gitea actions

.gitea/workflows/container.yml

@@ -0,0 +1,78 @@
+name: Container
+
+on:
+  push:
+    branches: [main]
+    tags: ["v*"]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+concurrency:
+  group: container-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install and test
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+          pytest
+
+  docker:
+    needs: test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Registry and image names
+        run: |
+          REGISTRY="${{ vars.REGISTRY }}"
+          if [ -z "$REGISTRY" ]; then
+            REGISTRY="${GITHUB_SERVER_URL#https://}"
+            REGISTRY="${REGISTRY#http://}"
+          fi
+          IMAGE="${REGISTRY}/${GITHUB_REPOSITORY,,}"
+          echo "REGISTRY=${REGISTRY}" >> "$GITHUB_ENV"
+          echo "IMAGE=${IMAGE}" >> "$GITHUB_ENV"
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Image tags and labels
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ env.IMAGE }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=ref,event=branch
+            type=ref,event=tag
+            type=sha,prefix=sha-
+            type=raw,value=manual,enable=${{ github.event_name == 'workflow_dispatch' }}
+
+      - name: Log in to the Gitea Container Registry
+        if: github.event_name != 'pull_request'
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ secrets.REGISTRY_USERNAME || github.actor }}
+          password: ${{ secrets.REGISTRY_TOKEN || secrets.GITEA_TOKEN }}
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: ${{ github.event_name != 'pull_request' }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          provenance: false

README.md

@@ -20,6 +20,7 @@ The **private key is generated on the server**, packed into a PKCS#12, and sent
 | --- | --- |
 | [docs/architecture.md](docs/architecture.md) | Request flow, the two PKCS#12s, why phones never talk to the CA |
 | [docs/setup.md](docs/setup.md) | OIDC, LDAP, certsrv, TLS, Docker / `python -m cert_portal` |
+| [docs/gitea.md](docs/gitea.md) | Gitea Actions: build and publish to the container registry |
 | [docs/adcs.md](docs/adcs.md) | Web Enrollment, template flags, SID URI / strong mapping |
 | [docs/profile-signing.md](docs/profile-signing.md) | Signing identity, device trust, CMS format |
 | [docs/security.md](docs/security.md) | Key lifetime, logging, sessions, who can download |
@@ -31,7 +32,7 @@ After sign-in, operators and users can also open **Help** in the app (`/help`) w
 
 1. Copy `.env.example` to `.env` and fill in OIDC, LDAP, certsrv, and the profile-signing PKCS#12 path.
 2. Python 3.12+: `pip install -e ".[dev]"` then `python -m cert_portal`
-3. Or: `docker build -t cert-portal .` and run with `--env-file .env`, publishing port 8000, mounting the signing P12.
+3. Or pull `git.atlashorizon.net/nick/cert-portal:latest` from the Gitea registry (see [docs/gitea.md](docs/gitea.md)), or `docker build -t cert-portal .` locally. Run with `--env-file .env`, publishing port 8000, mounting the signing P12.
 
 Put a reverse proxy in front for TLS. Set `PUBLIC_BASE_URL` and `OIDC_REDIRECT_URI` to that HTTPS origin (`/auth/callback`).
 

docs/gitea.md

@@ -0,0 +1,55 @@
+# Gitea Actions and Container Registry
+
+The workflow in [`.gitea/workflows/container.yml`](../.gitea/workflows/container.yml) runs tests, builds the Docker image, and publishes it to this Gitea instance’s OCI registry.
+
+## What it publishes
+
+On `main`, version tags (`v*`), and manual **Run workflow**:
+
+```
+git.atlashorizon.net/nick/cert-portal:latest   # default branch only
+git.atlashorizon.net/nick/cert-portal:main
+git.atlashorizon.net/nick/cert-portal:sha-<short-sha>
+git.atlashorizon.net/nick/cert-portal:v1.2.3   # git tags named v*
+```
+
+The host is taken from the Actions server URL (or `vars.REGISTRY` if you set one). The image name is `{registry}/{owner}/{repo}` in lowercase, which is what [Gitea’s container registry](https://docs.gitea.com/usage/packages/container) requires.
+
+Pull requests **build** the image but do **not** push.
+
+## One-time Gitea setup
+
+1. Enable **Actions** on the repository (`Settings` → `Actions`).
+2. Enable **Packages** for the owner (user or org) if it is not already on.
+3. Register an **act_runner** that can build images: Docker socket or privileged `dind`. A label matching `runs-on: ubuntu-latest` (Gitea’s default runner label) is enough.
+4. If `actions/checkout@v4` and the Docker actions cannot be fetched, either set Gitea `[actions].DEFAULT_ACTIONS_URL = github` or mirror those actions onto this instance and change the `uses:` lines.
+
+### Registry login from the job
+
+The workflow logs in as the user who triggered the job (`github.actor`) with `secrets.GITEA_TOKEN` (the job token). Give that token **package write** if your instance uses restricted token permissions (`Settings` → `Actions` → `General`, and `permissions: packages: write` in the workflow).
+
+If login returns **401**, the job token cannot write packages on this Gitea version. Create a PAT with **package read/write** (and 2FA/OAuth accounts must use a token, not a password) and add repository secrets:
+
+| Secret | Purpose |
+| --- | --- |
+| `REGISTRY_TOKEN` | PAT used instead of `GITEA_TOKEN` |
+| `REGISTRY_USERNAME` | Optional; defaults to the triggering user |
+
+Optional instance setting:
+
+| Variable | Purpose |
+| --- | --- |
+| `REGISTRY` | Registry host if it is not the Gitea web hostname |
+
+After the first successful push, open **Packages** on the user/org (or the repo if Gitea linked the package). Pull:
+
+```bash
+docker login git.atlashorizon.net
+docker pull git.atlashorizon.net/nick/cert-portal:latest
+```
+
+Run it the same way as a local build; see [setup.md](setup.md).
+
+## Manual run
+
+**Actions** → **Container** → **Run workflow**. That tags the image `manual` in addition to the SHA tag.

docs/setup.md

@@ -89,6 +89,16 @@ docker run --rm -p 8000:8000 --env-file .env \
 
 The image runs as UID 1000. The signing P12 path inside the container must match `PROFILE_SIGNING_P12_PATH`.
 
+CI on this Gitea publishes `git.atlashorizon.net/nick/cert-portal` (see [gitea.md](gitea.md)):
+
+```bash
+docker login git.atlashorizon.net
+docker pull git.atlashorizon.net/nick/cert-portal:latest
+docker run --rm -p 8000:8000 --env-file .env \
+  -v /etc/cert-portal:/etc/cert-portal:ro \
+  git.atlashorizon.net/nick/cert-portal:latest
+```
+
 ## 8. OpenAPI
 
 `/docs`, `/redoc`, and `/openapi.json` are **off** when `ENVIRONMENT=production` unless you set `DOCS_ENABLED=true`. They are on in `development`. Do not expose Swagger to the internet without additional access control.