mirror of
https://github.com/terraphim/gitea-infrastructure.git
synced 2026-07-16 00:00:32 +02:00
feat: Gitea deployment with 1Password and Caddy
Complete infrastructure deployment including: - Docker Compose templates with 1Password integration (op://) - Caddy reverse proxy configuration for git.terraphim.cloud - Automated deployment script (deploy-to-bigbox.sh) - Comprehensive documentation and deployment article - Network isolation: Public (Gitea) + Tailscale (Prometheus/S3) - Security: No hardcoded secrets, all via 1Password Services deployed: - Gitea 1.22.6 (Git hosting) - PostgreSQL 15 (Database) - SeaweedFS (S3-compatible storage) - Prometheus (Monitoring) Excludes: - docker-compose.yml (contains resolved secrets) - s3_config.json (contains resolved secrets) - Data directories (gitea/, postgres/, seaweedfs/) Refs: Private deployment on bigbox with TerraphimPlatform vault
This commit is contained in:
Alex
Executable
+273
@@ -0,0 +1,273 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Deploy Gitea Stack to Bigbox with 1Password Secrets Management
|
||||
#
|
||||
# Prerequisites:
|
||||
# - SSH access to bigbox configured
|
||||
# - 1Password CLI installed locally and on bigbox
|
||||
# - op_zesticai_non_prod.sh exists on bigbox with valid service account token
|
||||
# - 1Password vault items created (gitea-postgres, gitea-s3)
|
||||
# - Caddy already running on bigbox
|
||||
#
|
||||
# Network Configuration:
|
||||
# - Gitea: Public via Caddy (git.terraphim.cloud) -> localhost:3000
|
||||
# - Prometheus: Tailscale only (100.106.66.7:9000)
|
||||
# - S3: Tailscale only (100.106.66.7:8333)
|
||||
#
|
||||
# Usage:
|
||||
# ./deploy-to-bigbox.sh
|
||||
#
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# Configuration
|
||||
BIGBOX="bigbox"
|
||||
REMOTE_DIR="~/gitea-stack"
|
||||
TAILSCALE_IP="100.106.66.7"
|
||||
|
||||
echo -e "${GREEN}=== Gitea Stack Deployment to Bigbox ===${NC}"
|
||||
echo ""
|
||||
|
||||
# Step 1: Verify local prerequisites
|
||||
echo -e "${YELLOW}Step 1: Verifying local prerequisites...${NC}"
|
||||
if ! command -v rsync &> /dev/null; then
|
||||
echo -e "${RED}Error: rsync is not installed${NC}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if ! ssh -o ConnectTimeout=5 "$BIGBOX" "echo 'SSH OK'" &> /dev/null; then
|
||||
echo -e "${RED}Error: Cannot connect to $BIGBOX via SSH${NC}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo -e "${GREEN}✓ Local prerequisites verified${NC}"
|
||||
echo ""
|
||||
|
||||
# Step 2: Verify bigbox prerequisites
|
||||
echo -e "${YELLOW}Step 2: Verifying bigbox prerequisites...${NC}"
|
||||
ssh "$BIGBOX" << 'CHECKSCRIPT'
|
||||
set -e
|
||||
|
||||
# Check Docker
|
||||
if ! command -v docker &> /dev/null; then
|
||||
echo "Error: Docker not installed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check Docker Compose
|
||||
if ! docker compose version &> /dev/null; then
|
||||
echo "Error: Docker Compose not installed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check 1Password CLI
|
||||
if ! command -v op &> /dev/null; then
|
||||
echo "Error: 1Password CLI not installed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check service account script
|
||||
if [ ! -f "$HOME/op_zesticai_non_prod.sh" ]; then
|
||||
echo "Error: op_zesticai_non_prod.sh not found in home directory"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Test 1Password authentication
|
||||
source "$HOME/op_zesticai_non_prod.sh"
|
||||
if ! op vault list &> /dev/null; then
|
||||
echo "Error: 1Password authentication failed"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check Caddy is running
|
||||
if ! pgrep -x caddy > /dev/null; then
|
||||
echo "Error: Caddy is not running"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Check Caddy admin API is accessible
|
||||
if ! curl -s http://localhost:2019/config/ > /dev/null; then
|
||||
echo "Error: Caddy admin API is not accessible"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "All prerequisites verified"
|
||||
CHECKSCRIPT
|
||||
|
||||
echo -e "${GREEN}✓ Bigbox prerequisites verified${NC}"
|
||||
echo ""
|
||||
|
||||
# Step 3: Transfer files
|
||||
echo -e "${YELLOW}Step 3: Transferring files to bigbox...${NC}"
|
||||
ssh "$BIGBOX" "mkdir -p $REMOTE_DIR"
|
||||
|
||||
rsync -avz --progress \
|
||||
--exclude='.git' \
|
||||
--exclude='gitea' \
|
||||
--exclude='postgres' \
|
||||
--exclude='seaweedfs' \
|
||||
--exclude='seaweedfs_filter' \
|
||||
--exclude='docker-compose.yml' \
|
||||
--exclude='s3_config.json' \
|
||||
--exclude='.env' \
|
||||
--exclude='*.log' \
|
||||
--exclude='.docs/' \
|
||||
. "$BIGBOX:$REMOTE_DIR/"
|
||||
|
||||
echo -e "${GREEN}✓ Files transferred${NC}"
|
||||
echo ""
|
||||
|
||||
# Step 4: Inject secrets and start services
|
||||
echo -e "${YELLOW}Step 4: Injecting secrets and starting services...${NC}"
|
||||
ssh "$BIGBOX" << DEPLOYSCRIPT
|
||||
set -e
|
||||
cd $REMOTE_DIR
|
||||
|
||||
echo "Loading 1Password credentials..."
|
||||
source ~/op_zesticai_non_prod.sh
|
||||
|
||||
echo "Injecting secrets into docker-compose.yml..."
|
||||
op inject --in-file docker-compose.yml.template --out-file docker-compose.yml
|
||||
|
||||
echo "Injecting secrets into s3_config.json..."
|
||||
op inject --in-file s3_config.json.template --out-file s3_config.json
|
||||
|
||||
echo "Creating data directories..."
|
||||
mkdir -p gitea postgres seaweedfs seaweedfs_filter prometheus
|
||||
|
||||
echo "Setting permissions..."
|
||||
chmod -R 1000:1000 gitea 2>/dev/null || sudo chown -R 1000:1000 gitea 2>/dev/null || true
|
||||
|
||||
echo "Starting services with Docker Compose..."
|
||||
docker compose up -d
|
||||
|
||||
echo "Waiting for services to start..."
|
||||
sleep 30
|
||||
|
||||
echo "Service status:"
|
||||
docker compose ps
|
||||
DEPLOYSCRIPT
|
||||
|
||||
echo -e "${GREEN}✓ Services started${NC}"
|
||||
echo ""
|
||||
|
||||
# Step 5: Add Gitea route to Caddy
|
||||
echo -e "${YELLOW}Step 5: Adding Gitea route to Caddy...${NC}"
|
||||
ssh "$BIGBOX" << CADDYSCRIPT
|
||||
set -e
|
||||
|
||||
echo "Creating log directory..."
|
||||
sudo mkdir -p /var/log/caddy
|
||||
|
||||
echo "Adding Gitea route to Caddy via Admin API..."
|
||||
curl -s -X POST http://localhost:2019/config/apps/http/servers/srv0/routes \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{
|
||||
"@id": "gitea_route",
|
||||
"match": [{"host": ["git.terraphim.cloud"]}],
|
||||
"handle": [{
|
||||
"handler": "subroute",
|
||||
"routes": [{
|
||||
"handle": [{
|
||||
"handler": "reverse_proxy",
|
||||
"upstreams": [{"dial": "localhost:3000"}]
|
||||
}]
|
||||
}]
|
||||
}],
|
||||
"terminal": true
|
||||
}'
|
||||
|
||||
# Verify route was added
|
||||
if curl -s http://localhost:2019/config/apps/http/servers/srv0/routes | grep -q "git.terraphim.cloud"; then
|
||||
echo "✓ Gitea route added successfully to Caddy"
|
||||
else
|
||||
echo "✗ Warning: Could not verify Gitea route was added"
|
||||
fi
|
||||
CADDYSCRIPT
|
||||
|
||||
echo -e "${GREEN}✓ Caddy configured${NC}"
|
||||
echo ""
|
||||
|
||||
# Step 6: Verify deployment
|
||||
echo -e "${YELLOW}Step 6: Verifying deployment...${NC}"
|
||||
ssh "$BIGBOX" << VERIFYSCRIPT
|
||||
set -e
|
||||
cd $REMOTE_DIR
|
||||
|
||||
echo ""
|
||||
echo "=== Service Health Checks ==="
|
||||
|
||||
# Check Gitea (direct)
|
||||
if curl -s -o /dev/null -w '%{http_code}' http://localhost:3000/api/healthz | grep -q "200"; then
|
||||
echo "✓ Gitea is healthy (localhost:3000)"
|
||||
else
|
||||
echo "✗ Gitea is not responding"
|
||||
fi
|
||||
|
||||
# Check S3 (Tailscale)
|
||||
if curl -s http://${TAILSCALE_IP}:8333 > /dev/null 2>&1; then
|
||||
echo "✓ SeaweedFS S3 is responding (${TAILSCALE_IP}:8333)"
|
||||
else
|
||||
echo "✗ SeaweedFS S3 is not responding"
|
||||
fi
|
||||
|
||||
# Check Prometheus (Tailscale)
|
||||
if curl -s http://${TAILSCALE_IP}:9000/-/healthy > /dev/null 2>&1; then
|
||||
echo "✓ Prometheus is healthy (${TAILSCALE_IP}:9000)"
|
||||
else
|
||||
echo "✗ Prometheus is not responding"
|
||||
fi
|
||||
|
||||
# Check SSH port
|
||||
if nc -zv localhost 222 2>&1 | grep -q succeeded; then
|
||||
echo "✓ SSH port is open (port 222)"
|
||||
else
|
||||
echo "✗ SSH port is not responding"
|
||||
fi
|
||||
|
||||
# Check Caddy
|
||||
if pgrep -x caddy > /dev/null; then
|
||||
echo "✓ Caddy is running"
|
||||
else
|
||||
echo "✗ Caddy is not running"
|
||||
fi
|
||||
|
||||
echo ""
|
||||
echo "=== Container Status ==="
|
||||
docker compose ps
|
||||
|
||||
echo ""
|
||||
echo "=== Recent Logs ==="
|
||||
docker compose logs --tail=10
|
||||
VERIFYSCRIPT
|
||||
|
||||
echo ""
|
||||
echo -e "${GREEN}=== Deployment Complete ===${NC}"
|
||||
echo ""
|
||||
echo "Access your services:"
|
||||
echo ""
|
||||
echo "Public (via HTTPS):"
|
||||
echo " - Gitea Web: https://git.terraphim.cloud"
|
||||
echo ""
|
||||
echo "Tailscale Network Only (${TAILSCALE_IP}):"
|
||||
echo " - Prometheus: http://${TAILSCALE_IP}:9000"
|
||||
echo " - S3 API: http://${TAILSCALE_IP}:8333"
|
||||
echo ""
|
||||
echo "SSH Access:"
|
||||
echo " - Gitea SSH: ssh://bigbox:222"
|
||||
echo ""
|
||||
echo "Note: Prometheus and S3 are NOT accessible from the public internet."
|
||||
echo " Connect via Tailscale first: tailscale up"
|
||||
echo ""
|
||||
echo "Next steps:"
|
||||
echo " 1. Ensure DNS points git.terraphim.cloud to bigbox"
|
||||
echo " 2. Access Gitea at https://git.terraphim.cloud to complete setup"
|
||||
echo " 3. Change default admin password after first login"
|
||||
echo " 4. Review Caddy logs: ssh bigbox 'sudo tail -f /var/log/caddy/gitea-access.log'"
|
||||
echo ""
|
||||
Reference in New Issue
Block a user