Repository navigation
Replace caddy with nginx, gitea with forgejo, minor ansible deprecation fixes - #85
Merged
Merged
Conversation
Pin geerlingguy.mysql to 6.5.0; releases before 6.0.0 use non-boolean
conditionals that ansible >= 2.19 rejects.
In ipa_client, `lookup('env', ...) | default(false)` leaves the empty
string an unset env var returns, since `default` only substitutes on
undefined. Pipe through `bool` so the conditional is a real boolean.
artis3n.tailscale re-runs `tailscale up --reset` whenever its state file changes -- a new host, a different remote user or a changed login server is enough -- which re-keys a node that is already on the tailnet. Wrap it in a local role that checks `tailscale status` first and only brings the node up when it isn't already connected, with TAILSCALE_REAUTH to force it when re-keying is actually wanted. Since the wrapped role only registers the node addresses when it runs `tailscale up`, register them here too so roles/keycloak can still build its cluster IP list.
Track forgejo upstream rather than gitea; the release layout differs, so point the download at code.forgejo.org and follow its versioning. Verify the binary against the .sha256 sidecar published beside each release. Without a checksum, get_url only looks at whether dest exists and never at the URL, so the versioned URL changed but the binary at /usr/local/bin/gitea never did. With it, get_url hashes the installed binary and re-downloads only on a mismatch, so a version bump actually takes effect and correctly notifies the restart handler.
Bring gitea in line with the other public-facing roles, which all terminate TLS on nginx and manage certificates with certbot rather than relying on Caddy's automatic HTTPS. Gitea now listens on 127.0.0.1:3000 and nginx proxies to it, with a body size limit large enough for git pushes and LFS uploads. Certificates support webroot, Route53 and Cloudflare authentication; nginx is seeded with a self-signed certificate so it can start before the first certificate is issued, and the vhost is rewritten with the real paths once certbot succeeds. DNS-authenticated certificates are fetched before nginx starts, since they need no running webserver.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.