mirror of
https://github.com/terraphim/gitea-infrastructure.git
synced 2026-07-16 01:00:33 +02:00
Alex Mikhalev
961e54a902
- README: replace zesticai-non-prod vault name and bigbox hostname with generic placeholders; replace hardcoded Tailscale IP with descriptive text - deploy-to-bigbox.sh: make BIGBOX and TAILSCALE_IP configurable via env vars (auto-detect via tailscale ip -4); replace op_zesticai_non_prod.sh with op_credentials.sh - Caddyfile: remove bigbox hostname from comment - RESEARCH doc: remove hardcoded S3 access key and secret key values from the secrets table; replace with generic op:// reference format - docker-compose_kitchen_sink.yml: replace hardcoded S3 credentials with CHANGE_ME placeholders Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
70 lines
2.2 KiB
Markdown
70 lines
2.2 KiB
Markdown
# Ultimate Build Machine using Gitea
|
|
|
|
Self-hosted Git infrastructure with S3-compatible storage, monitoring, and proper secrets management.
|
|
|
|
## Stack Components
|
|
|
|
- **Gitea** (1.22.6) - Git hosting with Actions and LFS support
|
|
- **PostgreSQL** (15) - Database
|
|
- **SeaweedFS** - Distributed S3-compatible object storage
|
|
- **Prometheus** (v2.21.0) - Metrics and monitoring
|
|
- **Caddy** - Reverse proxy with automatic HTTPS
|
|
- **1Password** - Secrets management via `op inject`
|
|
|
|
## Quick Start
|
|
|
|
### Prerequisites
|
|
|
|
1. **1Password Vault Items** - Create in your 1Password vault:
|
|
```bash
|
|
op item create --vault="your-vault" --category=login \
|
|
--title="gitea-postgres" --generate-password=20 username=gitea
|
|
|
|
op item create --vault="your-vault" --category=custom \
|
|
--title="gitea-s3" access-key="$(openssl rand -hex 20)" \
|
|
secret-key="$(openssl rand -hex 40)"
|
|
```
|
|
|
|
2. **SSH Access** - Ensure `ssh your-server` works
|
|
|
|
3. **1Password Service Account** - `~/op_credentials.sh` on your server (sets `OP_SERVICE_ACCOUNT_TOKEN`)
|
|
|
|
### Deploy
|
|
|
|
```bash
|
|
./deploy-to-bigbox.sh
|
|
```
|
|
|
|
### Access Services
|
|
|
|
After deployment:
|
|
|
|
**Public (via HTTPS on terraphim.cloud):**
|
|
- **Gitea Web**: https://git.terraphim.cloud
|
|
- **Gitea SSH**: ssh://your-server:222
|
|
|
|
**Tailscale Network Only (your Tailscale node IP):**
|
|
- **Prometheus**: http://<tailscale-ip>:9000
|
|
- **S3 API**: http://<tailscale-ip>:8333
|
|
|
|
*Note: Prometheus and S3 are only accessible within the Tailscale VPN network, not from the public internet.*
|
|
|
|
## Documentation
|
|
|
|
- [Research Document](.docs/RESEARCH-gitea-bigbox-deployment.md) - Phase 1 analysis
|
|
- [Implementation Plan](.docs/IMPLEMENTATION-gitea-bigbox-deployment.md) - Phase 2 design
|
|
- [Deployment Summary](.docs/DEPLOYMENT-SUMMARY.md) - Post-deployment guide
|
|
|
|
## Security
|
|
|
|
- **No hardcoded secrets** - All credentials managed via 1Password
|
|
- **Template files** (`.template`) contain `op://` references
|
|
- **Generated files** excluded from git (`.gitignore`)
|
|
- **Caddy** provides automatic HTTPS
|
|
- **Secret injection** at deployment time via `op inject`
|
|
|
|
## TODO
|
|
|
|
- [ ] Automatic spin up and registration of gitea runners (github compatible)
|
|
- [ ] Earthly buildkit daemon (not satellite - with gitea runners we don't need earthly satellites)
|