# Ultimate Build Machine using Gitea

Self-hosted Git infrastructure with S3-compatible storage, monitoring, and proper secrets management.

## Stack Components

- **Gitea** (1.22.6) - Git hosting with Actions and LFS support
- **PostgreSQL** (15) - Database
- **SeaweedFS** - Distributed S3-compatible object storage
- **Prometheus** (v2.21.0) - Metrics and monitoring
- **Caddy** - Reverse proxy with automatic HTTPS
- **1Password** - Secrets management via `op inject`

## Quick Start

### Prerequisites

1. **1Password Vault Items** - Create in your 1Password vault:
   ```bash
   op item create --vault="your-vault" --category=login \
     --title="gitea-postgres" --generate-password=20 username=gitea

   op item create --vault="your-vault" --category=custom \
     --title="gitea-s3" access-key="$(openssl rand -hex 20)" \
     secret-key="$(openssl rand -hex 40)"
   ```

2. **SSH Access** - Ensure `ssh your-server` works

3. **1Password Service Account** - `~/op_credentials.sh` on your server (sets `OP_SERVICE_ACCOUNT_TOKEN`)

### Deploy

```bash
./deploy-to-bigbox.sh
```

### Access Services

After deployment:

**Public (via HTTPS on terraphim.cloud):**
- **Gitea Web**: https://git.terraphim.cloud
- **Gitea SSH**: ssh://your-server:222

**Tailscale Network Only (your Tailscale node IP):**
- **Prometheus**: http://<tailscale-ip>:9000
- **S3 API**: http://<tailscale-ip>:8333

*Note: Prometheus and S3 are only accessible within the Tailscale VPN network, not from the public internet.*

## Documentation

- [Research Document](.docs/RESEARCH-gitea-bigbox-deployment.md) - Phase 1 analysis
- [Implementation Plan](.docs/IMPLEMENTATION-gitea-bigbox-deployment.md) - Phase 2 design
- [Deployment Summary](.docs/DEPLOYMENT-SUMMARY.md) - Post-deployment guide

## Security

- **No hardcoded secrets** - All credentials managed via 1Password
- **Template files** (`.template`) contain `op://` references
- **Generated files** excluded from git (`.gitignore`)
- **Caddy** provides automatic HTTPS
- **Secret injection** at deployment time via `op inject`

## TODO

- [ ] Automatic spin up and registration of gitea runners (github compatible)
- [ ] Earthly buildkit daemon (not satellite - with gitea runners we don't need earthly satellites)