servers/roles/forgejo/tasks/main.yml

154 lines
4.9 KiB
YAML

- name: Add testing repo
lineinfile:
path: /etc/apk/repositories
line: '@testing https://dl-cdn.alpinelinux.org/alpine/edge/testing'
register: repo
- name: Install forgejo
package:
update_cache: '{{ repo.changed }}'
name:
- forgejo@testing
- forgejo-runner@testing
- podman
- name: Create nginx site
template:
dest: /etc/nginx/http.d/forgejo.conf
src: forgejo.conf.j2
notify: reload nginx
- name: Configure forgejo
ini_file:
path: /etc/forgejo/app.ini
section: '{{ item.section | default("") }}'
option: '{{ item.option }}'
value: '{{ item.value }}'
loop:
- { option: APP_NAME, value: 'FRI git' }
- { section: oauth2_client, option: ENABLE_AUTO_REGISTRATION, value: true }
- { section: oauth2_client, option: USERNAME, value: email }
- { section: service, option: ALLOW_ONLY_EXTERNAL_REGISTRATION, value: true }
- { section: service, option: DEFAULT_USER_VISIBILITY, value: private }
- { section: service.explore, option: DEFAULT_USERS_PAGE, value: private }
- { section: database, option: SQLITE_JOURNAL_MODE, value: WAL }
- { section: log, option: ROOT_PATH, value: /var/lib/forgejo/log }
- { section: server, option: ROOT_URL, value: 'https://{{ dns_name }}/' }
- { section: server, option: PROTOCOL, value: http+unix }
- { section: server, option: HTTP_ADDR, value: socket }
- { section: server, option: UNIX_SOCKET_PERMISSION, value: 660 }
- { section: server, option: LFS_START_SERVER, value: true }
- { section: lfs, option: PATH, value: /var/lib/forgejo/data/lfs }
- { section: repository, option: DEFAULT_BRANCH, value: master }
- { section: repository, option: ENABLE_PUSH_CREATE_ORG, value: true }
- { section: repository, option: ENABLE_PUSH_CREATE_USER, value: true }
- { section: ui, option: AMBIGUOUS_UNICODE_DETECTION, value: false }
- { section: other, option: SHOW_FOOTER_VERSION, value: false }
- { section: other, option: SHOW_FOOTER_TEMPLATE_LOAD_TIME, value: false }
- { section: cron.update_checker, option: ENABLED, value: false }
- { section: security, option: INSTALL_LOCK, value: true }
notify: restart forgejo
- name: Enable forgejo service
service:
name: forgejo
enabled: yes
notify: restart forgejo
- meta: flush_handlers
- name: Set up authentication
become: yes
become_user: forgejo
block:
- name: Create admin user
command: |
forgejo admin user create --admin
--username '{{ password.admin_user }}'
--email '{{ password.admin_mail }}'
--password '{{ password.admin_pass }}'
notify: restart forgejo
register: result
changed_when: 'result.rc == 0'
failed_when: 'result.rc != 0 and "user already exists" not in result.stderr'
- name: Set up SSO
command: |
forgejo admin auth add-oauth --provider=openidConnect \
--name '{{ password.oidc_name }}'
--auto-discover-url '{{ password.oidc_endpoint }}'
--key '{{ password.oidc_client_id }}'
--secret '{{ password.oidc_client_secret }}'
register: result
changed_when: 'result.rc == 0'
failed_when: 'result.rc != 0 and "login source already exists" not in result.stderr'
- name: Get forgejo-runner user
user:
name: forgejo-runner
register: user_info
- name: Configure subuid
lineinfile:
path: /etc/subuid
line: '{{ user_info.name }}:{{ user_info.uid }}00000:65536'
regexp: '^{{ user_info.name }}:'
- name: Configure subgid
lineinfile:
path: /etc/subgid
line: '{{ user_info.name }}:{{ user_info.group }}00000:65536'
regexp: '^{{ user_info.name }}:'
- name: Create podman service for forgejo-runner
file:
path: /etc/init.d/podman.forgejo-runner
src: podman
state: link
- name: Configure podman service for forgejo-runner
copy:
dest: /etc/conf.d/podman.forgejo-runner
content: podman_user="forgejo-runner"
- name: Configure forgejo-runner
template:
dest: /etc/forgejo-runner/config.yaml
src: config.yaml.j2
owner: forgejo-runner
group: forgejo-runner
mode: 0600
notify: restart forgejo-runner
- name: Check runner registration
stat:
path: /var/lib/forgejo-runner/.runner
register: runner_config
- name: Register runner
when: not runner_config.stat.exists
notify: restart forgejo-runner
block:
- name: Get runner token
become: yes
become_user: forgejo
command: forgejo actions generate-runner-token
register: token
- name: Register runner
become: yes
become_user: forgejo-runner
command: |
forgejo-runner register --no-interactive --name runner
--instance https://git.fri.uni-lj.si
--token '{{ token.stdout }}'
- name: Enable forgejo-runner services
service:
name: '{{ item }}'
state: started
enabled: yes
loop:
- forgejo-runner
- podman.forgejo-runner