diff --git a/legacy/.gitTally b/legacy/.gitTally index 2cee07f..af85aeb 100644 --- a/legacy/.gitTally +++ b/legacy/.gitTally @@ -84,9 +84,6 @@ export GITTALLY_ARTIFACT_SERVER_PORT='18080' # default GITTALLY_ARTIFACT_SERVER_BIND_ADDRESS='0.0.0.0' export GITTALLY_ARTIFACT_SERVER_BIND_ADDRESS='0.0.0.0' -# Host name or address printed in local artifact server URLs. -# default GITTALLY_ARTIFACT_SERVER_HOST='' -export GITTALLY_ARTIFACT_SERVER_HOST='' # Public base URL used for artifact links and Gitea status target URLs. # default GITTALLY_ARTIFACT_PUBLIC_BASE_URL='https://ci.example.org/' @@ -128,53 +125,6 @@ export GITTALLY_ARTIFACT_NGINX_CONTAINER_NAME='gittally-nginx-hsadmin-ng' # default GITTALLY_ARTIFACT_LETSENCRYPT_EMAIL='admin@example.org' export GITTALLY_ARTIFACT_LETSENCRYPT_EMAIL='' -# Additional certbot arguments, for example --staging. -# default GITTALLY_ARTIFACT_CERTBOT_ENV='' -export GITTALLY_ARTIFACT_CERTBOT_ENV='' - -# ================================================================================ -# Artifact website Gitea login -# -------------------------------------------------------------------------------- - -# Frontend auth mode for --nginx. Use gitea-oauth2 to require a Gitea browser login. -# default GITTALLY_ARTIFACT_AUTH_MODE='' -export GITTALLY_ARTIFACT_AUTH_MODE='' - -# Gitea base URL used only for browser login to the artifact website. -# default GITTALLY_ARTIFACT_AUTH_GITEA_BASE_URL='https://git.example.org' -export GITTALLY_ARTIFACT_AUTH_GITEA_BASE_URL='https://dev.hostsharing.net' - -# OAuth2 client ID registered in Gitea for the artifact website. -# default GITTALLY_ARTIFACT_AUTH_CLIENT_ID='gitea-oauth-client-id' -export GITTALLY_ARTIFACT_AUTH_CLIENT_ID='' - -# OAuth2 client secret registered in Gitea for the artifact website. -# default GITTALLY_ARTIFACT_AUTH_CLIENT_SECRET='gitea-oauth-client-secret' -export GITTALLY_ARTIFACT_AUTH_CLIENT_SECRET='' - -# Random oauth2-proxy cookie secret used to protect browser sessions. -# default GITTALLY_ARTIFACT_AUTH_COOKIE_SECRET='generate-a-random-cookie-secret' -export GITTALLY_ARTIFACT_AUTH_COOKIE_SECRET='' - -# Optional cookie domain for browser sessions. -# default GITTALLY_ARTIFACT_AUTH_COOKIE_DOMAIN='ci.example.org' -export GITTALLY_ARTIFACT_AUTH_COOKIE_DOMAIN='' - -# OAuth2 proxy Docker image used for Gitea browser login. -# default GITTALLY_ARTIFACT_AUTH_IMAGE='quay.io/oauth2-proxy/oauth2-proxy:v7.13.0' -export GITTALLY_ARTIFACT_AUTH_IMAGE='quay.io/oauth2-proxy/oauth2-proxy:v7.13.0' - -# Docker container name for the artifact website auth proxy. -# default GITTALLY_ARTIFACT_AUTH_CONTAINER_NAME='gittally-auth-example-repo' -export GITTALLY_ARTIFACT_AUTH_CONTAINER_NAME='gittally-auth-hsadmin-ng' - -# Internal HTTP port used by the artifact website auth proxy. -# default GITTALLY_ARTIFACT_AUTH_HTTP_PORT='4180' -export GITTALLY_ARTIFACT_AUTH_HTTP_PORT='4180' - -# Allowed email domains for logged-in Gitea users. Use * to allow any Gitea login. -# default GITTALLY_ARTIFACT_AUTH_EMAIL_DOMAINS='*' -export GITTALLY_ARTIFACT_AUTH_EMAIL_DOMAINS='*' # ================================================================================ # Legal @@ -224,6 +174,3 @@ export GITTALLY_GITEA_REPO='hs.hsadmin.ng' # default GITTALLY_GITEA_STATUS_CONTEXT='GitTally' export GITTALLY_GITEA_STATUS_CONTEXT='GitTally' -# Fixed status target URL. Leave empty to link to archived build artifacts. -# default GITTALLY_GITEA_STATUS_TARGET_URL='' -export GITTALLY_GITEA_STATUS_TARGET_URL='' diff --git a/legacy/gitTally b/legacy/gitTally index 8755db9..c15a3cb 100755 --- a/legacy/gitTally +++ b/legacy/gitTally @@ -59,21 +59,12 @@ default_gitea_base_url='https://git.example.org' default_gitea_owner='example-owner' default_gitea_repo='example-repo' default_gitea_git_username='example-user' -default_artifact_auth_gitea_base_url='https://git.example.org' -default_artifact_auth_image='quay.io/oauth2-proxy/oauth2-proxy:v7.13.0' -default_artifact_auth_http_port='4180' -default_artifact_auth_email_domains='*' default_artifact_public_base_url='https://ci.example.org/' default_impressum_url='https://example.org/imprint.html' default_artifact_nginx_server_name='ci.example.org' default_artifact_nginx_upstream_host='ci.example.org' default_artifact_nginx_container_name='gittally-nginx-example-repo' default_artifact_letsencrypt_email='admin@example.org' -default_artifact_auth_client_id='gitea-oauth-client-id' -default_artifact_auth_client_secret='gitea-oauth-client-secret' -default_artifact_auth_cookie_secret='generate-a-random-cookie-secret' -default_artifact_auth_cookie_domain='ci.example.org' -default_artifact_auth_container_name='gittally-auth-example-repo' config_file_var() { local name="$1" @@ -492,7 +483,6 @@ print_env() { local new_branch_commit_max_age local artifact_server_port local artifact_server_bind_address - local artifact_server_host local artifact_public_base_url local artifact_build_retention_per_branch local artifact_nginx_server_name @@ -502,21 +492,9 @@ print_env() { local artifact_nginx_container_name local artifact_nginx_state_dir local artifact_letsencrypt_email - local artifact_certbot_env - local artifact_auth_mode - local artifact_auth_gitea_base_url - local artifact_auth_client_id - local artifact_auth_client_secret - local artifact_auth_cookie_secret - local artifact_auth_cookie_domain - local artifact_auth_image - local artifact_auth_container_name - local artifact_auth_http_port - local artifact_auth_email_domains local impressum_url local gitea_token local gitea_status_context - local gitea_status_target_url local default_artifact_nginx_state_dir local default_repository_key local default_repository_simple_name @@ -540,10 +518,8 @@ print_env() { artifact_server_port=$(config_value GITTALLY_ARTIFACT_SERVER_PORT HSADMIN_NG_ARTIFACT_SERVER_PORT 18080) artifact_server_bind_address=$(config_value GITTALLY_ARTIFACT_SERVER_BIND_ADDRESS HSADMIN_NG_ARTIFACT_SERVER_BIND_ADDRESS 0.0.0.0) - artifact_server_host=$(config_value GITTALLY_ARTIFACT_SERVER_HOST HSADMIN_NG_ARTIFACT_SERVER_HOST "") artifact_http_server_port="$artifact_server_port" artifact_http_server_bind_address="$artifact_server_bind_address" - artifact_http_server_host="$artifact_server_host" artifact_nginx_server_name=$(config_value GITTALLY_ARTIFACT_NGINX_SERVER_NAME HSADMIN_NG_ARTIFACT_NGINX_SERVER_NAME "") artifact_public_base_url=$(config_value GITTALLY_ARTIFACT_PUBLIC_BASE_URL HSADMIN_NG_ARTIFACT_PUBLIC_BASE_URL "") artifact_build_retention_per_branch=$(config_value GITTALLY_ARTIFACT_BUILD_RETENTION_PER_BRANCH HSADMIN_NG_ARTIFACT_BUILD_RETENTION_PER_BRANCH 3) @@ -553,24 +529,11 @@ print_env() { artifact_nginx_container_name=$(config_value GITTALLY_ARTIFACT_NGINX_CONTAINER_NAME HSADMIN_NG_ARTIFACT_NGINX_CONTAINER_NAME "") artifact_nginx_state_dir=$(config_value GITTALLY_ARTIFACT_NGINX_STATE_DIR HSADMIN_NG_ARTIFACT_NGINX_STATE_DIR "") artifact_letsencrypt_email=$(config_value GITTALLY_ARTIFACT_LETSENCRYPT_EMAIL HSADMIN_NG_ARTIFACT_LETSENCRYPT_EMAIL "") - artifact_certbot_env=$(config_value GITTALLY_ARTIFACT_CERTBOT_ENV HSADMIN_NG_ARTIFACT_CERTBOT_ENV "") - artifact_auth_mode=$(config_value GITTALLY_ARTIFACT_AUTH_MODE "" "") - artifact_auth_gitea_base_url=$(config_value GITTALLY_ARTIFACT_AUTH_GITEA_BASE_URL "" "") - artifact_auth_client_id=$(config_value GITTALLY_ARTIFACT_AUTH_CLIENT_ID "" "") - artifact_auth_client_secret=$(config_value GITTALLY_ARTIFACT_AUTH_CLIENT_SECRET "" "") - artifact_auth_cookie_secret=$(config_value GITTALLY_ARTIFACT_AUTH_COOKIE_SECRET "" "") - artifact_auth_cookie_domain=$(config_value GITTALLY_ARTIFACT_AUTH_COOKIE_DOMAIN "" "") - artifact_auth_image=$(config_value GITTALLY_ARTIFACT_AUTH_IMAGE "" "$default_artifact_auth_image") - artifact_auth_container_name=$(config_value GITTALLY_ARTIFACT_AUTH_CONTAINER_NAME "" "") - artifact_auth_http_port=$(config_value GITTALLY_ARTIFACT_AUTH_HTTP_PORT "" "$default_artifact_auth_http_port") - artifact_auth_email_domains=$(config_value GITTALLY_ARTIFACT_AUTH_EMAIL_DOMAINS "" "$default_artifact_auth_email_domains") impressum_url=$(config_value GITTALLY_IMPRESSUM_URL "" "$default_impressum_url") if [ -n "$artifact_public_base_url" ]; then : elif [ -n "$artifact_nginx_server_name" ]; then artifact_public_base_url="https://$artifact_nginx_server_name/" - elif [ -n "$artifact_server_host" ]; then - artifact_public_base_url="http://$artifact_server_host:$artifact_server_port/" else artifact_public_base_url="http://$artifact_server_bind_address:$artifact_server_port/" fi @@ -584,14 +547,10 @@ print_env() { gitea_git_username=$(config_value GITTALLY_GITEA_GIT_USERNAME HSADMIN_NG_GITEA_GIT_USERNAME "") gitea_token=$(config_value GITTALLY_GITEA_TOKEN HSADMIN_NG_GITEA_TOKEN "") gitea_status_context=$(config_value GITTALLY_GITEA_STATUS_CONTEXT HSADMIN_NG_GITEA_STATUS_CONTEXT "$default_gitea_status_context") - gitea_status_target_url=$(config_value GITTALLY_GITEA_STATUS_TARGET_URL HSADMIN_NG_GITEA_STATUS_TARGET_URL "") detect_gitea_repo_from_origin_url if [ -z "$gitea_git_username" ]; then gitea_git_username=$(detect_git_username_from_origin_url) fi - if [ -z "$artifact_auth_gitea_base_url" ]; then - artifact_auth_gitea_base_url="${gitea_base_url:-$default_artifact_auth_gitea_base_url}" - fi default_repository_key=$(printf '%s' "${repo_root:-$(git rev-parse --show-toplevel)}" | sed 's#[^[:alnum:]._-]#_#g') default_repository_simple_name=$(basename "${repo_root:-$(git rev-parse --show-toplevel)}") default_artifact_nginx_state_dir='${XDG_STATE_HOME:-$HOME/.local/state}/gittally/nginx/' @@ -604,9 +563,6 @@ print_env() { if [ -z "$artifact_nginx_state_dir" ]; then artifact_nginx_state_dir="${XDG_STATE_HOME:-$HOME/.local/state}/gittally/nginx/$default_repository_key" fi - if [ -z "$artifact_auth_container_name" ]; then - artifact_auth_container_name="gittally-auth-$(printf '%s' "$default_repository_simple_name" | sed 's#[^[:alnum:]_.-]#-#g')" - fi printf '# Environment for %s version %s\n' "$tool_name" "$script_version" printf '# Save and source this output before starting the script, for example:\n' @@ -636,7 +592,6 @@ print_env() { print_env_section "Artifact server" print_env_var GITTALLY_ARTIFACT_SERVER_PORT "$artifact_server_port" 'Preferred HTTP port for serving archived build artifacts.' 18080 print_env_var GITTALLY_ARTIFACT_SERVER_BIND_ADDRESS "$artifact_server_bind_address" 'Bind address for the artifact HTTP server.' 0.0.0.0 - print_env_var GITTALLY_ARTIFACT_SERVER_HOST "$artifact_server_host" 'Host name or address printed in local artifact server URLs.' "" print_env_var GITTALLY_ARTIFACT_PUBLIC_BASE_URL "$artifact_public_base_url" 'Public base URL used for artifact links and Gitea status target URLs.' "$default_artifact_public_base_url" print_env_var GITTALLY_ARTIFACT_BUILD_RETENTION_PER_BRANCH "$artifact_build_retention_per_branch" 'Retained builds per branch. Use a count, or h/d suffix for age based retention.' 3 @@ -648,19 +603,6 @@ print_env() { print_env_var GITTALLY_ARTIFACT_NGINX_CONTAINER_NAME "$artifact_nginx_container_name" 'Docker container name for the nginx reverse proxy.' "$default_artifact_nginx_container_name" print_env_optional_var GITTALLY_ARTIFACT_NGINX_STATE_DIR "$artifact_nginx_state_dir" 'Persistent state directory for nginx config, logs, and certificate data.' "$default_artifact_nginx_state_dir" print_env_var GITTALLY_ARTIFACT_LETSENCRYPT_EMAIL "$artifact_letsencrypt_email" 'Email address used when registering Lets Encrypt certificates.' "$default_artifact_letsencrypt_email" - print_env_var GITTALLY_ARTIFACT_CERTBOT_ENV "$artifact_certbot_env" 'Additional certbot arguments, for example --staging.' "" - - print_env_section "Artifact website Gitea login" - print_env_var GITTALLY_ARTIFACT_AUTH_MODE "$artifact_auth_mode" 'Frontend auth mode for --nginx. Use gitea-oauth2 to require a Gitea browser login.' "" - print_env_var GITTALLY_ARTIFACT_AUTH_GITEA_BASE_URL "$artifact_auth_gitea_base_url" 'Gitea base URL used only for browser login to the artifact website.' "$default_artifact_auth_gitea_base_url" - print_env_var GITTALLY_ARTIFACT_AUTH_CLIENT_ID "$artifact_auth_client_id" 'OAuth2 client ID registered in Gitea for the artifact website.' "$default_artifact_auth_client_id" - print_env_var GITTALLY_ARTIFACT_AUTH_CLIENT_SECRET "$artifact_auth_client_secret" 'OAuth2 client secret registered in Gitea for the artifact website.' "$default_artifact_auth_client_secret" - print_env_var GITTALLY_ARTIFACT_AUTH_COOKIE_SECRET "$artifact_auth_cookie_secret" 'Random oauth2-proxy cookie secret used to protect browser sessions.' "$default_artifact_auth_cookie_secret" - print_env_var GITTALLY_ARTIFACT_AUTH_COOKIE_DOMAIN "$artifact_auth_cookie_domain" 'Optional cookie domain for browser sessions.' "$default_artifact_auth_cookie_domain" - print_env_var GITTALLY_ARTIFACT_AUTH_IMAGE "$artifact_auth_image" 'OAuth2 proxy Docker image used for Gitea browser login.' "$default_artifact_auth_image" - print_env_var GITTALLY_ARTIFACT_AUTH_CONTAINER_NAME "$artifact_auth_container_name" 'Docker container name for the artifact website auth proxy.' "$default_artifact_auth_container_name" - print_env_var GITTALLY_ARTIFACT_AUTH_HTTP_PORT "$artifact_auth_http_port" 'Internal HTTP port used by the artifact website auth proxy.' "$default_artifact_auth_http_port" - print_env_var GITTALLY_ARTIFACT_AUTH_EMAIL_DOMAINS "$artifact_auth_email_domains" 'Allowed email domains for logged-in Gitea users. Use * to allow any Gitea login.' "$default_artifact_auth_email_domains" print_env_section "Legal" print_env_var GITTALLY_IMPRESSUM_URL "$impressum_url" 'URL for the Impressum (Legal Disclosure) link in the footer.' "$default_impressum_url" @@ -676,7 +618,6 @@ print_env() { print_env_var GITTALLY_GITEA_GIT_USERNAME "$gitea_git_username" 'HTTPS git username used with the Gitea token. (required)' "$default_gitea_git_username" print_env_var GITTALLY_GITEA_TOKEN "$gitea_token" 'Token used for Gitea commit statuses and HTTPS git authentication. (required)' "" print_env_var GITTALLY_GITEA_STATUS_CONTEXT "$gitea_status_context" 'Gitea commit status context published by GitTally.' "$default_gitea_status_context" - print_env_var GITTALLY_GITEA_STATUS_TARGET_URL "$gitea_status_target_url" 'Fixed status target URL. Leave empty to link to archived build artifacts.' "" } if [ "$1" = "--env" ]; then @@ -735,9 +676,7 @@ active_build_pid= active_build_cancelled=false git_askpass_file= artifact_nginx_container_started=false -artifact_auth_container_started=false artifact_nginx_container_id= -artifact_auth_container_id= cleanup() { local ended_at @@ -780,11 +719,6 @@ cleanup() { artifact_nginx_container_started=false artifact_nginx_container_id= fi - if [ "${artifact_auth_container_started:-false}" = true ] && [ -n "${artifact_auth_container_id:-}" ]; then - docker rm -f "$artifact_auth_container_id" >/dev/null 2>&1 || true - artifact_auth_container_started=false - artifact_auth_container_id= - fi } trap cleanup EXIT trap 'exit 130' INT @@ -831,7 +765,6 @@ bootstrap_docker_build_env="$docker_build_env" bootstrap_docker_build_java_tool_options="$docker_build_java_tool_options" artifact_http_server_port=$(config_value GITTALLY_ARTIFACT_SERVER_PORT HSADMIN_NG_ARTIFACT_SERVER_PORT 18080) artifact_http_server_bind_address=$(config_value GITTALLY_ARTIFACT_SERVER_BIND_ADDRESS HSADMIN_NG_ARTIFACT_SERVER_BIND_ADDRESS 0.0.0.0) -artifact_http_server_host=$(config_value GITTALLY_ARTIFACT_SERVER_HOST HSADMIN_NG_ARTIFACT_SERVER_HOST "") artifact_public_base_url=$(config_value GITTALLY_ARTIFACT_PUBLIC_BASE_URL HSADMIN_NG_ARTIFACT_PUBLIC_BASE_URL "") artifact_build_retention_per_branch=$(config_value GITTALLY_ARTIFACT_BUILD_RETENTION_PER_BRANCH HSADMIN_NG_ARTIFACT_BUILD_RETENTION_PER_BRANCH 3) artifact_nginx_server_name=$(config_value GITTALLY_ARTIFACT_NGINX_SERVER_NAME HSADMIN_NG_ARTIFACT_NGINX_SERVER_NAME "") @@ -841,17 +774,6 @@ artifact_nginx_upstream_host=$(config_value GITTALLY_ARTIFACT_NGINX_UPSTREAM_HOS artifact_nginx_container_name=$(config_value GITTALLY_ARTIFACT_NGINX_CONTAINER_NAME HSADMIN_NG_ARTIFACT_NGINX_CONTAINER_NAME "") artifact_nginx_state_dir=$(config_value GITTALLY_ARTIFACT_NGINX_STATE_DIR HSADMIN_NG_ARTIFACT_NGINX_STATE_DIR "") artifact_letsencrypt_email=$(config_value GITTALLY_ARTIFACT_LETSENCRYPT_EMAIL HSADMIN_NG_ARTIFACT_LETSENCRYPT_EMAIL "") -artifact_certbot_env=$(config_value GITTALLY_ARTIFACT_CERTBOT_ENV HSADMIN_NG_ARTIFACT_CERTBOT_ENV "") -artifact_auth_mode=$(config_value GITTALLY_ARTIFACT_AUTH_MODE "" "") -artifact_auth_gitea_base_url=$(config_value GITTALLY_ARTIFACT_AUTH_GITEA_BASE_URL "" "") -artifact_auth_client_id=$(config_value GITTALLY_ARTIFACT_AUTH_CLIENT_ID "" "") -artifact_auth_client_secret=$(config_value GITTALLY_ARTIFACT_AUTH_CLIENT_SECRET "" "") -artifact_auth_cookie_secret=$(config_value GITTALLY_ARTIFACT_AUTH_COOKIE_SECRET "" "") -artifact_auth_cookie_domain=$(config_value GITTALLY_ARTIFACT_AUTH_COOKIE_DOMAIN "" "") -artifact_auth_image=$(config_value GITTALLY_ARTIFACT_AUTH_IMAGE "" "$default_artifact_auth_image") -artifact_auth_container_name=$(config_value GITTALLY_ARTIFACT_AUTH_CONTAINER_NAME "" "") -artifact_auth_http_port=$(config_value GITTALLY_ARTIFACT_AUTH_HTTP_PORT "" "$default_artifact_auth_http_port") -artifact_auth_email_domains=$(config_value GITTALLY_ARTIFACT_AUTH_EMAIL_DOMAINS "" "$default_artifact_auth_email_domains") impressum_url=$(config_value GITTALLY_IMPRESSUM_URL "" "$default_impressum_url") artifact_http_server_pid= artifact_http_server_local_url= @@ -862,7 +784,6 @@ gitea_repo=$(config_value GITTALLY_GITEA_REPO HSADMIN_NG_GITEA_REPO "") gitea_git_username=$(config_value GITTALLY_GITEA_GIT_USERNAME HSADMIN_NG_GITEA_GIT_USERNAME "") gitea_token=$(config_value GITTALLY_GITEA_TOKEN HSADMIN_NG_GITEA_TOKEN "") gitea_status_context=$(config_value GITTALLY_GITEA_STATUS_CONTEXT HSADMIN_NG_GITEA_STATUS_CONTEXT "$default_gitea_status_context") -gitea_status_target_url=$(config_value GITTALLY_GITEA_STATUS_TARGET_URL HSADMIN_NG_GITEA_STATUS_TARGET_URL "") branches_to_build=() usage() { @@ -910,7 +831,6 @@ usage() { echo echo "Set GITTALLY_ARTIFACT_SERVER_PORT to override the preferred artifact server port; default: 18080." echo "Set GITTALLY_ARTIFACT_SERVER_BIND_ADDRESS to override the artifact server bind address; default: 0.0.0.0." - echo "Set GITTALLY_ARTIFACT_SERVER_HOST to override the host printed in artifact server URLs." echo "Set GITTALLY_ARTIFACT_PUBLIC_BASE_URL to override public artifact URLs, for example behind nginx." echo "Set GITTALLY_ARTIFACT_BUILD_RETENTION_PER_BRANCH to override retained builds per branch;" echo " use a number for count, or a value ending in h/d for age; default: 3." @@ -920,18 +840,12 @@ usage() { echo "Set GITTALLY_ARTIFACT_NGINX_CONTAINER_NAME to override the Docker container name." echo "Set GITTALLY_ARTIFACT_NGINX_STATE_DIR to override the persistent nginx/certbot state directory." echo "Set GITTALLY_ARTIFACT_LETSENCRYPT_EMAIL to register the certificate with an email address." - echo "Set GITTALLY_ARTIFACT_CERTBOT_ENV for extra certbot args, for example --staging." - echo "Set GITTALLY_ARTIFACT_AUTH_MODE=gitea-oauth2 to require Gitea browser login for the nginx artifact website." - echo "Set GITTALLY_ARTIFACT_AUTH_GITEA_BASE_URL to choose the Gitea login base URL; default: detected Gitea URL or https://dev.hostsharing.net." - echo "Set GITTALLY_ARTIFACT_AUTH_CLIENT_ID, GITTALLY_ARTIFACT_AUTH_CLIENT_SECRET, and GITTALLY_ARTIFACT_AUTH_COOKIE_SECRET for OAuth2 login." - echo "Set GITTALLY_ARTIFACT_AUTH_EMAIL_DOMAINS to restrict logged-in Gitea users by email domain; default: *." echo "Legacy HSADMIN_NG_ARTIFACT_* variables are still accepted as fallbacks." echo echo "Set GITTALLY_GITEA_TOKEN to publish/read build statuses and authenticate HTTPS git commands via Gitea; required for startup." echo "Set GITTALLY_GITEA_GIT_USERNAME to authenticate HTTPS git commands with GITTALLY_GITEA_TOKEN; required for startup." echo "Set GITTALLY_GITEA_BASE_URL, GITTALLY_GITEA_OWNER, and GITTALLY_GITEA_REPO to override origin-based detection." echo "Set GITTALLY_GITEA_STATUS_CONTEXT to override the status context; default: GitTally." - echo "Set GITTALLY_GITEA_STATUS_TARGET_URL to override the status target URL." echo "Legacy HSADMIN_NG_GITEA_* variables are still accepted as fallbacks." echo echo "Branch arguments may be full names or unique name parts matching local or origin branches." @@ -1622,25 +1536,6 @@ artifact_nginx_default_state_dir() { echo "${XDG_STATE_HOME:-$HOME/.local/state}/gittally/nginx/$(repository_key)" } -artifact_auth_enabled() { - [ "$artifact_auth_mode" = gitea-oauth2 ] -} - -validate_artifact_auth_mode() { - case "$artifact_auth_mode" in - ""|none) - artifact_auth_mode= - ;; - gitea|gitea-oauth2) - artifact_auth_mode=gitea-oauth2 - ;; - *) - echo "WARNING: invalid GITTALLY_ARTIFACT_AUTH_MODE: $artifact_auth_mode; artifact website auth disabled." >&2 - artifact_auth_mode= - ;; - esac -} - configure_artifact_nginx_defaults() { local public_base_url_host @@ -1654,8 +1549,6 @@ configure_artifact_nginx_defaults() { public_base_url_host=$(base_url_host "$artifact_public_base_url") if [ -n "$public_base_url_host" ]; then artifact_nginx_server_name="$public_base_url_host" - elif [ -n "$artifact_http_server_host" ]; then - artifact_nginx_server_name="$artifact_http_server_host" fi fi @@ -1685,15 +1578,6 @@ configure_artifact_nginx_defaults() { artifact_nginx_state_dir=$(artifact_nginx_default_state_dir) fi - validate_artifact_auth_mode - - if [ -z "$artifact_auth_gitea_base_url" ]; then - artifact_auth_gitea_base_url="${gitea_base_url:-$default_artifact_auth_gitea_base_url}" - fi - - if [ -z "$artifact_auth_container_name" ]; then - artifact_auth_container_name="gittally-auth-$(safe_container_name_part "$(repository_simple_name)")" - fi } validate_artifact_build_retention_per_branch() { @@ -1925,9 +1809,7 @@ gitea_status_target_url_for_branch() { local branch="$1" local artifact_key="${2:-}" - if [ -n "$gitea_status_target_url" ]; then - echo "$gitea_status_target_url" - elif [ -n "$artifact_http_server_url" ]; then + if [ -n "$artifact_http_server_url" ]; then if [ -z "$artifact_key" ]; then artifact_key=$(build_artifact_branch_key "$branch") fi @@ -3488,11 +3370,6 @@ write_artifacts_root_index() { detect_artifact_http_server_host() { local host - if [ -n "$artifact_http_server_host" ]; then - echo "$artifact_http_server_host" - return 0 - fi - if [ "$artifact_http_server_bind_address" != "0.0.0.0" ]; then echo "$artifact_http_server_bind_address" return 0 @@ -4123,7 +4000,6 @@ EOF artifact_nginx_write_config() { local config_file="$1" local mode="$2" - local auth_proxy_url="http://$artifact_auth_container_name:$artifact_auth_http_port" if [ "$mode" = init ]; then cat >"$config_file" <&2 - return 1 - fi - - if ! [[ "$artifact_auth_http_port" =~ ^[0-9]+$ ]] || - [ "$artifact_auth_http_port" -lt 1 ] || - [ "$artifact_auth_http_port" -gt 65535 ]; then - echo "WARNING: invalid GITTALLY_ARTIFACT_AUTH_HTTP_PORT: $artifact_auth_http_port" >&2 - return 1 - fi - - public_base_url=$(normalize_base_url "${artifact_public_base_url:-https://$artifact_nginx_server_name/}") - redirect_url="${public_base_url}oauth2/callback" - gitea_base_url="${artifact_auth_gitea_base_url%/}" - - IFS=',' read -r -a email_domains <<<"$artifact_auth_email_domains" - for email_domain in "${email_domains[@]}"; do - if [ -n "$email_domain" ]; then - email_domain_args+=(--email-domain "$email_domain") - fi - done - if [ "${#email_domain_args[@]}" -eq 0 ]; then - email_domain_args=(--email-domain '*') - fi - - if [ -n "$artifact_auth_cookie_domain" ]; then - cookie_domain_args=(--cookie-domain "$artifact_auth_cookie_domain") - fi - - remove_docker_container_by_name "$artifact_auth_container_name" - artifact_auth_container_started=false - artifact_auth_container_id= - docker_args=(run -d --name "$artifact_auth_container_name" --network bridge) - mapfile -t docker_label_args < <(gittally_docker_label_args auth) - docker_args+=("${docker_label_args[@]}" "$artifact_auth_image" - --http-address=0.0.0.0:"$artifact_auth_http_port" - --provider=github - --provider-display-name=Gitea - --client-id="$artifact_auth_client_id" - --client-secret="$artifact_auth_client_secret" - --cookie-secret="$artifact_auth_cookie_secret" - --cookie-secure=true - --redirect-url="$redirect_url" - --login-url="$gitea_base_url/login/oauth/authorize" - --redeem-url="$gitea_base_url/login/oauth/access_token" - --validate-url="$gitea_base_url/api/v1/user/emails" - --reverse-proxy=true - --set-xauthrequest=true - --skip-provider-button=true - "${email_domain_args[@]}" - "${cookie_domain_args[@]}") - - if ! container_id=$(docker "${docker_args[@]}"); then - echo "WARNING: could not start artifact website Gitea auth proxy $artifact_auth_container_name." >&2 - return 1 - fi - artifact_auth_container_id="$container_id" - artifact_auth_container_started=true - - echo "Artifact website auth: Gitea login via $gitea_base_url" - echo "Artifact website auth callback: $redirect_url" -} - artifact_nginx_obtain_or_renew_certificate() { local certbot_conf="$1" local certbot_www="$2" local certbot_log="$3" local cert_file="$certbot_conf/live/$artifact_nginx_server_name/fullchain.pem" - local -a certbot_extra_args=() local -a email_args=() - if [ -n "$artifact_certbot_env" ]; then - read -r -a certbot_extra_args <<<"$artifact_certbot_env" - fi - if [ -n "$artifact_letsencrypt_email" ]; then email_args=(--email "$artifact_letsencrypt_email") else @@ -4498,7 +4248,7 @@ artifact_nginx_obtain_or_renew_certificate() { -v "$certbot_conf:/etc/letsencrypt" \ -v "$certbot_www:/var/www/certbot" \ -v "$certbot_log:/var/log/letsencrypt" \ - certbot/certbot renew -q "${certbot_extra_args[@]}" + certbot/certbot renew -q return $? fi @@ -4509,7 +4259,7 @@ artifact_nginx_obtain_or_renew_certificate() { certbot/certbot \ certonly --webroot --webroot-path /var/www/certbot --cert-name "$artifact_nginx_server_name" \ -d "$artifact_nginx_server_name" --rsa-key-size 4096 \ - --non-interactive --agree-tos "${email_args[@]}" "${certbot_extra_args[@]}" + --non-interactive --agree-tos "${email_args[@]}" } start_artifact_nginx() { @@ -4571,10 +4321,6 @@ start_artifact_nginx() { } if [ -f "$cert_file" ]; then - if ! start_artifact_auth_proxy; then - echo "WARNING: artifact nginx HTTPS proxy was not started because artifact website auth setup failed." >&2 - return 0 - fi artifact_nginx_write_config "$config_file" full || return 0 else artifact_nginx_write_config "$config_file" init || return 0 @@ -4590,11 +4336,6 @@ start_artifact_nginx() { return 0 fi - if ! start_artifact_auth_proxy; then - echo "WARNING: artifact nginx HTTPS proxy was not started because artifact website auth setup failed." >&2 - return 0 - fi - artifact_nginx_write_config "$config_file" full || return 0 if ! artifact_nginx_run_container "$config_file" "$certbot_conf" "$certbot_www" "$nginx_log"; then echo "WARNING: certificate is available, but restarting artifact nginx with HTTPS failed." >&2