- Trust X-Forwarded-For from the pod network (10.244.0.0/16) via security.REVERSE_PROXY_TRUSTED_PROXIES / REVERSE_PROXY_LIMIT so Gitea logs the external client address instead of the ingress-nginx pod IP. - Set actions.ENABLED explicitly and deploy an instance-wide runner via the gitea/actions chart (release "gitea-actions", pinned to 0.1.2). The registration token is generated in-cluster and stored in a Secret on first run, so no token lives in git or the vault. - Fix the old actions.yaml, which reused the "gitea" release name and would have clobbered the main Gitea release. - Add a demo workflow (.gitea/workflows/demo.yaml). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Claude
co-authored by
Claude Opus 5.5
Claude Opus 5.5
parent
9f46e92cd7
commit
0f1ed99dfc
@@ -0,0 +1,42 @@
|
||||
# Demo workflow showing Gitea Actions running on the in-cluster runner.
|
||||
name: Demo
|
||||
on:
|
||||
push:
|
||||
workflow_dispatch:
|
||||
|
||||
jobs:
|
||||
hello:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Say hello
|
||||
run: |
|
||||
echo "Hello from Gitea Actions on ${{ gitea.server_url }}"
|
||||
echo "Repository: ${{ gitea.repository }}"
|
||||
echo "Ref: ${{ gitea.ref }}"
|
||||
echo "Commit: ${{ gitea.sha }}"
|
||||
echo "Triggered by: ${{ gitea.actor }} (${{ gitea.event_name }})"
|
||||
|
||||
- name: Check out the role
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Show the role layout
|
||||
run: find . -path ./.git -prune -o -type f -print | sort
|
||||
|
||||
- name: Validate YAML
|
||||
run: |
|
||||
python3 -c 'import yaml' 2>/dev/null || (apt-get update -qq && apt-get install -y -qq python3-yaml >/dev/null)
|
||||
python3 - <<'PY'
|
||||
import pathlib, sys
|
||||
import yaml
|
||||
bad = 0
|
||||
for p in sorted(pathlib.Path('.').rglob('*.y*ml')):
|
||||
if '.git' in p.parts:
|
||||
continue
|
||||
try:
|
||||
yaml.safe_load(p.read_text())
|
||||
print(f"ok {p}")
|
||||
except yaml.YAMLError as e:
|
||||
bad += 1
|
||||
print(f"FAIL {p}: {e}")
|
||||
sys.exit(1 if bad else 0)
|
||||
PY
|
||||
@@ -1,3 +1,13 @@
|
||||
#SPDX-License-Identifier: MIT-0
|
||||
---
|
||||
# defaults file for ansible-role-gitea
|
||||
|
||||
# CIDRs allowed to set X-Forwarded-For / X-Real-IP for Gitea.
|
||||
# 10.244.0.0/16 is the cluster pod network, where ingress-nginx runs.
|
||||
gitea_trusted_proxies: "127.0.0.0/8,::1/128,10.244.0.0/16"
|
||||
|
||||
# Gitea Actions runner (gitea/actions chart)
|
||||
gitea_actions_enabled: true
|
||||
gitea_actions_chart_version: 0.1.2
|
||||
gitea_actions_runner_replicas: 1
|
||||
gitea_actions_runner_token_secret: gitea-actions-runner-token
|
||||
|
||||
+67
-13
@@ -1,23 +1,77 @@
|
||||
- name: deploy actions
|
||||
---
|
||||
# Deploys an instance-wide Gitea Actions runner (act_runner + DinD).
|
||||
- name: check for existing runner registration token secret
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Secret
|
||||
namespace: gitea
|
||||
name: "{{ gitea_actions_runner_token_secret }}"
|
||||
register: runner_token_secret
|
||||
|
||||
- name: generate and store a runner registration token
|
||||
when: runner_token_secret.resources | length == 0
|
||||
block:
|
||||
- name: find a running gitea pod
|
||||
kubernetes.core.k8s_info:
|
||||
kind: Pod
|
||||
namespace: gitea
|
||||
label_selectors:
|
||||
- app.kubernetes.io/name=gitea
|
||||
- app.kubernetes.io/instance=gitea
|
||||
field_selectors:
|
||||
- status.phase=Running
|
||||
register: gitea_pods
|
||||
|
||||
- name: generate instance-level runner registration token
|
||||
kubernetes.core.k8s_exec:
|
||||
namespace: gitea
|
||||
pod: "{{ gitea_pods.resources[0].metadata.name }}"
|
||||
container: gitea
|
||||
command: gitea actions generate-runner-token
|
||||
register: runner_token
|
||||
no_log: true
|
||||
|
||||
- name: store runner registration token
|
||||
kubernetes.core.k8s:
|
||||
state: present
|
||||
definition:
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: "{{ gitea_actions_runner_token_secret }}"
|
||||
namespace: gitea
|
||||
type: Opaque
|
||||
stringData:
|
||||
token: "{{ runner_token.stdout | trim }}"
|
||||
no_log: true
|
||||
|
||||
- name: deploy gitea actions runner
|
||||
kubernetes.core.helm:
|
||||
name: gitea
|
||||
name: gitea-actions
|
||||
chart_ref: gitea/actions
|
||||
chart_version: "{{ gitea_actions_chart_version }}"
|
||||
release_namespace: gitea
|
||||
create_namespace: true
|
||||
values:
|
||||
enabled: true
|
||||
provisioning:
|
||||
enabled: true
|
||||
giteaRootURL: https://gitea.eom.dev
|
||||
existingSecret: "{{ gitea_actions_runner_token_secret }}"
|
||||
existingSecretKey: token
|
||||
statefulset:
|
||||
actRunner:
|
||||
replicas: "{{ gitea_actions_runner_replicas }}"
|
||||
persistence:
|
||||
size: 1Gi
|
||||
runner:
|
||||
config: |
|
||||
log:
|
||||
level: debug
|
||||
cache:
|
||||
enabled: false
|
||||
log:
|
||||
level: info
|
||||
cache:
|
||||
enabled: false
|
||||
container:
|
||||
require_docker: true
|
||||
docker_timeout: 300s
|
||||
runner:
|
||||
capacity: 2
|
||||
labels:
|
||||
- "ubuntu-latest:docker://node:16-bullseye"
|
||||
- "ubuntu-22.04:docker://node:16-bullseye"
|
||||
- "ubuntu-20.04:docker://node:16-bullseye"
|
||||
- "ubuntu-18.04:docker://node:16-buster"
|
||||
- "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
|
||||
- "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
|
||||
- "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
|
||||
|
||||
@@ -72,6 +72,13 @@
|
||||
EMAIL_DOMAIN_BLOCKLIST: "spammer.com,mailinator.com,tempmail.com,10minutemail.com,guerrillamail.com,dispostable.com,fakemail.com,maildrop.cc,trashmail.com,yopmail.com,techstrategylab.com,timminsgoldminetour.com,claxyn.org,sise.claxyn.org,blyxen.com,seti.blyxen.com,tute.blyxen.com,tula.blyxen.com,sise.blyxen.org,ivolix.com,seti.lyvix.org,tute.lyvix.org,seti.ivolix.org,semo.ivolix.com,elyquin.org,simu.elyquin.org,semo.claxyn.com,sise.oxilv.com,simu.glinxy.org,simu.hivoltz.org,semo.elyquin.com,prisite.online,sise.dravix.org,dravix.org,semo.glinxy.com,glinxy.com,dark-webmarket.com,seti.juxal.org,juxal.org,9e5d.getir.space,getir.space,topcompanygroup.com,6d43.getir.space,9e2d.mikrowellen-tests.com,verifiedlinklist.com,xylzen.com,tapi.xylzen.com,ylixo.com,tapi.ylixo.com,tute.ylixo.com,estrella.glinxy.com,nestmailbox.com,theweifamily.icu,1mail.x24hr.com,8.dnsabr.com,23.8.dnsabr.com,2712.bubbles-swimming.co.uk,anonmails.de,spambog.ru,anonmails.de,virginvoyages.click,travellersrest.click,mailus.virginvoyages.com,tula.hivoltz.org,theblueholiday.click,mailius.virginvoyages.com,travellersrest.click,twitch.work,backlinks.monster,onlinecmail.com,gsasearchenginerankervps.com,seoautomationpro.online"
|
||||
ENABLE_CAPTCHA: true
|
||||
REGISTER_EMAIL_CONFIRM: true
|
||||
security:
|
||||
# Trust X-Forwarded-For from ingress-nginx (pod network) so Gitea
|
||||
# logs the real client address instead of the ingress pod IP.
|
||||
REVERSE_PROXY_LIMIT: 1
|
||||
REVERSE_PROXY_TRUSTED_PROXIES: "{{ gitea_trusted_proxies }}"
|
||||
actions:
|
||||
ENABLED: true
|
||||
oauth2_client:
|
||||
ENABLE_AUTO_REGISTRATION: true
|
||||
UPDATE_AVATAR: true
|
||||
|
||||
+5
-3
@@ -2,6 +2,8 @@
|
||||
---
|
||||
# tasks file for ansible-role-gitea
|
||||
- name: gitea
|
||||
include_tasks: "{{ item }}"
|
||||
loop:
|
||||
- gitea.yaml
|
||||
include_tasks: gitea.yaml
|
||||
|
||||
- name: gitea actions runner
|
||||
include_tasks: actions.yaml
|
||||
when: gitea_actions_enabled | bool
|
||||
|
||||
Reference in New Issue
Block a user