Add explicit package scope to token

Update to gitea 1.19.3

gitea/config/act-runner-config.yml

@@ -47,4 +47,4 @@ container:
   # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
   privileged: true
   # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
-  options: --add-host=gitea.local:host-gateway
+  options: --add-host=gitea.local:host-gateway --volume "/var/lib/docker"

gitea/delete-repo.sh

@@ -0,0 +1,46 @@
+#!/usr/bin/env bash
+# Script that calls the Giteap API to delete one repo
+
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+
+if ! [[ $# -eq 1 ]]; then
+    echo "Illegal number of parameters" >&2
+    exit 1
+fi
+repo_to_delete=$1
+
+if [[ -z "${CERC_GITEA_AUTH_TOKEN}" ]]; then
+    echo "CERC_GITEA_AUTH_TOKEN is not set" >&2
+    exit 1
+fi
+if [[ -z "${CERC_GITEA_API_URL}" ]]; then
+    echo "CERC_GITEA_API_URL is not set" >&2
+    exit 1
+fi
+if [[ "${CERC_GITEA_MIRROR_REPO}" == "true" ]]; then
+    is_mirror=true
+else
+    is_mirror=false
+fi
+
+gitea_target_org=$(dirname ${repo_to_delete})
+gitea_target_repo_name=$(basename ${repo_to_delete})
+# Sanity check the repo name
+if [[ -z "${gitea_target_org}" ]]; then
+    echo "${repo_to_delete} is not a valid repo name" >&2
+    exit 1
+fi
+if [[ -z "${gitea_target_repo_name}" ]]; then
+    echo "${repo_to_delete} is not a valid repo name" >&2
+    exit 1
+fi
+
+echo "****** DELETING repo: ${repo_to_delete}"
+# Note use: --trace-ascii - \ below to see the raw request
+delete_response=$( curl -s -X DELETE "${CERC_GITEA_API_URL}/api/v1/repos/${repo_to_delete}" \
+      -H "Authorization: token ${CERC_GITEA_AUTH_TOKEN}" \
+      -H  "accept: application/json" \
+)
+echo ${delete_response} | jq -r

gitea/docker-compose.yml

@@ -1,12 +1,7 @@
-version: "3"
-
-networks:
-  gitea:
-    external: false
 
 services:
   server:
-    image: gitea/gitea:1.19.1
+    image: gitea/gitea:1.19.3
     environment:
       - USER_UID=1000
       - USER_GID=1000
@@ -21,8 +16,8 @@ services:
       - GITEA__actions__ENABLED=true
       - GITEA__security__INSTALL_LOCK=true
     restart: always
-    networks:
-      - gitea
+    extra_hosts:
+      - "gitea.local:host-gateway"
     volumes:
       - ./gitea:/data
       - /etc/timezone:/etc/timezone:ro
@@ -44,8 +39,6 @@ services:
     # Workaround below for lack of docker uid mapping. Change the container's postgres user's uid/gid to match the host user's
     entrypoint: bash
     command: -c  'usermod -u ${CERC_HOST_UID:-1000} postgres;groupmod -g ${CERC_HOST_GID:-1000} postgres;exec /usr/local/bin/docker-entrypoint.sh postgres'
-    networks:
-      - gitea
     volumes:
       - ./postgres:/var/lib/postgresql/data
 
@@ -57,8 +50,6 @@ services:
       - GITEA_INSTANCE_URL=http://gitea.local:3000
       - GITEA_RUNNER_LABELS=ubuntu-latest:docker://cerc/act-runner-task-executor:local,ubuntu-22.04:docker://cerc/act-runner-task-executor:local
       - CONFIG_FILE=/config/act-runner-config.yml
-    networks:
-      - gitea
     extra_hosts:
       - "gitea.local:host-gateway"
     volumes:

gitea/initialize-gitea.sh

@@ -44,7 +44,7 @@ if [[ ${token_found} != 1 ]] ; then
     new_gitea_token=$( curl -s -X POST "${GITEA_URL_PREFIX}/api/v1/users/${GITEA_USER}/tokens" \
       -u ${GITEA_USER}:${GITEA_PASSWORD} \
       -H "Content-Type: application/json" \
-      -d '{"name":"'${CERC_GITEA_TOKEN_NAME}'", "scopes": [ "sudo" ] }' \
+      -d '{"name":"'${CERC_GITEA_TOKEN_NAME}'", "scopes": [ "sudo", "package" ] }' \
       | jq -r .sha1 )
     echo "This is your gitea access token: ${new_gitea_token}. Keep it safe and secure, it can not be fetched again from gitea."
     echo "To use with laconic-so set this environment variable: export CERC_NPM_AUTH_TOKEN=${new_gitea_token}"

gitea/migrate-repo.sh

@@ -0,0 +1,57 @@
+#!/usr/bin/env bash
+# Script that calls the Giteap API to migrate one repo from
+# a source hosting platform into that Gitea instance
+
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+
+if ! [[ $# -eq 1 ]]; then
+    echo "Illegal number of parameters" >&2
+    exit 1
+fi
+repo_to_migrate=$1
+
+if [[ -z "${CERC_GITEA_AUTH_TOKEN}" ]]; then
+    echo "CERC_GITEA_AUTH_TOKEN is not set" >&2
+    exit 1
+fi
+if [[ -z "${CERC_GITEA_API_URL}" ]]; then
+    echo "CERC_GITEA_API_URL is not set" >&2
+    exit 1
+fi
+if [[ "${CERC_GITEA_MIRROR_REPO}" == "true" ]]; then
+    is_mirror=true
+else
+    is_mirror=false
+fi
+
+gitea_target_org=$(dirname ${repo_to_migrate})
+gitea_target_repo_name=$(basename ${repo_to_migrate})
+# Sanity check the repo name
+if [[ -z "${gitea_target_org}" ]]; then
+    echo "${repo_to_migrate} is not a valid repo name" >&2
+    exit 1
+fi
+if [[ -z "${gitea_target_repo_name}" ]]; then
+    echo "${repo_to_migrate} is not a valid repo name" >&2
+    exit 1
+fi
+
+github_repo_url="https://github.com/${repo_to_migrate}"
+echo "Migrating repo: ${repo_to_migrate} (mirror:${is_mirror})"
+# Note use: --trace-ascii - \ below to see the raw request
+migrate_response=$( curl -s -X POST "${CERC_GITEA_API_URL}/api/v1/repos/migrate" \
+      -H "Authorization: token ${CERC_GITEA_AUTH_TOKEN}" \
+      -H "Content-Type: application/json" \
+      -H  "accept: application/json" \
+      -d @- << EOF
+{
+    "clone_addr": "${github_repo_url}",
+    "mirror": ${is_mirror},
+    "repo_name": "${gitea_target_repo_name}",
+    "repo_owner": "${gitea_target_org}"
+}
+EOF
+)
+echo Migrated to: $(echo ${migrate_response} | jq -r .html_url)

tls-proxy/README.md

@@ -0,0 +1,2 @@
+# tls-proxy
+Automated deployment of TLS reverse proxy provisioned with Let's Encrypt certificate

tls-proxy/docker-compose.yml

@@ -0,0 +1,27 @@
+services:
+
+    proxy:
+        image: nginx:stable-bullseye
+        command: "/bin/sh -c 'while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g \"daemon off;\"'"
+        ports:
+            - 80:80
+            - 443:443
+        volumes:
+            - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
+            - ./certbot/challenge:/data/certbot-challenge:ro
+            - ./certbot/certificates:/data/certificates:ro
+
+    certbot:
+        image: certbot/certbot:v2.5.0
+        volumes: 
+            - ./certbot/certificates:/etc/letsencrypt
+            - ./certbot/challenge:/data-www-challenge
+        entrypoint: "/bin/sh -c 'sleep 300; trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
+
+    # Hello-world http container useful for test/debugging the proxy
+    # an actual service would be used for production
+    example-webservice:
+        image: crccheck/hello-world
+        ports:
+          - 8000
+

tls-proxy/initialize-tls-proxy.sh

@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+# TODO: get from the caller
+LACONIC_TLS_DOMAIN=example.com
+# When we're called nginx and certbot container are up and running and certbot is sleeping before executing renew
+# So we can now ask certbot to issue our initial cert
+tls_certificate_directory=./certbot/certificates/live/${LACONIC_TLS_DOMAIN}
+rm -rf ${tls_certificate_directory}
+# TODO: pass in email from caller
+# TODO: allow staging/dry-run mode
+docker compose exec certbot \
+    certbot certonly --webroot -w /data-www-challenge \
+    --staging \
+    --email ${EMAIL} \
+    -d ${LACONIC_TLS_DOMAIN} \
+    --rsa-key-size 4096 \
+    --agree-tos \
+    --force-renewal

tls-proxy/nginx-config-template

@@ -0,0 +1,39 @@
+events {
+    worker_connections  1024;
+}
+
+http {
+    server_tokens off;
+    charset utf-8;
+
+    server {
+        listen 80 default_server;
+
+        server_name _;
+
+        location ~ /.well-known/acme-challenge/ {
+            root /data/certbot-challenge;
+        }
+
+        location / {
+            proxy_pass ${LACONIC_ORIGIN_SERVICE_URL};
+        }
+    }
+
+    server {
+        listen 443 ssl http2;
+        ssl_certificate     /data/certificates/live/${LACONIC_TLS_DOMAIN}/fullchain.pem;
+        ssl_certificate_key /data/certificates/live/${LACONIC_TLS_DOMAIN}/privkey.pem;
+        server_name ${LACONIC_TLS_DOMAIN};
+        root /var/www/html;
+        index index.php index.html index.htm;
+
+        location / {
+            proxy_pass ${LACONIC_ORIGIN_SERVICE_URL};
+        }
+
+        location ~ /.well-known/acme-challenge/ {
+            root /data/certbot-challenge;
+        }
+    }
+}

tls-proxy/run-this-first.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+if [[ -n "$CERC_SCRIPT_DEBUG" ]]; then
+    set -x
+fi
+set -e
+mkdir -p ./nginx
+mkdir -p ./certbot/certificates
+mkdir -p ./certbot/challenge
+# TODO: get from the caller
+LACONIC_TLS_DOMAIN=example.com
+LACONIC_ORIGIN_SERVICE_URL=http://example-webservice:8000/
+# Expand the config template into the nginx config file
+cat ./nginx-config-template | sed 's/${LACONIC_TLS_DOMAIN}/'${LACONIC_TLS_DOMAIN}'/' | \
+	sed 's/${LACONIC_ORIGIN_SERVICE_URL}/'${LACONIC_ORIGIN_SERVICE_URL}'/' > ./nginx/nginx.conf
+# Create a self-signed cert so nginx will start without us changing its config between pre and post certbot invocation.
+# Check if we have a cert already
+tls_certificate_directory=./certbot/certificates/live/${LACONIC_TLS_DOMAIN}
+tls_certificate_directory_in_container=/etc/letsencrypt/live/${LACONIC_TLS_DOMAIN}
+tls_certificate_file_name=${tls_certificate_directory}/fullchain.pem
+# TODO: this won't work if there's a delay of more than one day between generating the 
+# self signed cert and starting the certbot enrollment process
+if [[ ! -f ${tls_certificate_file_name} ]] ; then
+    echo "Generating self-signed certificate for ${LACONIC_TLS_DOMAIN}:"
+    mkdir -p ${tls_certificate_directory}
+    docker compose run --rm --entrypoint "\
+        openssl req -x509 -nodes -newkey rsa:4096 -days 1 -keyout '${tls_certificate_directory_in_container}/privkey.pem' \
+        -out '${tls_certificate_directory_in_container}/fullchain.pem' -subj '/CN=${LACONIC_TLS_DOMAIN}'" certbot
+echo
+fi