
+GITEA_NOREPLY_EMAIL=noreply@tips-of-mine.fr
+GITEA_URL=https://gitea.tips-of-mine.com/
+GITEA_HOSTNAME=gitea.tips-of-mine.com
+GITEA_SSH_PORT=22
+GITEA_HTTP_PORT=3000
+GITEA_SSH_LISTEN_PORT=22
+
+
+# Adminer Variables
+ADMINER_IMAGE_TAG=adminer:latest
+
+# Backup Variables
+BACKUP_INIT_SLEEP=30m
+BACKUP_INTERVAL=24h
+POSTGRES_BACKUP_PRUNE_DAYS=7
+DATA_BACKUP_PRUNE_DAYS=7
+POSTGRES_BACKUPS_PATH=/srv/gitea-postgres/backups
+DATA_BACKUPS_PATH=/srv/gitea-application-data/backups
+DATA_PATH=/bitnami/gitea
+POSTGRES_BACKUP_NAME=gitea-postgres-backup
+DATA_BACKUP_NAME=gitea-application-data-backup

config.yaml

@@ -0,0 +1,101 @@
+# Example configuration file, it's safe to copy this as the default config file without any modification.
+
+# You don't have to copy this file to your instance,
+# just run `./act_runner generate-config > config.yaml` to generate a config file.
+
+log:
+  # The level of logging, can be trace, debug, info, warn, error, fatal
+  level: debug
+
+runner:
+  # Where to store the registration result.
+  file: .runner
+  # Execute how many tasks concurrently at the same time.
+  capacity: 1
+  # Extra environment variables to run jobs.
+  envs:
+    A_TEST_ENV_NAME_1: a_test_env_value_1
+    A_TEST_ENV_NAME_2: a_test_env_value_2
+  # Extra environment variables to run jobs from a file.
+  # It will be ignored if it's empty or the file doesn't exist.
+  env_file: .env
+  # The timeout for a job to be finished.
+  # Please note that the Gitea instance also has a timeout (3h by default) for the job.
+  # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
+  timeout: 3h
+  # Whether skip verifying the TLS certificate of the Gitea instance.
+  #insecure: false
+  insecure: true
+  # The timeout for fetching the job from the Gitea instance.
+  fetch_timeout: 5s
+  # The interval for fetching the job from the Gitea instance.
+  fetch_interval: 2s
+  # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
+  # Like: "macos-arm64:host" or "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
+  # Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
+  # If it's empty when registering, it will ask for inputting labels.
+  # If it's empty when execute `daemon`, will use labels in `.runner` file.
+  labels:
+    #- "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
+    #- "ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04"
+    #- "ubuntu-20.04:docker://gitea/runner-images:ubuntu-20.04"
+    #- "ubuntu-20.04:docker://gnu96/default-image:ubuntu-20-04-rc-01"
+    - "ubuntu-20.04:docker://registry.traefik.me/gitea/default-image:ubuntu-20.04"
+
+cache:
+  # Enable cache server to use actions/cache.
+  enabled: true
+  # The directory to store the cache data.
+  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
+    dir: ""
+  # The host of the cache server.
+  # It's not for the address to listen, but the address to connect from job containers.
+  # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
+  host: ""
+  # The port of the cache server.
+  # 0 means to use a random available port.
+  port: 0
+  # The external cache server URL. Valid only when enable is true.
+  # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
+  # The URL should generally end with "/".
+  external_server: ""
+
+container:
+  # Specifies the network to which the container will connect.
+  # Could be host, bridge or the name of a custom network.
+  # If it's empty, act_runner will create a network automatically.
+  network: ""
+  # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
+  privileged: false
+  # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
+  options: --mount type=bind,source=/etc/ssl/certs,target=/etc/ssl/certs,readonly
+  # The parent directory of a job's working directory.
+  # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically.
+  # If the path starts with '/', the '/' will be trimmed.
+  # For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
+  # If it's empty, /workspace will be used.
+  workdir_parent:
+  # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
+  # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
+  # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
+  # valid_volumes:
+  #   - data
+  #   - /src/*.json
+  # If you want to allow any volume, please use the following configuration:
+  # valid_volumes:
+  #   - '**'
+  valid_volumes: ['/etc/ssl/certs']
+  # overrides the docker client host with the specified one.
+  # If it's empty, act_runner will find an available docker host automatically.
+  # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
+  # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
+  docker_host: ""
+  # Pull docker image(s) even if already present
+  force_pull: true
+  # Rebuild docker image(s) even if already present
+  force_rebuild: true
+
+host:
+  # The parent directory of a job's working directory.
+  # If it's empty, $HOME/.cache/act/ will be used.
+  workdir_parent:

docker-compose.yml

@@ -2,41 +2,251 @@
 networks:
   traefik_front_network:
     external: true
-  back_network_:
+  back_network_gitea:
     driver: bridge
     attachable: true
 
 #### SERVICES
 services:
-### hello_world
+  gitea:
-  hello_world:
     container_name: gitea-app
     hostname: gitea-app
-    image: hello-world
+    image: ${GITEA_IMAGE_TAG}
     environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - GITEA__database__DB_TYPE=postgres
+      - GITEA__database__HOST=postgres:5432
+      - GITEA__database__NAME=${POSTGRE_DB_NAME}
+      - GITEA__database__USER=${POSTGRE_DB_USER}
+      - GITEA__database__PASSWD=${POSTGRE_DB_PASSWORD}
+      - GITEA__database__LOG_SQL=true
+      - GITEA__database__SCHEMA=public
+      - GITEA__database__SSL_MODE=disable
+      - GITEA__mailer__ENABLED=true
+      - GITEA__mailer__FROM=hostinfo@tips-of-mine.fr
+      - GITEA__mailer__PROTOCOL=smtp
+      - GITEA__mailer__SMTP_ADDR=gitea-msmtpd
+      - GITEA__mailer__SMTP_PORT=2500
+      - GITEA__mailer__USER=
+      - GITEA__mailer__PASSWD=
+      - GITEA__admin__USER=${GITEA_ADMIN_USERNAME}
+      - GITEA__admin__PASSWORD=${GITEA_ADMIN_PASSWORD}
+      - GITEA__admin__EMAIL=${GITEA_ADMIN_EMAIL}
+      - GITEA__server__DOMAIN=${GITEA_HOSTNAME}
+      - GITEA__server__SSH_DOMAIN=${GITEA_HOSTNAME}
+      - GITEA__server__ROOT_URL=${GITEA_URL}
+      - GITEA__server__HTTP_PORT=${GITEA_HTTP_PORT}
+      - GITEA__server__SSH_PORT=${GITEA_SSH_PORT}
+      - GITEA__server__SSH_LISTEN_PORT=${GITEA_SSH_LISTEN_PORT}
+      - GITEA__server__DISABLE_SSH=false
+      - GITEA__server__START_SSH_SERVER=false
+      - GITEA__server__OFFLINE_MODE=false
+      - GITEA__repository__USE_COMPAT_SSH_URI=false
+      - GITEA__repository__DEFAULT_BRANCH=main
+      - GITEA__actions__ENABLED=true
+      - GITEA__metrics__ENABLED=true
+      - GITEA__metrics__ENABLED_ISSUE_BY_REPOSITORY=true
+            - GITEA__metrics__ENABLED_ISSUE_BY_LABEL=true
+      - GITEA__service__DISABLE_REGISTRATION=false
+      - GITEA__service__REQUIRE_SIGNIN_VIEW=false
+      - GITEA__service__REGISTER_EMAIL_CONFIRM=true
+      - GITEA__service__ENABLE_NOTIFY_MAIL=true
+      - GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=false
+      - GITEA__service__ENABLE_CAPTCHA=true
+      - GITEA__service__DEFAULT_KEEP_EMAIL_PRIVATE=false
+      - GITEA__service__DEFAULT_ALLOW_CREATE_ORGANIZATION=false
+      - GITEA__service__DEFAULT_ENABLE_TIMETRACKING=true
+      - GITEA__service__NO_REPLY_ADDRESS=${GITEA_NOREPLY_EMAIL}
+      - GITEA__RUN_MODE=prod
+      - GITEA__APP_NAME=Gitea
     restart: always
     networks:
-#      - back_network_gitea
+      - back_network_gitea
       - traefik_front_network
     volumes:
+      - ./gitea:/data:rw
+      - ./custom:/app/gitea/custom:rw
+      - ./log:/app/gitea/log:rw
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+#    ports:
+#      - "3080:3000"
+#      - "222:222"
+    depends_on:
+      postgres:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://gitea.tips-of-mine.com/"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 90s
     labels:
       - "traefik.enable=true"
       - "traefik.docker.network=traefik_front_network"
 # HTTP
-      - "traefik.http.routers.hello-world-http.rule=Host(`hello-world.tips-of-mine.com`)"
+      - "traefik.http.routers.gitea-http.rule=Host(`gitea.tips-of-mine.com`)"
-      - "traefik.http.routers.hello-world-http.entrypoints=http"
+      - "traefik.http.routers.gitea-http.entrypoints=http"
-      - "traefik.http.routers.hello-world-http.priority=49"
+      - "traefik.http.routers.gitea-http.priority=49"
 # HTTPS
-      - "traefik.http.routers.hello-world-https.rule=Host(`hello-world.tips-of-mine.com`)"
+      - "traefik.http.routers.gitea-https.rule=Host(`gitea.tips-of-mine.com`)"
-      - "traefik.http.routers.hello-world-https.entrypoints=https"
+      - "traefik.http.routers.gitea-https.entrypoints=https"
-      - "traefik.http.routers.hello-world-https.tls=true"
+      - "traefik.http.routers.gitea-https.tls=true"
-      - "traefik.http.routers.hello-world-https.priority=50"
+      - "traefik.http.routers.gitea-https.priority=50"
       - "traefik.http.routers.gitea.service=gitea-https-service"
+# SSH
+      - "traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)"
+      - "traefik.tcp.routers.gitea-ssh.entrypoints=ssh"
+      - "traefik.tcp.routers.gitea-ssh.service=gitea-ssh-service"
 # Middleware
 # Service
-#      - "traefik.http.services.gitea-https-service.loadbalancer.server.port=3000"
+      - "traefik.http.services.gitea-https-service.loadbalancer.server.port=3000"
 #      - "traefik.http.services.gitea-https-service.loadbalancer.server.scheme=https"
 #      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.hostname=gitea.traefik.me"
 #      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.method=foobar"
 #      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.timeout=10"
 #      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.interval=30"
+      - "traefik.tcp.services.gitea-ssh-service.loadbalancer.server.port=22"
+#      - "traefik.tcp.services.gitea-ssh-service.loadbalancer.server.tls=true"
+
+### postgres
+  postgres:
+    container_name: gitea-postgres
+    hostname: gitea-postgres
+    image: ${POSTGRES_IMAGE_TAG}
+    environment:
+      PGDATA: ${POSTGRE_DB_DATA}
+      POSTGRES_DB: ${POSTGRE_DB_NAME}
+      POSTGRES_PASSWORD: ${POSTGRE_DB_PASSWORD}
+      POSTGRES_USER: ${POSTGRE_DB_USER}
+      TZ: Europe/Paris
+    restart: unless-stopped
+    networks:
+      - back_network_gitea
+    volumes:
+      - ./data:/var/lib/postgresql/data:rw
+    healthcheck:
+      test: [ "CMD", "pg_isready", "-q", "-d", "${POSTGRE_DB_NAME}", "-U", "${POSTGRE_DB_USER}" ]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 60s
+
+### adminer
+#  adminer:
+#    container_name: gitea-adminer
+#    hostname: gitea-adminer
+#    image: ${ADMINER_IMAGE_TAG}
+#    restart: always
+#    networks:
+#    - back_network
+#    - traefik_front_network
+#    depends_on:
+#      postgres:
+#        condition: service_healthy
+#    labels:
+#      - "traefik.enable=true"
+#      - "traefik.docker.network=traefik_front_network"
+# HTTP
+#      - "traefik.http.routers.adminer-http.rule=Host(`gitea-adminer.traefik.me`)"
+#      - "traefik.http.routers.adminer-http.entrypoints=http"
+# HTTPS
+#      - "traefik.http.routers.adminer-https.rule=Host(`gitea-adminer.traefik.me`)"
+#      - "traefik.http.routers.adminer-https.entrypoints=https"
+#      - "traefik.http.routers.adminer-https.tls=true"
+#      - "traefik.http.routers.adminer.service=adminer-service"
+# Middleware
+# Service
+#      - "traefik.http.services.adminer-service.loadbalancer.server.port=8080"
+
+### backups
+  backups:
+    container_name: gitea-postgres-backup
+    hostname: gitea-postgres-backup
+    image: ${POSTGRES_IMAGE_TAG}
+    command: >-
+      sh -c 'sleep $BACKUP_INIT_SLEEP &&
+      while true; do
+        pg_dump -h postgres -p 5432 -d $POSTGRE_DB_NAME -U $POSTGRE_DB_USER | gzip > $POSTGRES_BACKUPS_PATH/$POSTGRES_BACKUP_NAME-$(date "+%Y-%m-%d_%H-%M").gz &&
+        tar -zcpf $DATA_BACKUPS_PATH/$DATA_BACKUP_NAME-$(date "+%Y-%m-%d_%H-%M").tar.gz $DATA_PATH &&
+        find $POSTGRES_BACKUPS_PATH -type f -mtime +$POSTGRES_BACKUP_PRUNE_DAYS | xargs rm -f &&
+        find $DATA_BACKUPS_PATH -type f -mtime +$DATA_BACKUP_PRUNE_DAYS | xargs rm -f;
+        sleep $BACKUP_INTERVAL; done'
+    environment:
+      GITEA_DB_NAME: ${POSTGRE_DB_NAME}
+      GITEA_DB_USER: ${POSTGRE_DB_USER}
+      PGPASSWORD: ${POSTGRE_DB_PASSWORD}
+      BACKUP_INIT_SLEEP: ${BACKUP_INIT_SLEEP}
+      BACKUP_INTERVAL: ${BACKUP_INTERVAL}
+      POSTGRES_BACKUP_PRUNE_DAYS: ${POSTGRES_BACKUP_PRUNE_DAYS}
+      DATA_BACKUP_PRUNE_DAYS: ${DATA_BACKUP_PRUNE_DAYS}
+      POSTGRES_BACKUPS_PATH: ${POSTGRES_BACKUPS_PATH}
+      DATA_BACKUPS_PATH: ${DATA_BACKUPS_PATH}
+      DATA_PATH: ${DATA_PATH}
+      POSTGRES_BACKUP_NAME: ${POSTGRES_BACKUP_NAME}
+      DATA_BACKUP_NAME: ${DATA_BACKUP_NAME}
+    restart: unless-stopped
+    networks:
+      - back_network_gitea
+    volumes:
+      - ./backup/data:/var/lib/postgresql/data
+      - ./backup/gitea:${DATA_PATH}
+      - ./backup/backups:${DATA_BACKUPS_PATH}
+      - ./backup/database:${POSTGRES_BACKUPS_PATH}
+    depends_on:
+      postgres:
+        condition: service_healthy
+
+### runner
+  runner:
+    container_name: gitea-runner
+    hostname: gitea-runner
+    image: gitea/act_runner:latest
+    environment:
+      - GITEA_INSTANCE_URL=${GITEA_URL}
+      - GITEA_RUNNER_REGISTRATION_TOKEN=v1bOsBNZeoJ0P3fGHsyEoqxcpBoLc8xTBByhnB5I
+      - GITEA_RUNNER_NAME=gitea-runner
+    restart: unless-stopped
+    networks:
+      - back_network_gitea
+    volumes:
+#      - ./data-runner:/data
+      - /etc/ssl/certs/:/etc/ssl/certs:ro
+#      - ./data-runner/cache:/root/.cache
+#      - ./config.yaml:/config.yaml
+      - /var/run/docker.sock:/var/run/docker.sock
+    privileged: true
+    depends_on:
+      gitea:
+        condition: service_healthy
+
+### msmtpd
+  msmtpd:
+    container_name: gitea-msmtpd
+    hostname: gitea-msmtpd
+    image: crazymax/msmtpd:latest
+    networks:
+    - back_network_gitea
+#    ports:
+#      - 2500:2500
+    environment:
+      - "TZ=Europe/Paris"
+      - "PUID=1500"
+      - "PGID=1500"
+      - "SMTP_HOST=10.0.4.52"
+      - "SMTP_PORT=587"
+      - "SMTP_TLS=on"
+      - "SMTP_STARTTLS=on"
+      - "SMTP_TLS_CHECKCERT=off"
+      - "SMTP_AUTH=on"
+      - "SMTP_USER=hostinfo@tips-of-mine.fr"
+      - "SMTP_PASSWORD=P@ssword!Here!123456"
+      - "SMTP_DOMAIN=localhost"
+      - "SMTP_FROM=hostinfo@tips-of-mine.fr"
+    restart: always
+    healthcheck:
+      test: ["CMD-SHELL", "echo EHLO localhost"]
+      interval: 5s
+      timeout: 5s
+      retries: 5