-
Notifications
You must be signed in to change notification settings - Fork 4
/
main.yml
192 lines (160 loc) · 9.72 KB
/
main.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
---
forgejo_enabled: true
forgejo_version: 9.0.3
forgejo_identifier: forgejo
forgejo_scheme: https
# The fully-qualified name of your Forgejo server (e.g. `forgejo.example.com`)
forgejo_hostname: ''
forgejo_path_prefix: /
forgejo_uid: ''
forgejo_gid: ''
forgejo_container_image: "{{ forgejo_container_image_registry_prefix }}forgejo/forgejo:{{ forgejo_container_image_tag }}"
forgejo_container_image_tag: "{{ forgejo_version }}-rootless"
forgejo_container_image_force_pull: "{{ forgejo_container_image.endswith(':latest') }}"
forgejo_container_image_registry_prefix: codeberg.org/
forgejo_base_path: "/{{ forgejo_identifier }}"
forgejo_data_dir_path: "{{ forgejo_base_path }}/data"
forgejo_config_dir_path: "{{ forgejo_base_path }}/config"
forgejo_ssh_port: 22
forgejo_http_bind_port: ''
forgejo_ssh_bind_port: "{{ forgejo_ssh_port }}"
forgejo_systemd_required_systemd_services_list: ['docker.service']
forgejo_config_database_type: postgres
forgejo_config_database_hostname: ''
forgejo_config_database_port: 5432
forgejo_config_database_name: forgejo
forgejo_config_database_username: ''
forgejo_config_database_password: ''
forgejo_config_root_url: "{{ forgejo_scheme }}://{{ forgejo_hostname }}{{ forgejo_path_prefix }}"
# Controls the RUN_USER configuration setting (`GITEA____RUN_USER` environment variable).
#
# This defaults to `git` in the upstream configuration.
#
# On startup, Forgejo checks if the resolved username for the user it works with matches the RUN_USER.
#
# Because we run the container with a custom user (forgejo_uid),
# and not with uid=1000 matching the git user and inside the container,
# unless we unset this, we'd get an error message:
# > `Expect user 'git' but current user is: `
# The relevant check is here: https://github.com/go-forgejo/forgejo/blob/ccd3a55bf4f07a390e13d48100c58fb937fd3dcf/modules/setting/setting.go#L297-L300C4
#
# Unsetting this to an empty string makes it match. Unless you forgejo_uid accidentally hits some other user that is part of the container's /etc/passwd file.
forgejo_config_run_user: "{{ 'git' if forgejo_uid | string == '1000' else '' }}"
# When integrating Forgejo with Woodpecker CI, and if Woodpecker is
# served under a subpath (e.g. `https://forgejo.host/ci`), it is
# necessary to use Docker's `--add-host` option to point Forgejo to
# the external host IP, so that webhook calls to Woodpecker can work.
#
# For example:
#
# forgejo_container_add_host_domain_name: "{{ devture_woodpecker_ci_server_hostname }}"
# forgejo_container_add_host_domain_ip_address: "{{ ansible_host }}"
#
# Don't forget to also update `webhook.ALLOWED_HOST_LIST` on Forgejo's
# app.ini config file.
forgejo_container_add_host_domain_name: ''
forgejo_container_add_host_domain_ip_address: ''
# forgejo_container_labels_traefik_enabled controls whether labels to assist a Traefik reverse-proxy will be attached to the container.
# See `roles/custom/forgejo/templates/labels.j2` for details.
#
# To inject your own other container labels, see `forgejo_container_labels_additional_labels`.
forgejo_container_labels_traefik_enabled: true
forgejo_container_labels_traefik_docker_network: ''
forgejo_container_labels_traefik_hostname: "{{ forgejo_hostname }}"
# The path prefix must either be `/` or not end with a slash (e.g. `/forgejo`).
forgejo_container_labels_traefik_path_prefix: "{{ forgejo_path_prefix }}"
forgejo_container_labels_traefik_rule: "Host(`{{ forgejo_container_labels_traefik_hostname }}`){% if forgejo_container_labels_traefik_path_prefix != '/' %} && PathPrefix(`{{ forgejo_container_labels_traefik_path_prefix | quote }}`){% endif %}"
forgejo_container_labels_traefik_priority: 0
forgejo_container_labels_traefik_entrypoints: web-secure
forgejo_container_labels_traefik_tls: "{{ forgejo_container_labels_traefik_entrypoints != 'web' }}"
forgejo_container_labels_traefik_tls_certResolver: default # noqa var-naming
# Controls which additional headers to attach to all HTTP requests.
# To add your own custom request headers, use `forgejo_container_labels_traefik_additional_response_headers_custom`
forgejo_container_labels_traefik_additional_request_headers: "{{ forgejo_container_labels_traefik_additional_request_headers_auto | combine(forgejo_container_labels_traefik_additional_request_headers_custom) }}"
forgejo_container_labels_traefik_additional_request_headers_auto: |
{{
{}
| combine ({'X-Script-Name': forgejo_path_prefix} if forgejo_path_prefix != '/' else {})
}}
forgejo_container_labels_traefik_additional_request_headers_custom: {}
# Controls which additional headers to attach to all HTTP responses.
# To add your own custom response headers, use `forgejo_container_labels_traefik_additional_response_headers_custom`
forgejo_container_labels_traefik_additional_response_headers: "{{ forgejo_container_labels_traefik_additional_response_headers_auto | combine(forgejo_container_labels_traefik_additional_response_headers_custom) }}"
forgejo_container_labels_traefik_additional_response_headers_auto: |
{{
{}
| combine ({'X-XSS-Protection': forgejo_http_header_xss_protection} if forgejo_http_header_xss_protection else {})
| combine ({'X-Frame-Options': forgejo_http_header_frame_options} if forgejo_http_header_frame_options else {})
| combine ({'X-Content-Type-Options': forgejo_http_header_content_type_options} if forgejo_http_header_content_type_options else {})
| combine ({'Content-Security-Policy': forgejo_http_header_content_security_policy} if forgejo_http_header_content_security_policy else {})
| combine ({'Permission-Policy': forgejo_http_header_content_permission_policy} if forgejo_http_header_content_permission_policy else {})
| combine ({'Strict-Transport-Security': forgejo_http_header_strict_transport_security} if forgejo_http_header_strict_transport_security and forgejo_container_labels_traefik_tls else {})
}}
forgejo_container_labels_traefik_additional_response_headers_custom: {}
# forgejo_container_labels_additional_labels contains a multiline string with additional labels to add to the container label file.
# See `roles/custom/forgejo/templates/labels.j2` for details.
#
# Example:
# forgejo_container_labels_additional_labels: |
# my.label=1
# another.label="here"
forgejo_container_labels_additional_labels: ''
# forgejo_container_additional_environment_variables contains a multiline string with additional environment variables to pass to the container.
#
# Example:
# forgejo_container_additional_environment_variables: |
# VAR=1
# ANOTHER=value
forgejo_container_additional_environment_variables: ''
forgejo_container_network: "{{ forgejo_identifier }}"
# A list of additional container networks that the container would be connected to.
# The playbook does not create these networks, so make sure they already exist.
# Use this to expose this container to a reverse proxy, which runs in a different container network.
forgejo_container_additional_networks: "{{ forgejo_container_additional_networks_auto + forgejo_container_additional_networks_custom }}"
forgejo_container_additional_networks_auto: []
forgejo_container_additional_networks_custom: []
# Additional environment variables.
forgejo_environment_variables_additional_variables: ''
# Specifies the value of the `X-XSS-Protection` header
# Stops pages from loading when they detect reflected cross-site scripting (XSS) attacks.
#
# Learn more about it is here:
# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
# - https://portswigger.net/web-security/cross-site-scripting/reflected
forgejo_http_header_xss_protection: "1; mode=block"
# Specifies the value of the `X-Frame-Options` header which controls whether framing can happen.
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options
forgejo_http_header_frame_options: SAMEORIGIN
# Specifies the value of the `X-Content-Type-Options` header.
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options
forgejo_http_header_content_type_options: nosniff
# Specifies the value of the `Content-Security-Policy` header.
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
forgejo_http_header_content_security_policy: frame-ancestors 'self'
# Specifies the value of the `Permission-Policy` header.
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permission-Policy
forgejo_http_header_content_permission_policy: "{{ 'interest-cohort=()' if forgejo_floc_optout_enabled else '' }}"
# Specifies the value of the `Strict-Transport-Security` header.
# See: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
forgejo_http_header_strict_transport_security: "max-age=31536000; includeSubDomains{{ '; preload' if forgejo_hsts_preload_enabled else '' }}"
# Controls whether to send a "Permissions-Policy interest-cohort=();" header along with all responses
#
# Learn more about what it is here:
# - https://www.eff.org/deeplinks/2021/03/googles-floc-terrible-idea
# - https://paramdeo.com/blog/opting-your-website-out-of-googles-floc-network
# - https://amifloced.org/
#
# Of course, a better solution is to just stop using browsers (like Chrome), which participate in such tracking practices.
# See: `forgejo_content_permission_policy`
forgejo_floc_optout_enabled: true
# Controls if HSTS preloading is enabled
#
# In its strongest and recommended form, the [HSTS policy](https://www.chromium.org/hsts) includes all subdomains, and
# indicates a willingness to be "preloaded" into browsers:
# `Strict-Transport-Security: max-age=31536000; includeSubDomains; preload`
# For more information visit:
# - https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
# - https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security
# - https://hstspreload.org/#opt-in
# See: `forgejo_http_header_strict_transport_security`
forgejo_hsts_preload_enabled: false