ctao/portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

deploy: join gitea netns instead of bridge (machine kernel lacks ip_tables for rootless netavark); pin image digests; push-to-create repo

Browse Source
This commit is contained in:
ctao
2026-07-28 14:07:44 +02:00
parent ed7a9c01e7
commit 80d886c0cb
6 changed files with 28 additions and 34 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/ctao-demo-gitea.container
+10 -7
View File
@@ -11,16 +11,15 @@ After=network-online.target
[Container]
ContainerName=ctao-demo-gitea
# Same major as the local demo (1.27). Re-pin to the exact digest at install:
# podman pull docker.io/gitea/gitea:1.27-rootless
# podman images --digests docker.io/gitea/gitea → paste sha256 here
Image=docker.io/gitea/gitea:1.27-rootless
# Pinned by digest at install (2026-07-28); tag kept for readability.
Image=docker.io/gitea/gitea:1.27-rootless@sha256:36cce26be71609091e1236d5b5de2c66a81fb8a7d45756a5fd3b7a28c11733b7
# The rootless image runs as uid 1000 inside; keep-id maps it to the host user
# so the bind-mounted dirs stay owned by `strapi` (no chown, no root anywhere).
UserNS=keep-id:uid=1000,gid=1000
# Shared bridge with the build containers (name-resolvable as ctao-demo-gitea);
# host loopback stays out of reach for build code — see ctao-demo.network.
Network=ctao-demo.network
# Networking: default rootless pasta (userspace — the machine's kernel lacks
# ip_tables for rootless netavark bridges, and we have no sudo). The build
# container joins THIS container's netns (--network=container:ctao-demo-gitea),
# so it sees Gitea on localhost:3000 while the HOST loopback stays invisible.
Volume=%h/ctao-portal-demo/gitea-data:/var/lib/gitea:Z
Volume=%h/ctao-portal-demo/gitea-config:/etc/gitea:Z
PublishPort=3000:3000
@@ -37,6 +36,10 @@ Environment=GITEA__database__DB_TYPE=sqlite3
Environment=GITEA__security__INSTALL_LOCK=true
Environment=GITEA__service__DISABLE_REGISTRATION=true
Environment=GITEA__mailer__ENABLED=false
# First `git push` auto-creates the repo (no UI step); public so the build
# pipeline can clone anonymously — content is the public site anyway.
Environment=GITEA__repository__ENABLE_PUSH_CREATE_USER=true
Environment=GITEA__repository__DEFAULT_PRIVATE=public
# Sveltia is served from the portal vhost and calls the Gitea API cross-origin.
# TODO(vhost): tighten * to the portal origin once known, and add
# GITEA__cors__SCHEME=https (the [cors] SCHEME default is http).