Co-authored-by: 6543 <6543@obermui.de> Co-authored-by: Lauris BH <lauris@nix.lv>
13 KiB
date | title | slug | weight | toc | draft | menu | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
2020-03-19T19:27:00+02:00 | Installation with Docker | install-with-docker | 10 | false | false |
|
Installation with Docker
Gitea provides automatically updated Docker images within its Docker Hub organization. It is possible to always use the latest stable tag or to use another service that handles updating Docker images.
This reference setup guides users through the setup based on docker-compose
, but the installation
of docker-compose
is out of scope of this documentation. To install docker-compose
itself, follow
the official install instructions.
Table of Contents
{{< toc >}}
Basics
The most simple setup just creates a volume and a network and starts the gitea/gitea:latest
image as a service. Since there is no database available, one can be initialized using SQLite3.
Create a directory like gitea
and paste the following content into a file named docker-compose.yml
.
Note that the volume should be owned by the user/group with the UID/GID specified in the config file.
If you don't give the volume correct permissions, the container may not start.
Also be aware that the tag :latest
will install the current development version.
For a stable release you can use :1
or specify a certain release like :{{< version >}}
.
version: "3"
networks:
gitea:
external: false
services:
server:
image: gitea/gitea:{{< version >}}
container_name: gitea
environment:
- USER_UID=1000
- USER_GID=1000
restart: always
networks:
- gitea
volumes:
- ./gitea:/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
ports:
- "3000:3000"
- "222:22"
Ports
To bind the integrated openSSH daemon and the webserver on a different port, adjust the port section. It's common to just change the host port and keep the ports within the container like they are.
version: "3"
networks:
gitea:
external: false
services:
server:
image: gitea/gitea:{{< version >}}
container_name: gitea
environment:
- USER_UID=1000
- USER_GID=1000
restart: always
networks:
- gitea
volumes:
- ./gitea:/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
ports:
- - "3000:3000"
- - "222:22"
+ - "8080:3000"
+ - "2221:22"
Databases
MySQL database
To start Gitea in combination with a MySQL database, apply these changes to the
docker-compose.yml
file created above.
version: "3"
networks:
gitea:
external: false
services:
server:
image: gitea/gitea:{{< version >}}
container_name: gitea
environment:
- USER_UID=1000
- USER_GID=1000
+ - DB_TYPE=mysql
+ - DB_HOST=db:3306
+ - DB_NAME=gitea
+ - DB_USER=gitea
+ - DB_PASSWD=gitea
restart: always
networks:
- gitea
volumes:
- ./gitea:/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
ports:
- "3000:3000"
- "222:22"
+ depends_on:
+ - db
+
+ db:
+ image: mysql:5.7
+ restart: always
+ environment:
+ - MYSQL_ROOT_PASSWORD=gitea
+ - MYSQL_USER=gitea
+ - MYSQL_PASSWORD=gitea
+ - MYSQL_DATABASE=gitea
+ networks:
+ - gitea
+ volumes:
+ - ./mysql:/var/lib/mysql
PostgreSQL database
To start Gitea in combination with a PostgreSQL database, apply these changes to
the docker-compose.yml
file created above.
version: "3"
networks:
gitea:
external: false
services:
server:
image: gitea/gitea:{{< version >}}
container_name: gitea
environment:
- USER_UID=1000
- USER_GID=1000
+ - DB_TYPE=postgres
+ - DB_HOST=db:5432
+ - DB_NAME=gitea
+ - DB_USER=gitea
+ - DB_PASSWD=gitea
restart: always
networks:
- gitea
volumes:
- ./gitea:/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
ports:
- "3000:3000"
- "222:22"
+ depends_on:
+ - db
+
+ db:
+ image: postgres:9.6
+ restart: always
+ environment:
+ - POSTGRES_USER=gitea
+ - POSTGRES_PASSWORD=gitea
+ - POSTGRES_DB=gitea
+ networks:
+ - gitea
+ volumes:
+ - ./postgres:/var/lib/postgresql/data
Named volumes
To use named volumes instead of host volumes, define and use the named volume
within the docker-compose.yml
configuration. This change will automatically
create the required volume. You don't need to worry about permissions with
named volumes; Docker will deal with that automatically.
version: "3"
networks:
gitea:
external: false
+volumes:
+ gitea:
+ driver: local
+
services:
server:
image: gitea/gitea:{{< version >}}
container_name: gitea
restart: always
networks:
- gitea
volumes:
- - ./gitea:/data
+ - gitea:/data
- /etc/timezone:/etc/timezone:ro
- /etc/localtime:/etc/localtime:ro
ports:
- "3000:3000"
- "222:22"
MySQL or PostgreSQL containers will need to be created separately.
Startup
To start this setup based on docker-compose
, execute docker-compose up -d
,
to launch Gitea in the background. Using docker-compose ps
will show if Gitea
started properly. Logs can be viewed with docker-compose logs
.
To shut down the setup, execute docker-compose down
. This will stop
and kill the containers. The volumes will still exist.
Notice: if using a non-3000 port on http, change app.ini to match
LOCAL_ROOT_URL = http://localhost:3000/
.
Installation
After starting the Docker setup via docker-compose
, Gitea should be available using a
favorite browser to finalize the installation. Visit http://server-ip:3000 and follow the
installation wizard. If the database was started with the docker-compose
setup as
documented above, please note that db
must be used as the database hostname.
Environment variables
You can configure some of Gitea's settings via environment variables:
(Default values are provided in bold)
APP_NAME
: "Gitea: Git with a cup of tea": Application name, used in the page title.RUN_MODE
: prod: Application run mode, affects performance and debugging. Either "dev", "prod" or "test".DOMAIN
: localhost: Domain name of this server, used for the displayed http clone URL in Gitea's UI.SSH_DOMAIN
: localhost: Domain name of this server, used for the displayed ssh clone URL in Gitea's UI. If the install page is enabled, SSH Domain Server takes DOMAIN value in the form (which overwrite this setting on save).SSH_PORT
: 22: SSH port displayed in clone URL.SSH_LISTEN_PORT
: %(SSH_PORT)s: Port for the built-in SSH server.DISABLE_SSH
: false: Disable SSH feature when it's not available. If you want to disable SSH feature, you should set SSH port to0
when installing Gitea.HTTP_PORT
: 3000: HTTP listen port.ROOT_URL
: "": Overwrite the automatically generated public URL. This is useful if the internal and the external URL don't match (e.g. in Docker).LFS_START_SERVER
: false: Enables git-lfs support.DB_TYPE
: sqlite3: The database type in use [mysql, postgres, mssql, sqlite3].DB_HOST
: localhost:3306: Database host address and port.DB_NAME
: gitea: Database name.DB_USER
: root: Database username.DB_PASSWD
: "<empty>": Database user password. Use `your password` for quoting if you use special characters in the password.INSTALL_LOCK
: false: Disallow access to the install page.SECRET_KEY
: "": Global secret key. This should be changed. If this has a value andINSTALL_LOCK
is empty,INSTALL_LOCK
will automatically set totrue
.DISABLE_REGISTRATION
: false: Disable registration, after which only admin can create accounts for users.REQUIRE_SIGNIN_VIEW
: false: Enable this to force users to log in to view any page.USER_UID
: 1000: The UID (Unix user ID) of the user that runs Gitea within the container. Match this to the UID of the owner of the/data
volume if using host volumes (this is not necessary with named volumes).USER_GID
: 1000: The GID (Unix group ID) of the user that runs Gitea within the container. Match this to the GID of the owner of the/data
volume if using host volumes (this is not necessary with named volumes).
Customization
Customization files described here should
be placed in /data/gitea
directory. If using host volumes, it's quite easy to access these
files; for named volumes, this is done through another container or by direct access at
/var/lib/docker/volumes/gitea_gitea/_data
. The configuration file will be saved at
/data/gitea/conf/app.ini
after the installation.
Upgrading
❗❗ Make sure you have volumed data to somewhere outside Docker container ❗❗
To upgrade your installation to the latest release:
# Edit `docker-compose.yml` to update the version, if you have one specified
# Pull new images
docker-compose pull
# Start a new container, automatically removes old one
docker-compose up -d
SSH Container Passthrough
Since SSH is running inside the container, SSH needs to be passed through from the host to the container if SSH support is desired. One option would be to run the container SSH on a non-standard port (or moving the host port to a non-standard port). Another option which might be more straightforward is to forward SSH connections from the host to the container. This setup is explained in the following.
This guide assumes that you have created a user on the host called git
which shares the same UID
/ GID
as the container values USER_UID
/ USER_GID
. These values can be set as environment variables in the docker-compose.yml
:
environment:
- USER_UID=1000
- USER_GID=1000
Next mount /home/git/.ssh
of the host into the container. Otherwise the SSH authentication cannot work inside the container.
volumes:
- /home/git/.ssh/:/data/git/.ssh
Now a SSH key pair needs to be created on the host. This key pair will be used to authenticate the git
user on the host to the container.
sudo -u git ssh-keygen -t rsa -b 4096 -C "Gitea Host Key"
In the next step a file named /app/gitea/gitea
(with executable permissions) needs to be created on the host. This file will issue the SSH forwarding from the host to the container. Add the following contents to /app/gitea/gitea
:
ssh -p 2222 -o StrictHostKeyChecking=no git@127.0.0.1 "SSH_ORIGINAL_COMMAND=\"$SSH_ORIGINAL_COMMAND\" $0 $@"
To make the forwarding work, the SSH port of the container (22) needs to be mapped to the host port 2222 in docker-compose.yml
. Since this port does not need to be exposed to the outside world, it can be mapped to the localhost
of the host machine:
ports:
# [...]
- "127.0.0.1:2222:22"
In addition, /home/git/.ssh/authorized_keys
on the host needs to be modified. It needs to act in the same way as authorized_keys
within the Gitea container. Therefore add
command="/app/gitea/gitea --config=/data/gitea/conf/app.ini serv key-1",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty ssh-rsa <YOUR_SSH_PUBKEY>
and replace <YOUR_SSH_PUBKEY>
with a valid SSH public key of yours.
In addition the public key of the git
user on the host needs to be added to /home/git/.ssh/authorized_keys
so authentication against the container can succeed: echo "$(cat /home/git/.ssh/id_rsa.pub)" >> /home/git/.ssh/authorized_keys
.
Here is a detailed explanation what is happening when a SSH request is made:
- A SSH request is made against the host using the
git
user, e.g.git clone git@domain:user/repo.git
. - In
/home/git/.ssh/authorized_keys
, the command executes the/app/gitea/gitea
script. /app/gitea/gitea
forwards the SSH request to port 2222 which is mapped to the SSH port (22) of the container.- Due to the existence of the public key of the
git
user in/home/git/.ssh/authorized_keys
the authentication host → container succeeds and the SSH request get forwarded to Gitea running in the docker container.
If a new SSH key is added in the Gitea web interface, it will be appended to .ssh/authorized_keys
in the same way as the already existing key.
Notes
SSH container passthrough will work only if
opensshd
is used in the container- if
AuthorizedKeysCommand
is not used in combination withSSH_CREATE_AUTHORIZED_KEYS_FILE=false
to disable authorized files key generation LOCAL_ROOT_URL
is not changed