From 7967dbf9f04b13b70725f4272a000f1276f86f96 Mon Sep 17 00:00:00 2001 From: Chewbaccalakis Date: Fri, 18 Sep 2026 20:08:29 -0700 Subject: [PATCH] gitea actions --- .gitea/workflows/container.yml | 78 ++++++++++++++++++++++++++++++++++ README.md | 3 +- docs/gitea.md | 55 ++++++++++++++++++++++++ docs/setup.md | 10 +++++ 4 files changed, 145 insertions(+), 1 deletion(-) create mode 100644 .gitea/workflows/container.yml create mode 100644 docs/gitea.md diff --git a/.gitea/workflows/container.yml b/.gitea/workflows/container.yml new file mode 100644 index 0000000..2d932a8 --- /dev/null +++ b/.gitea/workflows/container.yml @@ -0,0 +1,78 @@ +name: Container + +on: + push: + branches: [main] + tags: ["v*"] + pull_request: + workflow_dispatch: + +permissions: + contents: read + packages: write + +concurrency: + group: container-${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + test: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - uses: actions/setup-python@v5 + with: + python-version: "3.12" + - name: Install and test + run: | + python -m pip install --upgrade pip + pip install -e ".[dev]" + pytest + + docker: + needs: test + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + + - name: Registry and image names + run: | + REGISTRY="${{ vars.REGISTRY }}" + if [ -z "$REGISTRY" ]; then + REGISTRY="${GITHUB_SERVER_URL#https://}" + REGISTRY="${REGISTRY#http://}" + fi + IMAGE="${REGISTRY}/${GITHUB_REPOSITORY,,}" + echo "REGISTRY=${REGISTRY}" >> "$GITHUB_ENV" + echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV" + + - uses: docker/setup-buildx-action@v3 + + - name: Image tags and labels + id: meta + uses: docker/metadata-action@v5 + with: + images: ${{ env.IMAGE }} + tags: | + type=raw,value=latest,enable={{is_default_branch}} + type=ref,event=branch + type=ref,event=tag + type=sha,prefix=sha- + type=raw,value=manual,enable=${{ github.event_name == 'workflow_dispatch' }} + + - name: Log in to the Gitea Container Registry + if: github.event_name != 'pull_request' + uses: docker/login-action@v3 + with: + registry: ${{ env.REGISTRY }} + username: ${{ secrets.REGISTRY_USERNAME || github.actor }} + password: ${{ secrets.REGISTRY_TOKEN || secrets.GITEA_TOKEN }} + + - name: Build and push + uses: docker/build-push-action@v6 + with: + context: . + push: ${{ github.event_name != 'pull_request' }} + tags: ${{ steps.meta.outputs.tags }} + labels: ${{ steps.meta.outputs.labels }} + provenance: false diff --git a/README.md b/README.md index 4352041..728b245 100644 --- a/README.md +++ b/README.md @@ -20,6 +20,7 @@ The **private key is generated on the server**, packed into a PKCS#12, and sent | --- | --- | | [docs/architecture.md](docs/architecture.md) | Request flow, the two PKCS#12s, why phones never talk to the CA | | [docs/setup.md](docs/setup.md) | OIDC, LDAP, certsrv, TLS, Docker / `python -m cert_portal` | +| [docs/gitea.md](docs/gitea.md) | Gitea Actions: build and publish to the container registry | | [docs/adcs.md](docs/adcs.md) | Web Enrollment, template flags, SID URI / strong mapping | | [docs/profile-signing.md](docs/profile-signing.md) | Signing identity, device trust, CMS format | | [docs/security.md](docs/security.md) | Key lifetime, logging, sessions, who can download | @@ -31,7 +32,7 @@ After sign-in, operators and users can also open **Help** in the app (`/help`) w 1. Copy `.env.example` to `.env` and fill in OIDC, LDAP, certsrv, and the profile-signing PKCS#12 path. 2. Python 3.12+: `pip install -e ".[dev]"` then `python -m cert_portal` -3. Or: `docker build -t cert-portal .` and run with `--env-file .env`, publishing port 8000, mounting the signing P12. +3. Or pull `git.atlashorizon.net/nick/cert-portal:latest` from the Gitea registry (see [docs/gitea.md](docs/gitea.md)), or `docker build -t cert-portal .` locally. Run with `--env-file .env`, publishing port 8000, mounting the signing P12. Put a reverse proxy in front for TLS. Set `PUBLIC_BASE_URL` and `OIDC_REDIRECT_URI` to that HTTPS origin (`/auth/callback`). diff --git a/docs/gitea.md b/docs/gitea.md new file mode 100644 index 0000000..b73e944 --- /dev/null +++ b/docs/gitea.md @@ -0,0 +1,55 @@ +# Gitea Actions and Container Registry + +The workflow in [`.gitea/workflows/container.yml`](../.gitea/workflows/container.yml) runs tests, builds the Docker image, and publishes it to this Gitea instance’s OCI registry. + +## What it publishes + +On `main`, version tags (`v*`), and manual **Run workflow**: + +``` +git.atlashorizon.net/nick/cert-portal:latest # default branch only +git.atlashorizon.net/nick/cert-portal:main +git.atlashorizon.net/nick/cert-portal:sha- +git.atlashorizon.net/nick/cert-portal:v1.2.3 # git tags named v* +``` + +The host is taken from the Actions server URL (or `vars.REGISTRY` if you set one). The image name is `{registry}/{owner}/{repo}` in lowercase, which is what [Gitea’s container registry](https://docs.gitea.com/usage/packages/container) requires. + +Pull requests **build** the image but do **not** push. + +## One-time Gitea setup + +1. Enable **Actions** on the repository (`Settings` → `Actions`). +2. Enable **Packages** for the owner (user or org) if it is not already on. +3. Register an **act_runner** that can build images: Docker socket or privileged `dind`. A label matching `runs-on: ubuntu-latest` (Gitea’s default runner label) is enough. +4. If `actions/checkout@v4` and the Docker actions cannot be fetched, either set Gitea `[actions].DEFAULT_ACTIONS_URL = github` or mirror those actions onto this instance and change the `uses:` lines. + +### Registry login from the job + +The workflow logs in as the user who triggered the job (`github.actor`) with `secrets.GITEA_TOKEN` (the job token). Give that token **package write** if your instance uses restricted token permissions (`Settings` → `Actions` → `General`, and `permissions: packages: write` in the workflow). + +If login returns **401**, the job token cannot write packages on this Gitea version. Create a PAT with **package read/write** (and 2FA/OAuth accounts must use a token, not a password) and add repository secrets: + +| Secret | Purpose | +| --- | --- | +| `REGISTRY_TOKEN` | PAT used instead of `GITEA_TOKEN` | +| `REGISTRY_USERNAME` | Optional; defaults to the triggering user | + +Optional instance setting: + +| Variable | Purpose | +| --- | --- | +| `REGISTRY` | Registry host if it is not the Gitea web hostname | + +After the first successful push, open **Packages** on the user/org (or the repo if Gitea linked the package). Pull: + +```bash +docker login git.atlashorizon.net +docker pull git.atlashorizon.net/nick/cert-portal:latest +``` + +Run it the same way as a local build; see [setup.md](setup.md). + +## Manual run + +**Actions** → **Container** → **Run workflow**. That tags the image `manual` in addition to the SHA tag. diff --git a/docs/setup.md b/docs/setup.md index 4548212..2f36c5e 100644 --- a/docs/setup.md +++ b/docs/setup.md @@ -89,6 +89,16 @@ docker run --rm -p 8000:8000 --env-file .env \ The image runs as UID 1000. The signing P12 path inside the container must match `PROFILE_SIGNING_P12_PATH`. +CI on this Gitea publishes `git.atlashorizon.net/nick/cert-portal` (see [gitea.md](gitea.md)): + +```bash +docker login git.atlashorizon.net +docker pull git.atlashorizon.net/nick/cert-portal:latest +docker run --rm -p 8000:8000 --env-file .env \ + -v /etc/cert-portal:/etc/cert-portal:ro \ + git.atlashorizon.net/nick/cert-portal:latest +``` + ## 8. OpenAPI `/docs`, `/redoc`, and `/openapi.json` are **off** when `ENVIRONMENT=production` unless you set `DOCS_ENABLED=true`. They are on in `development`. Do not expose Swagger to the internet without additional access control.