Add first module : Gitea app

modules/apps/gitea/lib/scripts/create-backup.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+set -euo pipefail
+
+source /opt/gitea/env.sh
+
+TIMESTAMP=$(date +'%Y-%m-%d_%H%M%S')
+
+sudo -u "$GITEA_USER" gitea dump -c "$GITEA_HOME/app.ini" -f $GITEA_BACKUPS_DIR/gitea-dump-\$TIMESTAMP.zip
+
+ls -1dt $GITEA_BACKUPS_DIR/gitea-dump-*.zip | tail -n +5 | xargs -r rm -f

modules/apps/gitea/lib/scripts/env.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+set -euo pipefail
+
+GITEA_HOME="/var/lib/gitea"
+GITEA_CONF="$GITEA_HOME/app.ini"
+GITEA_USER="git"
+GITEA_VERSION="1.25.3"
+GITEA_BINARY="/usr/local/bin/gitea"
+GITEA_SERVICE="/etc/systemd/system/gitea.service"
+DB_NAME="giteadb"
+DB_USER="gitea"
+GITEA_BACKUPS_DIR="/backups/gitea"

modules/apps/gitea/lib/scripts/install-gitea.sh

@@ -0,0 +1,90 @@
+#!/bin/bash
+set -euo pipefail
+
+source /opt/gitea/env.sh
+
+# Gitea user
+if ! id -u $GITEA_USER >/dev/null 2>&1; then
+    adduser \
+        --system \
+        --shell /bin/bash \
+        --gecos 'Git Version Control' \
+        --group \
+        --disabled-password \
+        --home /home/git \
+        $GITEA_USER
+fi
+echo "---- Gitea user created ----"
+
+# Gitea folder structure
+mkdir -p $GITEA_HOME/{custom,data,log}
+chown -R $GITEA_USER:$GITEA_USER $GITEA_HOME
+chmod -R 750 $GITEA_HOME
+
+if [ ! -f $GITEA_BINARY ]; then
+    wget -O /tmp/gitea "https://dl.gitea.com/gitea/$GITEA_VERSION/gitea-$GITEA_VERSION-linux-amd64"
+    chmod +x /tmp/gitea
+    mv /tmp/gitea $GITEA_BINARY
+fi
+echo "---- Gitea folder structure created ----"
+
+# Postgres initial config
+DB_PASS=$(openssl rand -base64 12)
+sudo -u postgres psql <<EOF
+CREATE ROLE $DB_USER WITH LOGIN PASSWORD '$DB_PASS';
+CREATE DATABASE $DB_NAME WITH OWNER $DB_USER TEMPLATE template0 ENCODING UTF8 LC_COLLATE 'en_US.UTF-8' LC_CTYPE 'en_US.UTF-8';
+EOF
+
+if ls -1 "$GITEA_BACKUPS_DIR"/gitea-dump-*.zip >/dev/null 2>&1; then
+    echo "---- Backup found, restoring Gitea ----"
+    /usr/local/bin/restore-backup.sh
+else
+    echo "---- No backup found in $GITEA_BACKUPS_DIR, skipping restore ----"
+fi
+
+sudo chown -R $GITEA_USER:$GITEA_USER $GITEA_BACKUPS_DIR
+sudo chmod -R 770 $GITEA_BACKUPS_DIR
+
+GITEA_SECRET_KEY=$("$GITEA_BINARY" generate secret SECRET_KEY)
+GITEA_JWT_SECRET=$("$GITEA_BINARY" generate secret JWT_SECRET)
+GITEA_INTERNAL_TOKEN=$("$GITEA_BINARY" generate secret INTERNAL_TOKEN)
+
+mkdir -p $(dirname "$GITEA_CONF")
+cat > "$GITEA_CONF" <<EOF
+[database]
+DB_TYPE = postgres
+HOST = 127.0.0.1:5432
+NAME = $DB_NAME
+USER = $DB_USER
+PASSWD = $DB_PASS
+SSL_MODE = disable
+
+[security]
+INSTALL_LOCK = true
+SECRET_KEY = $GITEA_SECRET_KEY
+JWT_SECRET = $GITEA_JWT_SECRET
+INTERNAL_TOKEN = $GITEA_INTERNAL_TOKEN
+
+[server]
+DOMAIN = gitea.aldon.fr
+HTTP_PORT = 3000
+ROOT_URL = https://gitea.aldon.fr
+DISABLE_SSH = false
+SSH_PORT = 22
+
+[repository]
+ROOT = /var/lib/gitea/data/repositories
+
+[service]
+DISABLE_REGISTRATION = true
+EOF
+echo "---- Generated Gitea app.ini with secrets ----"
+
+chown git:git $GITEA_CONF
+chmod 640 $GITEA_CONF
+
+systemctl daemon-reload
+systemctl enable gitea
+
+systemctl is-active --quiet gitea || systemctl start gitea
+echo "---- Gitea installation completed ----"

modules/apps/gitea/lib/scripts/restore-backup.sh

@@ -0,0 +1,62 @@
+#!/bin/bash
+set -euo pipefail
+
+source /opt/gitea/env.sh
+
+sudo -u postgres psql <<EOF
+DO \$\$
+BEGIN
+   IF EXISTS (SELECT FROM pg_database WHERE datname = '$DB_NAME') THEN
+       EXECUTE 'DROP DATABASE $DB_NAME';
+   END IF;
+   IF EXISTS (SELECT FROM pg_roles WHERE rolname = '$DB_USER') THEN
+       EXECUTE 'DROP ROLE $DB_USER';
+   END IF;
+END
+\$\$;
+EOF
+
+LATEST_BACKUP=$(ls -1 $GITEA_BACKUPS_DIR/gitea-dump-*.zip 2>/dev/null | sort | tail -n1)
+
+if [ -n "$LATEST_BACKUP" ] && [ -f "$LATEST_BACKUP" ]; then
+    TMP_DIR=$(mktemp -d)
+    unzip -o $LATEST_BACKUP -d $TMP_DIR
+    [ -d $TMP_DIR/data ] && cp -a $TMP_DIR/data/* /var/lib/gitea/data/
+    [ -d $TMP_DIR/log ] && cp -a $TMP_DIR/log/* /var/lib/gitea/log/
+    [ -d $TMP_DIR/repos ] && cp -aH $TMP_DIR/repos/. /var/lib/gitea/data/repositories/
+    chown -R $GITEA_USER:$GITEA_USER $GITEA_HOME
+    sudo -u postgres psql -d $DB_NAME < $TMP_DIR/gitea-db.sql
+    sudo -u postgres psql -d "$DB_NAME" <<EOF
+DO \$\$
+DECLARE
+  r RECORD;
+BEGIN
+  -- Tables
+  FOR r IN
+    SELECT schemaname, tablename
+    FROM pg_tables
+    WHERE schemaname = 'public'
+  LOOP
+    EXECUTE format(
+      'ALTER TABLE %I.%I OWNER TO $DB_USER;',
+      r.schemaname,
+      r.tablename
+    );
+  END LOOP;
+
+  -- Sequences
+  FOR r IN
+    SELECT sequence_schema, sequence_name
+    FROM information_schema.sequences
+    WHERE sequence_schema = 'public'
+  LOOP
+    EXECUTE format(
+      'ALTER SEQUENCE %I.%I OWNER TO $DB_USER;',
+      r.sequence_schema,
+      r.sequence_name
+    );
+  END LOOP;
+END
+\$\$;
+EOF
+fi

modules/apps/gitea/lib/services/gitea.service

@@ -0,0 +1,42 @@
+[Unit]
+Description=Gitea (Git with a cup of tea)
+After=network.target
+
+#Wants=postgresql.service
+#After=postgresql.service
+[Service]
+# Uncomment the next line if you have repos with lots of files and get a HTTP 500 error because of that
+# LimitNOFILE=524288:524288
+RestartSec=2s
+Type=simple
+User=git
+Group=git
+WorkingDirectory=/var/lib/gitea/
+# If using Unix socket: tells systemd to create the /run/gitea folder, which will contain the gitea.sock file
+# (manually creating /run/gitea doesn't work, because it would not persist across reboots)
+#RuntimeDirectory=gitea
+ExecStart=/usr/local/bin/gitea web --config /var/lib/gitea/app.ini
+Restart=always
+Environment=USER=git HOME=/home/git GITEA_WORK_DIR=/var/lib/gitea
+# If you install Git to directory prefix other than default PATH (which happens
+# for example if you install other versions of Git side-to-side with
+# distribution version), uncomment below line and add that prefix to PATH
+# Don't forget to place git-lfs binary on the PATH below if you want to enable
+# Git LFS support
+#Environment=PATH=/path/to/git/bin:/bin:/sbin:/usr/bin:/usr/sbin
+# If you want to bind Gitea to a port below 1024, uncomment
+# the two values below, or use socket activation to pass Gitea its ports as above
+###
+#CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+#AmbientCapabilities=CAP_NET_BIND_SERVICE
+###
+# In some cases, when using CapabilityBoundingSet and AmbientCapabilities option, you may want to
+# set the following value to false to allow capabilities to be applied on gitea process. The following
+# value if set to true sandboxes gitea service and prevent any processes from running with privileges
+# in the host user namespace.
+###
+#PrivateUsers=false
+###
+
+[Install]
+WantedBy=multi-user.target

modules/apps/gitea/lib/services/restore-backup.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=Restore latest Gitea backup
+After=network.target postgresql.service gitea.service
+Requires=postgresql.service gitea.service
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/restore-backup.sh
+WorkingDirectory=/var/lib/gitea
+TimeoutStartSec=600

modules/apps/gitea/lib/services/weekly-backup.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=Weekly Gitea Backup
+Wants=network.target
+After=network.target gitea.service
+Before=shutdown.target reboot.target halt.target
+
+[Service]
+Type=oneshot
+User=root
+ExecStart=/usr/local/bin/backup.sh

modules/apps/gitea/lib/services/weekly-backup.timer

@@ -0,0 +1,9 @@
+[Unit]
+Description=Run Gitea backup weekly
+
+[Timer]
+OnCalendar=Sun *-*-* 01:00:00
+Persistent=true
+
+[Install]
+WantedBy=timers.target