How to set up a gitea docker instance
Basic installation
To setup a gitea server using docker, the following docker-compose.yml file shall be used:
networks:
gitea:
external: false
services:
web:
image: gitea/gitea:latest
environment:
- USER_UID=1002
- USER_GID=1002
volumes:
- ./data:/data
- /home/git/.ssh/:/data/git/.ssh
ports:
- "3000:3000"
- "2200:22"
depends_on:
- db
restart: always
networks:
- gitea
db:
image: mariadb
restart: always
environment:
- MYSQL_ROOT_PASSWORD=<redacted>
- MYSQL_DATABASE=gitea
- MYSQL_USER=gitea
- MYSQL_PASSWORD=<redacted>
volumes:
- ./db/:/var/lib/mysql
networks:
- gitea
What the above docker-compose configuration will do is that it will, in essence, create two, always on, services, that will forever be restarted: a mariadb database server that will write all of its data to a local "db" directory, and another web service that will server as the main git server and the web server alongside it.
Before starting the docker services, please create the necessary resources first.
Create the required local directories to store the data in
Do a simple command to create the necessary directories:
mkdir data db
Backing up just these two directories should, in theory, be enough to allow for full restoration of all git repository resources into the future. WARNING: This has not been tested yet!!!
Create a separate git user to login into via SSH
Creating a separate user, technically, is unnecessary, but it makes the configuration more conventional.
Assuming the 1002 UID is already assigned to a different user, feel free to use a different UID (be sure to update the yaml configuration with the proper user ID, then).
Once this configuration has been done, go ahead and generate an /home/git/.ssh/ directory for the user to have. Be sure to chown this specific directory to the git user as appropriate:
chmod 700 /home/git/.ssh/
Once all these steps are done, you can proceed to the next step.
Spin up a container from the docker image
Had all the necessary steps been done properly, this should yield a fully functional container. If there are any errors encountered by this point, please fix them before proceeding.
Set up a proper nginx endpoint for the docker service
Deploy the following configuration to make the container accessible to the outside world:
server_name git.transistor.one;
listen [::]:443 http2 ssl; # managed by Certbot
listen 443 http2 ssl; # managed by Certbot
# http2 on;
include /etc/nginx/snippets/ssl.conf;
location / {
proxy_pass http://localhost:3000;
}
}
Once this is done, restart nginx:
Confirm that the web page is accessible at the git.transistor.one URL. In case it's not, fix it.
# Customize Gitea configuration #
Assuming you do need to change a couple of settings, gitea will have generated a configuration file at ./data/gitea/conf/app.ini.
Make whatever changes you need to make in this file.
The changes will take effect only after stopping and restarting the container, though.
Notable changes that are worth mentioning is setting up an SMTP endpoint:
ENABLED = true
PROTOCOL = smtp+starttls
HOST = mail.transistor.one:587
FROM = gitea@transistor.one
USER =
PASSWD =
And, of course, the server hostname configuration:
APP_DATA_PATH = /data/gitea
DOMAIN = transistor.one
SSH_DOMAIN = transistor.one
HTTP_PORT = 3000
ROOT_URL = https://git.transistor.one/
DISABLE_SSH = false
SSH_PORT = 22
SSH_LISTEN_PORT = 22
Oh and, almost forgot, disable user registrations by setting
DISABLE_REGISTRATION = true
If you need more configuration information, check this out.
Activating SSH passthrough
This is the most complex step out of all of them. In order to take advantage of the fact that SSH git pulls/pushes will be done via standard port 22, normal SSH traffic needs to be differentiated from git specific SSH traffic.
To this end, multiple configurations will need to be done.
This one's extremely important. Failing to perform this step will make SSH git pulls and pushes require to be done directly from the 2200 port like so
While this isn't the end of the world, ideally, all SSH traffic should be routed to port 22, as is standard. VPS firewalls or intermediary ISPs may, themselves, block off incoming or outgoing traffic to unconventional ports, which can cause issues. As such, using the standard port 22 for SSH communication would be ideal.
Enable SSH login for the git user
So, to enable SSH capabilities to the git user, please edit the "/etc/ssh/sshd_config" configuration and change the following line:
Obviously the "alex" user doesn't need to be here. The git user does. Change this list as best suits your needs. Don't forget to restart the service after you're done: