Trez/rinoa-docker
4
0
Fork 0
Code Issues 1 Pull Requests 8 Actions Activity

Adding Jinja macro for Vault lookup.
Gitea Branch PR & Ansible Deployment / Check and Create PR (push) Successful in 6m4s
Details
Gitea Branch PR & Ansible Deployment / Ansible Lint (push) Failing after 15m39s
Details
Gitea Branch PR & Ansible Deployment / PR Merge (push) Successful in 7m16s
Details
Gitea Branch PR & Ansible Deployment / Ansible Config Deployment (push) Successful in 14m40s
Details

Browse Source
This commit is contained in:
Trez.One
2025-06-13 21:52:09 -04:00
parent 7cf7c4a2aa
commit add421bb81
73 changed files with 191 additions and 114 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/app-configs/gitea/act-runner/config.yaml.j2
+3
View File
@@ -1,3 +1,6 @@
{% import '../macros/rinoa-macros.j2' as vault %}
{% set vault_addr = 'https://vault.trez.wtf' %}
{% set secrets_path = 'rinoa-docker/env' %}
# Example configuration file, it's safe to copy this as the default config file without any modification.
# You don't have to copy this file to your instance,
ansible/app-configs/gitea/app.ini.j2
+6 -5
View File
@@ -1,3 +1,4 @@
{% import '../macros/rinoa-macros.j2' as vault %}
{% set vault_addr = 'https://vault.trez.wtf' %}
{% set secrets_path = 'rinoa-docker/env' %}
@@ -27,7 +28,7 @@ DISABLE_SSH = false
SSH_PORT = 22
SSH_LISTEN_PORT = 22
LFS_START_SERVER = true
LFS_JWT_SECRET = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_LFS_JWT_SECRET'] }}
LFS_JWT_SECRET = {{ vault.vault_secret('env', 'GITEA_LFS_JWT_SECRET') }}
OFFLINE_MODE = true
[database]
@@ -36,7 +37,7 @@ DB_TYPE = postgres
HOST = gitea-db:5432
NAME = gitea
USER = gitea
PASSWD = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_PG_DB_PASSWORD'] }}
PASSWD = {{ vault.vault_secret('env', 'GITEA_PG_DB_PASSWORD') }}
LOG_SQL = false
SCHEMA =
SSL_MODE = disable
@@ -70,7 +71,7 @@ INSTALL_LOCK = true
SECRET_KEY =
REVERSE_PROXY_LIMIT = 1
REVERSE_PROXY_TRUSTED_PROXIES = *
INTERNAL_TOKEN = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_INTERNAL_TOKEN'] }}
INTERNAL_TOKEN = {{ vault.vault_secret('env', 'GITEA_INTERNAL_TOKEN') }}
PASSWORD_HASH_ALGO = pbkdf2
[service]
@@ -89,7 +90,7 @@ NO_REPLY_ADDRESS = noreply@trez.wtf
PATH = /data/git/lfs
[mailer]
PASSWD = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['POSTAL_SMTP_AUTH_PASSWORD'] }}
PASSWD = {{ vault.vault_secret('env', 'POSTAL_SMTP_AUTH_PASSWORD') }}
PROTOCOL = smtp
ENABLED = true
FROM = '"Gitea" <noreply@trez.wtf>'
@@ -112,7 +113,7 @@ DEFAULT_MERGE_STYLE = merge
DEFAULT_TRUST_MODEL = committer
[oauth2]
JWT_SECRET = {{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_OAUTH2_JWT_SECRET'] }}
JWT_SECRET = {{ vault.vault_secret('env', 'GITEA_OAUTH2_JWT_SECRET') }}
[ui]
THEMES =
ansible/app-configs/gitea/gitea-sonarqube-bot/config.yaml.j2
+5 -4
View File
@@ -1,3 +1,4 @@
{% import '../macros/rinoa-macros.j2' as vault %}
{% set vault_addr = 'https://vault.trez.wtf' %}
{% set secrets_path = 'rinoa-docker/env' %}
@@ -9,7 +10,7 @@ gitea:
# Created access token for the user that shall be used as bot account.
# User needs "Read project" permissions with access to "Pull Requests"
token:
value: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_TOKEN'] }}"
value: "{{ vault.vault_secret('env', 'GITEA_SONARQUBE_BOT_GITEA_TOKEN') }}"
# # or path to file containing the plain text secret
# file: /path/to/gitea/token
@@ -18,7 +19,7 @@ gitea:
# The bot looks for `X-Gitea-Signature` header containing the sha256 hmac hash of the plain text secret. If the header
# exists and no webhookSecret is defined here, the bot will ignore the request, because it cannot be validated.
webhook:
secret: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_GITEA_WEBHOOK_SECRET'] }}"
secret: "{{ vault.vault_secret('env', 'GITEA_SONARQUBE_BOT_GITEA_WEBHOOK_SECRET') }}"
# # or path to file containing the plain text secret
# secretFile: /path/to/gitea/webhook/secret
@@ -35,7 +36,7 @@ sonarqube:
# Created access token for the user that shall be used as bot account.
# User needs "Browse on project" permissions
token:
value: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_SQUBE_TOKEN'] }}"
value: "{{ vault.vault_secret('env', 'GITEA_SONARQUBE_BOT_SQUBE_TOKEN') }}"
# # or path to file containing the plain text secret
# file: /path/to/sonarqube/token
@@ -45,7 +46,7 @@ sonarqube:
# If the header exists and no webhookSecret is defined here, the bot will ignore the request, because it cannot be
# validated.
webhook:
secret: "{{ lookup('community.hashi_vault.vault_kv2_get', 'env', engine_mount_point='rinoa-docker', url=vault_addr, token=vault_token_cleaned)['secret']['GITEA_SONARQUBE_BOT_SQUBE_WEBHOOK_SECRET'] }}"
secret: "{{ vault.vault_secret('env', 'GITEA_SONARQUBE_BOT_SQUBE_WEBHOOK_SECRET') }}"
# # or path to file containing the plain text secret
# secretFile: /path/to/sonarqube/webhook/secret