fix(config): Include custom configuration in global file

Previously, this formula generated two configuration files,
a global one for database and secrets setup and
a custom one for all other settings in `custom/conf/app.ini`.

This did not work as intended.

gitea/config/clean.sls

@@ -12,6 +12,8 @@ gitea-config-clean-file-absent:
   file.absent:
     - names:
       - {{ gitea.lookup.paths.conf | path_join('app.ini') }}
-      - {{ gitea.lookup.paths.custom | path_join('conf', 'app.ini') }}
+{%- if gitea._generate_token %}
+      - {{ gitea.lookup.paths.internal_token_uri[7:] }}
+{%- endif %}
     - require:
       - sls: {{ sls_service_clean }}

gitea/config/file.sls

@@ -9,27 +9,9 @@
 include:
   - {{ sls_package_install }}
 
-# Since this formula does not rely on the web installer,
-# the global configuration should include:
-#   - database configuration
-#   - secrets
-# Otherwise, gitea would not run at all.
-Required Gitea config is setup:
-  file.managed:
-    - name: {{ gitea.lookup.paths.conf | path_join('app.ini') }}
-    - source: {{ files_switch(['etc/app.ini.j2'],
-                              lookup='Required Gitea config is setup'
-                 )
-              }}
-    - template: jinja
-    - mode: '0640'
-    - user: root
-    - group: {{ gitea.lookup.group }}
-    - require:
-      - sls: {{ sls_package_install }}
-    - context:
-        gitea: {{ gitea | json }}
-{%- if not gitea.secrets.internal_token and 'file://' == gitea.lookup.paths.internal_token_uri[:7] %}
+{%- if gitea._generate_token %}
+
+Gitea internal token file is generated:
   # gitea complained about permissions with mode = 640, root:git ownership
   cmd.run:
     - name: >
@@ -41,20 +23,21 @@ Required Gitea config is setup:
       - sls: {{ sls_package_install }}
 {%- endif %}
 
-gitea-config-file-file-managed:
+Gitea config is setup:
   file.managed:
-    - name: {{ gitea.lookup.paths.custom | path_join('conf', 'app.ini') }}
+    - name: {{ gitea.lookup.paths.conf | path_join('app.ini') }}
     - source: {{ files_switch(['app.ini.j2'],
-                              lookup='gitea-config-file-file-managed'
+                              lookup='Gitea config is setup'
                  )
               }}
-    - mode: '0640'
-    - makedirs: true
-    - dir_mode: '0750'
-    - user: {{ gitea.lookup.user }}
-    - group: {{ gitea.lookup.group }}
     - template: jinja
+    - mode: '0640'
+    - user: root
+    - group: {{ gitea.lookup.group }}
     - require:
       - sls: {{ sls_package_install }}
+{%- if gitea._generate_token %}
+      - Gitea internal token file is generated
+{%- endif %}
     - context:
         gitea: {{ gitea | json }}

gitea/files/default/etc/app.ini.j2

@@ -1,24 +0,0 @@
-;; Global Gitea configuration managed by salt state.
-;; These values are necessary to skip the web installer.
-
-[database]
-{%- for conf, val in gitea.database.items() %}
-{{ conf | upper }} = {{ val if conf | upper != 'PASSWD' else '`{}`'.format(val) }}
-{%- endfor %}
-
-{#- The following secrets are guaranteed to be set by `post-map.jinja`. #}
-
-[oauth2]
-JWT_SECRET = {{ gitea.secrets.jwt_secret }}
-
-[security]
-INSTALL_LOCK = true
-{%- if gitea.secrets.internal_token %}
-INTERNAL_TOKEN = {{ gitea.secrets.internal_token }}
-{%- else %}
-INTERNAL_TOKEN_URI = {{ gitea.lookup.paths.internal_token_uri }}
-{%- endif %}
-SECRET_KEY = {{ gitea.secrets.secret_key }}
-
-[server]
-LFS_JWT_SECRET = {{ gitea.secrets.lfs_jwt_secret }}

gitea/parameters/defaults.yaml

@@ -35,6 +35,11 @@ values:
     shell: /bin/bash
     user: git
   config:
+    database:
+      db_type: sqlite3
+      name: gitea
+      password: hunter1
+      user: root
     default:
       app_name: Gitea
       run_mode: prod
@@ -43,23 +48,19 @@ values:
       level: Info
       mode: console
       stacktrace_level: None
+    oauth2:
+      jwt_secret: ''
     repository.signing:
       signing_key: default
+    security:
+      internal_token: ''
+      secret_key: ''
     server:
       domain: localhost
       http_addr: 0.0.0.0
       http_port: 3000
+      lfs_jwt_secret: ''
       protocol: http
-  database:
-    db_type: sqlite3
-    name: gitea
-    password: hunter1
-    user: root
-  secrets:
-    internal_token: ''
-    jwt_secret: ''
-    lfs_jwt_secret: ''
-    secret_key: ''
   service:
     requires_mount: []
     socket_activation: false

gitea/post-map.jinja

@@ -47,30 +47,43 @@
       b) and special-casing to avoid regenerating those secrets every run.
 
     The INTERNAL_TOKEN has a special format, but it can be configured to be read from a separate file.
+
+    "." is used in place of ":" to avoid libmapstack automap. @TODO sensible to indulge in that magic?
 -#}
 
-{%- if not mapdata.secrets.secret_key -%}
+{%- if not mapdata.config | traverse("security:secret_key", "") -%}
   {%- set secret_key = salt['grains.get_or_set_hash'](
-        'gitea_secret_key',
+        'gitea.config.security.secret_key',
         length=64,
         chars='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789',
       )
   -%}
-  {%- do mapdata.secrets.update({'secret_key': secret_key}) -%}
+  {%- do mapdata.config | update_dict_key_value("security", {"secret_key": secret_key}) -%}
 {%- endif -%}
 
-{%- for jwt in ['jwt_secret', 'lfs_jwt_secret'] -%}
-  {%- if not mapdata.secrets[jwt] -%}
+{%- for jwt in ['oauth2:jwt_secret', 'server:lfs_jwt_secret'] -%}
+  {%- if not mapdata.config | traverse(jwt, "") -%}
     {%- set secret = salt['grains.get_or_set_hash'](
-          'gitea_' ~ jwt ,
+          'gitea.config.' ~ jwt | replace(":", "."),
           length=43,
           chars='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-',
         )
     -%}
-    {%- do mapdata.secrets.update({jwt: secret}) -%}
+    {%- do mapdata.config | update_dict_key_value(jwt.split(":")[0], {jwt.split(":")[1]: secret}) -%}
   {%- endif -%}
 {%- endfor -%}
 
+{%- do mapdata.update({"_generate_token": false}) -%}
+{%- if not mapdata.config | traverse("security:internal_token") -%}
+  {%- do mapdata.config | update_dict_key_value("security", {"internal_token_uri": mapdata.lookup.paths.internal_token_uri}) -%}
+  {%- if 'file://' == mapdata.lookup.paths.internal_token_uri[:7] -%}
+    {%- do mapdata.update({"_generate_token": true}) -%}
+  {%- endif %}
+{%- endif -%}
+
+{%- do mapdata.config | update_dict_key_value("security", {"install_lock": true}) -%}
+
+
 {#-
     Automatically configure the socket path to use the one provided by Systemd.
 -#}
@@ -79,6 +92,7 @@
   {%- do mapdata.config.server.update({"http_addr": "/run/gitea/gitea.socket"}) -%}
 {%- endif -%}
 
+
 {#-
     Automatically configure basic service dependencies.
     Memcached/Redis are not as easy to discover (multiple settings)