mirror of
https://github.com/terraphim/gitea-infrastructure.git
synced 2026-07-16 01:00:33 +02:00
Alex Mikhalev
1637782273
Automated fix from pre-commit hooks (trailing-whitespace, end-of-file-fixer). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
70 lines
2.2 KiB
Markdown
70 lines
2.2 KiB
Markdown
# Ultimate Build Machine using Gitea
|
|
|
|
Self-hosted Git infrastructure with S3-compatible storage, monitoring, and proper secrets management.
|
|
|
|
## Stack Components
|
|
|
|
- **Gitea** (1.22.6) - Git hosting with Actions and LFS support
|
|
- **PostgreSQL** (15) - Database
|
|
- **SeaweedFS** - Distributed S3-compatible object storage
|
|
- **Prometheus** (v2.21.0) - Metrics and monitoring
|
|
- **Caddy** - Reverse proxy with automatic HTTPS
|
|
- **1Password** - Secrets management via `op inject`
|
|
|
|
## Quick Start
|
|
|
|
### Prerequisites
|
|
|
|
1. **1Password Vault Items** - Create in `zesticai-non-prod` vault:
|
|
```bash
|
|
op item create --vault="zesticai-non-prod" --category=login \
|
|
--title="gitea-postgres" --generate-password=20 username=gitea
|
|
|
|
op item create --vault="zesticai-non-prod" --category=custom \
|
|
--title="gitea-s3" access-key="$(openssl rand -hex 20)" \
|
|
secret-key="$(openssl rand -hex 40)"
|
|
```
|
|
|
|
2. **SSH Access** - Ensure `ssh bigbox` works
|
|
|
|
3. **1Password Service Account** - `~/op_zesticai_non_prod.sh` on bigbox
|
|
|
|
### Deploy to Bigbox
|
|
|
|
```bash
|
|
./deploy-to-bigbox.sh
|
|
```
|
|
|
|
### Access Services
|
|
|
|
After deployment:
|
|
|
|
**Public (via HTTPS on terraphim.cloud):**
|
|
- **Gitea Web**: https://git.terraphim.cloud
|
|
- **Gitea SSH**: ssh://bigbox:222
|
|
|
|
**Tailscale Network Only (100.106.66.7):**
|
|
- **Prometheus**: http://100.106.66.7:9000
|
|
- **S3 API**: http://100.106.66.7:8333
|
|
|
|
*Note: Prometheus and S3 are only accessible within the Tailscale VPN network, not from the public internet.*
|
|
|
|
## Documentation
|
|
|
|
- [Research Document](.docs/RESEARCH-gitea-bigbox-deployment.md) - Phase 1 analysis
|
|
- [Implementation Plan](.docs/IMPLEMENTATION-gitea-bigbox-deployment.md) - Phase 2 design
|
|
- [Deployment Summary](.docs/DEPLOYMENT-SUMMARY.md) - Post-deployment guide
|
|
|
|
## Security
|
|
|
|
- **No hardcoded secrets** - All credentials managed via 1Password
|
|
- **Template files** (`.template`) contain `op://` references
|
|
- **Generated files** excluded from git (`.gitignore`)
|
|
- **Caddy** provides automatic HTTPS
|
|
- **Secret injection** at deployment time via `op inject`
|
|
|
|
## TODO
|
|
|
|
- [ ] Automatic spin up and registration of gitea runners (github compatible)
|
|
- [ ] Earthly buildkit daemon (not satellite - with gitea runners we don't need earthly satellites)
|