Ultimate Build Machine using Gitea

Self-hosted Git infrastructure with S3-compatible storage, monitoring, and proper secrets management.

Stack Components

• Gitea (1.22.6) - Git hosting with Actions and LFS support
• PostgreSQL (15) - Database
• SeaweedFS - Distributed S3-compatible object storage
• Prometheus (v2.21.0) - Metrics and monitoring
• Caddy - Reverse proxy with automatic HTTPS
• 1Password - Secrets management via op inject

Quick Start

Prerequisites

1. 1Password Vault Items - Create in your 1Password vault:

   op item create --vault="your-vault" --category=login \
     --title="gitea-postgres" --generate-password=20 username=gitea
   
   op item create --vault="your-vault" --category=custom \
     --title="gitea-s3" access-key="$(openssl rand -hex 20)" \
     secret-key="$(openssl rand -hex 40)"
   

2. SSH Access - Ensure ssh your-server works

3. 1Password Service Account - ~/op_credentials.sh on your server (sets OP_SERVICE_ACCOUNT_TOKEN)

Deploy

./deploy-to-bigbox.sh

Access Services

After deployment:

Public (via HTTPS on terraphim.cloud):

• Gitea Web: https://git.terraphim.cloud
• Gitea SSH: ssh://your-server:222

Tailscale Network Only (your Tailscale node IP):

• Prometheus: http://<tailscale-ip>:9000
• S3 API: http://<tailscale-ip>:8333

Note: Prometheus and S3 are only accessible within the Tailscale VPN network, not from the public internet.

Documentation

• Research Document - Phase 1 analysis
• Implementation Plan - Phase 2 design
• Deployment Summary - Post-deployment guide

Security

• No hardcoded secrets - All credentials managed via 1Password
• Template files (.template) contain op:// references
• Generated files excluded from git (.gitignore)
• Caddy provides automatic HTTPS
• Secret injection at deployment time via op inject

TODO

• Automatic spin up and registration of gitea runners (github compatible)
• Earthly buildkit daemon (not satellite - with gitea runners we don't need earthly satellites)