116 lines
4.9 KiB
Django/Jinja
116 lines
4.9 KiB
Django/Jinja
{#
|
|
Rendered by Ansible from src/forgejo/common/vars.yml merged with
|
|
../vars.yml (as `app_config`), plus Vault path homelab/forgejo (as
|
|
`vault_secrets`). The native-install equivalent of the
|
|
FORGEJO__section__KEY environment variables in ../../unraid/docker-compose.yml.
|
|
|
|
Do not edit this file on the host — the next deploy overwrites it. It is
|
|
root-owned and group-readable by Forgejo precisely so Forgejo cannot rewrite
|
|
it behind Ansible's back.
|
|
|
|
Note what is NOT configured here: every path Forgejo stores state under is
|
|
left at its default beneath APP_DATA_PATH — indexers, queues, sessions,
|
|
avatars, packages. That is deliberate. All of it sitting on the container's
|
|
own disk is what makes a vzdump of this guest a complete copy of Forgejo's
|
|
filesystem state.
|
|
#}
|
|
APP_NAME = Forgejo
|
|
RUN_USER = {{ app_config.FORGEJO_USER }}
|
|
RUN_MODE = prod
|
|
WORK_PATH = {{ app_config.FORGEJO_WORK_PATH }}
|
|
|
|
[server]
|
|
PROTOCOL = http
|
|
DOMAIN = {{ app_config.FORGEJO_DOMAIN }}
|
|
ROOT_URL = {{ app_config.FORGEJO_ROOT_URL }}
|
|
HTTP_ADDR = 0.0.0.0
|
|
HTTP_PORT = {{ app_config.FORGEJO_HTTP_PORT }}
|
|
APP_DATA_PATH = {{ app_config.FORGEJO_DATA_PATH }}
|
|
{# The container's own sshd serves git over SSH, so Forgejo only advertises
|
|
the address and manages the git user's authorized_keys. On Unraid this was
|
|
Forgejo's built-in server behind a published Docker port. #}
|
|
SSH_DOMAIN = {{ app_config.FORGEJO_DOMAIN }}
|
|
SSH_PORT = {{ app_config.FORGEJO_SSH_PORT }}
|
|
START_SSH_SERVER = false
|
|
DISABLE_SSH = false
|
|
LFS_START_SERVER = true
|
|
LFS_JWT_SECRET = {{ vault_secrets.LFS_JWT_SECRET }}
|
|
|
|
[database]
|
|
DB_TYPE = postgres
|
|
HOST = {{ app_config.DB_HOST }}:{{ app_config.DB_PORT }}
|
|
NAME = {{ app_config.DB_NAME }}
|
|
USER = {{ app_config.DB_USER }}
|
|
PASSWD = {{ vault_secrets.DB_PASSWORD }}
|
|
{# The shared Postgres publishes a plain port on the LAN and has no TLS
|
|
configured — see src/shared/postgres/ansible/unraid/docker-compose.yml.
|
|
Change both together if that ever gains a certificate. #}
|
|
SSL_MODE = disable
|
|
|
|
[repository]
|
|
ROOT = {{ app_config.FORGEJO_DATA_PATH }}/forgejo-repositories
|
|
|
|
[security]
|
|
{# Fully configured from Vault, so skip the web installer entirely — without
|
|
this, a fresh container serves the setup wizard on first boot and would
|
|
write its own app.ini over this one. #}
|
|
INSTALL_LOCK = true
|
|
SECRET_KEY = {{ vault_secrets.SECRET_KEY }}
|
|
INTERNAL_TOKEN = {{ vault_secrets.INTERNAL_TOKEN }}
|
|
|
|
[oauth2]
|
|
JWT_SECRET = {{ vault_secrets.JWT_SECRET }}
|
|
|
|
[oauth2_client]
|
|
{# Policy for signing in through an external OIDC provider (Authentik). The
|
|
provider itself is NOT configured here and cannot be: Forgejo keeps
|
|
authentication sources in its database, added once with
|
|
`forgejo admin auth add-oauth` — see step 8 of docs/forgejo-proxmox.md.
|
|
This section only decides what happens to a user who has just
|
|
authenticated there. #}
|
|
|
|
{# Create a Forgejo account on first successful OIDC login. Without this,
|
|
Authentik authenticates the user and Forgejo then has nobody to log in as.
|
|
Gated by the registration settings below, not independent of them. #}
|
|
ENABLE_AUTO_REGISTRATION = true
|
|
|
|
{# Attach an OIDC identity to an existing local account when the email
|
|
matches, rather than creating a second one alongside it. This is what lets
|
|
the break-glass admin from step 4b become the same account you arrive as
|
|
through Authentik, instead of demoting you to a fresh unprivileged user on
|
|
first SSO login. `login` would ask the user to confirm by entering their
|
|
local password; `auto` links silently, which is only safe because
|
|
Authentik is the sole source of verified addresses here. #}
|
|
ACCOUNT_LINKING = auto
|
|
|
|
{# Take the Forgejo username from the provider's preferred_username claim.
|
|
The alternative, `userid`, would name accounts after Authentik's opaque
|
|
subject UUID. #}
|
|
USERNAME = nickname
|
|
|
|
[service]
|
|
{# INSTALL_LOCK skips the wizard, which is also where these would have been
|
|
chosen.
|
|
|
|
These two are a pair and the combination is deliberate. DISABLE_REGISTRATION
|
|
cannot stay `true` once SSO is wanted: it blocks OIDC auto-registration as
|
|
well as the local signup form, so Authentik logins authenticate correctly
|
|
and are then refused an account — which reads like a broken provider rather
|
|
than a policy setting. ALLOW_ONLY_EXTERNAL_REGISTRATION restores exactly
|
|
the property that was wanted: no self-service signup, accounts only through
|
|
a configured provider.
|
|
|
|
Safe to have in place before the Authentik source exists. With no external
|
|
provider configured, "only external registration" permits nothing, so this
|
|
is not a window during which the forge is open — flipping the first value
|
|
alone would have been. #}
|
|
DISABLE_REGISTRATION = false
|
|
ALLOW_ONLY_EXTERNAL_REGISTRATION = true
|
|
REQUIRE_SIGNIN_VIEW = false
|
|
|
|
[log]
|
|
{# journald, via systemd capturing stdout — `journalctl -u forgejo`. ROOT_PATH
|
|
still matters: some subsystems write their own files regardless. #}
|
|
MODE = console
|
|
LEVEL = info
|
|
ROOT_PATH = {{ app_config.FORGEJO_LOG_PATH }}
|