ctao/portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

vhost switch: Sveltia backend + Gitea ROOT_URL to https ingress domains, CORS locked to the portal origin

Browse Source
This commit is contained in:
ctao
2026-07-29 10:35:26 +02:00
parent a74eef0e47
commit 746b015e85
2 changed files with 12 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/ctao-demo-gitea.container
+6 -7
View File
@@ -28,9 +28,8 @@ PublishPort=3000:3000
# (see .skills/gitea/SKILL.md). Secrets: none here; the admin account is # (see .skills/gitea/SKILL.md). Secrets: none here; the admin account is
# created interactively after first start (README). # created interactively after first start (README).
Environment=GITEA__server__HTTP_PORT=3000 Environment=GITEA__server__HTTP_PORT=3000
# TODO(vhost): set to the public URL once the ingress vhost exists, # Public URL via the Cyfronet ingress (vhost by Hubert, 2026-07-29).
# e.g. https://gitea-portal-demo.isl-dev.grid.cyfronet.pl/ — then restart. Environment=GITEA__server__ROOT_URL=https://astro-git.isl-dev.grid.cyfronet.pl/
Environment=GITEA__server__ROOT_URL=http://localhost:3000/
Environment=GITEA__server__DISABLE_SSH=true Environment=GITEA__server__DISABLE_SSH=true
Environment=GITEA__database__DB_TYPE=sqlite3 Environment=GITEA__database__DB_TYPE=sqlite3
Environment=GITEA__security__INSTALL_LOCK=true Environment=GITEA__security__INSTALL_LOCK=true
@@ -42,11 +41,11 @@ Environment=GITEA__repository__ENABLE_PUSH_CREATE_USER=true
Environment=GITEA__repository__DEFAULT_PRIVATE=public Environment=GITEA__repository__DEFAULT_PRIVATE=public
# Push-created repos have their OWN default (true = private) — learned the hard way: # Push-created repos have their OWN default (true = private) — learned the hard way:
Environment=GITEA__repository__DEFAULT_PUSH_CREATE_PRIVATE=false Environment=GITEA__repository__DEFAULT_PUSH_CREATE_PRIVATE=false
# Sveltia is served from the portal vhost and calls the Gitea API cross-origin. # Sveltia is served from the portal vhost and calls the Gitea API cross-origin
# TODO(vhost): tighten * to the portal origin once known, and add # — CORS locked to exactly that origin.
# GITEA__cors__SCHEME=https (the [cors] SCHEME default is http).
Environment=GITEA__cors__ENABLED=true Environment=GITEA__cors__ENABLED=true
Environment=GITEA__cors__ALLOW_DOMAIN=* Environment=GITEA__cors__SCHEME=https
Environment=GITEA__cors__ALLOW_DOMAIN=astro.isl-dev.grid.cyfronet.pl
Environment=GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS Environment=GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
[Service] [Service]
public/admin/config.yml
+6 -8
View File
@@ -1,15 +1,13 @@
# Sveltia CMS config — backend: Gitea on the Cyfronet machine (demo). Editors # Sveltia CMS config — backend: Gitea behind the Cyfronet ingress (HTTPS
# log in via Gitea OAuth (PKCE, no client secret); edits are committed to the # vhost). Editors log in via Gitea OAuth (PKCE, no client secret); edits are
# ctao/portal repo. localhost:3000 works both on the machine and through the # committed to the ctao/portal repo. Gitea's ROOT_URL and CORS are pinned to
# ssh -L tunnel (same port number keeps Gitea's ROOT_URL valid). # these origins in deploy/ctao-demo-gitea.container.
# TODO(vhost): switch base_url/api_root to the public Gitea URL once the
# ingress vhost exists (and update the OAuth app's redirect_uris + ROOT_URL).
backend: backend:
name: gitea name: gitea
repo: ctao/portal repo: ctao/portal
branch: main branch: main
base_url: http://localhost:3000 base_url: https://astro-git.isl-dev.grid.cyfronet.pl
api_root: http://localhost:3000/api/v1 api_root: https://astro-git.isl-dev.grid.cyfronet.pl/api/v1
app_id: cf1c44ac-ebe6-4a97-bf2f-f7f26ef1126c app_id: cf1c44ac-ebe6-4a97-bf2f-f7f26ef1126c
# OAuth only — hides the "access token" sign-in option (documented # OAuth only — hides the "access token" sign-in option (documented
# auth_methods). The "Work with Local Repository" button needs no config: # auth_methods). The "Work with Local Repository" button needs no config: