mirror of https://github.com/terraphim/gitea-infrastructure.git synced 2026-07-15 22:50:34 +02:00

Files

Alex Mikhalev 961e54a902 security: redact credentials and remove corporate hostname/vault references

- README: replace zesticai-non-prod vault name and bigbox hostname with
  generic placeholders; replace hardcoded Tailscale IP with descriptive text
- deploy-to-bigbox.sh: make BIGBOX and TAILSCALE_IP configurable via env
  vars (auto-detect via tailscale ip -4); replace op_zesticai_non_prod.sh
  with op_credentials.sh
- Caddyfile: remove bigbox hostname from comment
- RESEARCH doc: remove hardcoded S3 access key and secret key values from
  the secrets table; replace with generic op:// reference format
- docker-compose_kitchen_sink.yml: replace hardcoded S3 credentials with
  CHANGE_ME placeholders

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-02-18 19:56:32 +01:00

2.2 KiB

Raw Permalink Blame History

Ultimate Build Machine using Gitea

Self-hosted Git infrastructure with S3-compatible storage, monitoring, and proper secrets management.

Stack Components

Gitea (1.22.6) - Git hosting with Actions and LFS support
PostgreSQL (15) - Database
SeaweedFS - Distributed S3-compatible object storage
Prometheus (v2.21.0) - Metrics and monitoring
Caddy - Reverse proxy with automatic HTTPS
1Password - Secrets management via op inject

Quick Start

Prerequisites

1Password Vault Items - Create in your 1Password vault:

op item create --vault="your-vault" --category=login \
  --title="gitea-postgres" --generate-password=20 username=gitea

op item create --vault="your-vault" --category=custom \
  --title="gitea-s3" access-key="$(openssl rand -hex 20)" \
  secret-key="$(openssl rand -hex 40)"

SSH Access - Ensure ssh your-server works
1Password Service Account - ~/op_credentials.sh on your server (sets OP_SERVICE_ACCOUNT_TOKEN)

Deploy

./deploy-to-bigbox.sh

Access Services

After deployment:

Public (via HTTPS on terraphim.cloud):

Gitea Web: https://git.terraphim.cloud
Gitea SSH: ssh://your-server:222

Tailscale Network Only (your Tailscale node IP):

Prometheus: http://<tailscale-ip>:9000
S3 API: http://<tailscale-ip>:8333

Note: Prometheus and S3 are only accessible within the Tailscale VPN network, not from the public internet.

Documentation

Research Document - Phase 1 analysis
Implementation Plan - Phase 2 design
Deployment Summary - Post-deployment guide

Security

No hardcoded secrets - All credentials managed via 1Password
Template files (.template) contain op:// references
Generated files excluded from git (.gitignore)
Caddy provides automatic HTTPS
Secret injection at deployment time via op inject

TODO

Automatic spin up and registration of gitea runners (github compatible)
Earthly buildkit daemon (not satellite - with gitea runners we don't need earthly satellites)

2.2 KiB Raw Permalink Blame History