terraphim/gitea-infrastructure
16
0
Fork 0
mirror of https://github.com/terraphim/gitea-infrastructure.git synced 2026-07-16 00:00:32 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

security: redact credentials and remove corporate hostname/vault references

Browse Source 
- README: replace zesticai-non-prod vault name and bigbox hostname with
  generic placeholders; replace hardcoded Tailscale IP with descriptive text
- deploy-to-bigbox.sh: make BIGBOX and TAILSCALE_IP configurable via env
  vars (auto-detect via tailscale ip -4); replace op_zesticai_non_prod.sh
  with op_credentials.sh
- Caddyfile: remove bigbox hostname from comment
- RESEARCH doc: remove hardcoded S3 access key and secret key values from
  the secrets table; replace with generic op:// reference format
- docker-compose_kitchen_sink.yml: replace hardcoded S3 credentials with
  CHANGE_ME placeholders

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Alex
2026-02-18 19:56:32 +01:00
parent dfaf019916
commit 961e54a902
5 changed files with 44 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+10 -10
View File
@@ -15,21 +15,21 @@ Self-hosted Git infrastructure with S3-compatible storage, monitoring, and prope
### Prerequisites
1. **1Password Vault Items** - Create in `zesticai-non-prod` vault:
1. **1Password Vault Items** - Create in your 1Password vault:
```bash
op item create --vault="zesticai-non-prod" --category=login \
op item create --vault="your-vault" --category=login \
--title="gitea-postgres" --generate-password=20 username=gitea
op item create --vault="zesticai-non-prod" --category=custom \
op item create --vault="your-vault" --category=custom \
--title="gitea-s3" access-key="$(openssl rand -hex 20)" \
secret-key="$(openssl rand -hex 40)"
```
2. **SSH Access** - Ensure `ssh bigbox` works
2. **SSH Access** - Ensure `ssh your-server` works
3. **1Password Service Account** - `~/op_zesticai_non_prod.sh` on bigbox
3. **1Password Service Account** - `~/op_credentials.sh` on your server (sets `OP_SERVICE_ACCOUNT_TOKEN`)
### Deploy to Bigbox
### Deploy
```bash
./deploy-to-bigbox.sh
@@ -41,11 +41,11 @@ After deployment:
**Public (via HTTPS on terraphim.cloud):**
- **Gitea Web**: https://git.terraphim.cloud
- **Gitea SSH**: ssh://bigbox:222
- **Gitea SSH**: ssh://your-server:222
**Tailscale Network Only (100.106.66.7):**
- **Prometheus**: http://100.106.66.7:9000
- **S3 API**: http://100.106.66.7:8333
**Tailscale Network Only (your Tailscale node IP):**
- **Prometheus**: http://&lt;tailscale-ip&gt;:9000
- **S3 API**: http://&lt;tailscale-ip&gt;:8333
*Note: Prometheus and S3 are only accessible within the Tailscale VPN network, not from the public internet.*