Initial commit

gitea/_mapdata/_mapdata.jinja

@@ -0,0 +1,13 @@
+# yamllint disable rule:indentation rule:line-length
+# {{ grains.get("osfinger", grains.os) }}
+---
+{#- use salt.slsutil.serialize to avoid encoding errors on some platforms #}
+{{ salt["slsutil.serialize"](
+     "yaml",
+     map,
+     default_flow_style=False,
+     allow_unicode=True,
+   )
+   | regex_replace("^\s+'$", "'", multiline=True)
+   | trim
+}}

gitea/_mapdata/init.sls

@@ -0,0 +1,21 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+---
+{%- set tplroot = tpldir.split("/")[0] %}
+{%- from tplroot ~ "/map.jinja" import mapdata with context %}
+
+{%- set _mapdata = {
+      "values": mapdata,
+    } %}
+{%- do salt["log.debug"]("### MAP.JINJA DUMP ###\n" ~ _mapdata | yaml(False)) %}
+
+{%- set output_dir = "/temp" if grains.os_family == "Windows" else "/tmp" %}
+{%- set output_file = output_dir ~ "/salt_mapdata_dump.yaml" %}
+
+{{ tplroot }}-mapdata-dump:
+  file.managed:
+    - name: {{ output_file }}
+    - source: salt://{{ tplroot }}/_mapdata/_mapdata.jinja
+    - template: jinja
+    - context:
+        map: {{ _mapdata | yaml }}

gitea/clean.sls

@@ -0,0 +1,7 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+include:
+  - .service.clean
+  - .config.clean
+  - .package.clean

gitea/config/clean.sls

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+{%- set tplroot = tpldir.split('/')[0] %}
+{%- set sls_service_clean = tplroot ~ '.service.clean' %}
+{%- from tplroot ~ "/map.jinja" import mapdata as gitea with context %}
+
+include:
+  - {{ sls_service_clean }}
+
+gitea-config-clean-file-absent:
+  file.absent:
+    - names:
+      - {{ gitea.lookup.paths.conf | path_join('app.ini') }}
+      - {{ gitea.lookup.paths.custom | path_join('conf', 'app.ini') }}
+    - require:
+      - sls: {{ sls_service_clean }}

gitea/config/file.sls

@@ -0,0 +1,60 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+{%- set tplroot = tpldir.split('/')[0] %}
+{%- set sls_package_install = tplroot ~ '.package.install' %}
+{%- from tplroot ~ "/map.jinja" import mapdata as gitea with context %}
+{%- from tplroot ~ "/libtofs.jinja" import files_switch with context %}
+
+include:
+  - {{ sls_package_install }}
+
+# Since this formula does not rely on the web installer,
+# the global configuration should include:
+#   - database configuration
+#   - secrets
+# Otherwise, gitea would not run at all.
+Required Gitea config is setup:
+  file.managed:
+    - name: {{ gitea.lookup.paths.conf | path_join('app.ini') }}
+    - source: {{ files_switch(['etc/app.ini.j2'],
+                              lookup='Required Gitea config is setup'
+                 )
+              }}
+    - template: jinja
+    - mode: '0640'
+    - user: root
+    - group: {{ gitea.lookup.group }}
+    - require:
+      - sls: {{ sls_package_install }}
+    - context:
+        gitea: {{ gitea | json }}
+{%- if not gitea.secrets.internal_token and 'file://' == gitea.lookup.paths.internal_token_uri[:7] %}
+  # gitea complained about permissions with mode = 640, root:git ownership
+  cmd.run:
+    - name: >
+        {{ gitea.lookup.paths.bin | path_join('gitea') }} generate secret INTERNAL_TOKEN > '{{ gitea.lookup.paths.internal_token_uri[7:] }}' &&
+        chmod 0640 '{{ gitea.lookup.paths.internal_token_uri[7:] }}' &&
+        chown {{ gitea.lookup.user }}:{{ gitea.lookup.group }} '{{ gitea.lookup.paths.internal_token_uri[7:] }}'
+    - creates: {{ gitea.lookup.paths.internal_token_uri[7:] }}
+    - require:
+      - sls: {{ sls_package_install }}
+{%- endif %}
+
+gitea-config-file-file-managed:
+  file.managed:
+    - name: {{ gitea.lookup.paths.custom | path_join('conf', 'app.ini') }}
+    - source: {{ files_switch(['app.ini.j2'],
+                              lookup='gitea-config-file-file-managed'
+                 )
+              }}
+    - mode: '0640'
+    - makedirs: true
+    - dir_mode: '0750'
+    - user: {{ gitea.lookup.user }}
+    - group: {{ gitea.lookup.group }}
+    - template: jinja
+    - require:
+      - sls: {{ sls_package_install }}
+    - context:
+        gitea: {{ gitea | json }}

gitea/config/init.sls

@@ -0,0 +1,5 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+include:
+  - .file

gitea/files/default/app.ini.j2

@@ -0,0 +1,30 @@
+{%- macro render_opt(name, val) %}
+{%-   if val is boolean %}
+{%-     set rendered = val | string | lower %}
+{%-   elif val | is_list %}
+{%-     set rendered = val | join(',') %}
+{#-   some special characters might make problems, escape the value just in case #}
+{%-   elif val is string %}
+{%-     set rendered = '`{}`'.format(val) %}
+{%-   else %}
+{%-     set rendered = val | string %}
+{%-   endif %}
+{{- name | upper }} = {{ rendered }}
+{%- endmacro -%}
+
+;; This file is managed by Salt.
+;; Manual changes might be overwritten.
+
+{% for name, val in gitea.config.default.items() %}
+{{ render_opt(name, val) }}
+{%- endfor %}
+
+{%- for topic in gitea.config %}
+{%-   if 'default' != topic %}
+
+[{{ topic | lower }}]
+{%-     for name, val in gitea.config[topic].items() %}
+{{ render_opt(name, val) }}
+{%-     endfor %}
+{%-   endif %}
+{%- endfor %}

gitea/files/default/etc/app.ini.j2

@@ -0,0 +1,24 @@
+;; Global Gitea configuration managed by salt state.
+;; These values are necessary to skip the web installer.
+
+[database]
+{%- for conf, val in gitea.database.items() %}
+{{ conf | upper }} = {{ val if conf | upper != 'PASSWD' else '`{}`'.format(val) }}
+{%- endfor %}
+
+{#- The following secrets are guaranteed to be set by `post-map.jinja`. #}
+
+[oauth2]
+JWT_SECRET = {{ gitea.secrets.jwt_secret }}
+
+[security]
+INSTALL_LOCK = true
+{%- if gitea.secrets.internal_token %}
+INTERNAL_TOKEN = {{ gitea.secrets.internal_token }}
+{%- else %}
+INTERNAL_TOKEN_URI = {{ gitea.lookup.paths.internal_token_uri }}
+{%- endif %}
+SECRET_KEY = {{ gitea.secrets.secret_key }}
+
+[server]
+LFS_JWT_SECRET = {{ gitea.secrets.lfs_jwt_secret }}

gitea/files/default/gitea.service.j2

@@ -0,0 +1,103 @@
+{#- To keep the below "readable", set short vars here. -#}
+{%- set work = gitea.lookup.paths.work -%}
+{%- set bin = gitea.lookup.paths.bin | path_join('gitea') -%}
+{%- set user = gitea.lookup.user -%}
+{%- set home = salt['user.info'](gitea.lookup.user).home -%}
+{%- set config = gitea.lookup.paths.conf | path_join('app.ini') -%}
+{%- set custom_needed = gitea.lookup.paths.custom != (gitea.lookup.paths.work | path_join('custom')) -%}
+{%- set custom = gitea.lookup.paths.custom -%}
+
+[Unit]
+Description=Gitea (Git with a cup of tea)
+After=syslog.target
+After=network.target
+{%- if gitea.service.wants %}
+{%-   for wanted in gitea.service.wants %}
+Wants={{ wanted }}.service
+After={{ wanted }}.service
+{%-   endfor %}
+{%- endif %}
+{%- if gitea.service.requires_mount %}
+{%-   for mount in gitea.service.requires_mount %}
+RequiresMountsFor={{ mount }}
+{%-   endfor %}
+{%- endif %}
+###
+# Don't forget to add the database service dependencies
+###
+#
+#Wants=mysql.service
+#After=mysql.service
+#
+#Wants=mariadb.service
+#After=mariadb.service
+#
+#Wants=postgresql.service
+#After=postgresql.service
+#
+#Wants=memcached.service
+#After=memcached.service
+#
+#Wants=redis.service
+#After=redis.service
+#
+###
+# If using socket activation for main http/s
+###
+#
+#After=gitea.main.socket
+#Requires=gitea.main.socket
+#
+###
+# (You can also provide gitea an http fallback and/or ssh socket too)
+#
+# An example of /etc/systemd/system/gitea.main.socket
+###
+##
+## [Unit]
+## Description=Gitea Web Socket
+## PartOf=gitea.service
+##
+## [Socket]
+## Service=gitea.service
+## ListenStream=<some_port>
+## NoDelay=true
+##
+## [Install]
+## WantedBy=sockets.target
+##
+###
+
+[Service]
+# Modify these two values and uncomment them if you have
+# repos with lots of files and get an HTTP error 500 because
+# of that
+###
+#LimitMEMLOCK=infinity
+#LimitNOFILE=65535
+RestartSec=2s
+Type=simple
+User={{ user }}
+Group={{ gitea.lookup.group }}
+WorkingDirectory={{ work }}
+# If using Unix socket: tells systemd to create the /run/gitea folder, which will contain the gitea.sock file
+# (manually creating /run/gitea doesn't work, because it would not persist across reboots)
+#RuntimeDirectory=gitea
+ExecStart={{ bin }} web --config '{{ config }}'
+Restart=always
+Environment=USER={{ user }} HOME={{ home }} GITEA_WORK_DIR={{ work }}{% if custom_needed %} GITEA_CUSTOM={{ custom }}{% endif %}
+# If you install Git to directory prefix other than default PATH (which happens
+# for example if you install other versions of Git side-to-side with
+# distribution version), uncomment below line and add that prefix to PATH
+# Don't forget to place git-lfs binary on the PATH below if you want to enable
+# Git LFS support
+#Environment=PATH=/path/to/git/bin:/bin:/sbin:/usr/bin:/usr/sbin
+# If you want to bind Gitea to a port below 1024, uncomment
+# the two values below, or use socket activation to pass Gitea its ports as above
+###
+#CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+#AmbientCapabilities=CAP_NET_BIND_SERVICE
+###
+
+[Install]
+WantedBy=multi-user.target

gitea/files/default/key.asc

@@ -0,0 +1,158 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+xsFNBFsvDSkBEADtyFKGhQ/sh9KmVAzivJfMGbasytWkZNdIrwCoxSTEijl2QLyi
+E8b5xEOK2+9b3OXF+Nbm+tdfVCaKfoDhXdglxvENSdXA0mKxt4RhKxXAkWHrLfeA
+A4RbUj0ndfpJWpoRoEPZTP2a8UXOctUVQP+JzC+D028nawzpSVrXN7UYkszJ5j06
+oR6+ZMjpEMbPRnOWRuaJONPvBuTHGDSsD3UPJlWyeUv7+GmcVJzjc8uq1HeX/5Ap
+NTrESldIDPgcxfTWhscj1+s8gvW5SqcNQnWSIUtI+Bi2sW9ibj9XlkFJMU7QFV+S
+1uF9D8lynZCSDIjnsqSuX3TMgr2CPk7+0eLNFAVrrTUbGwcoyge3d8osJD5PS3z6
+COwDlzAXRJECScRo1ynxCxJTLVf6JoGQEFzVc5HSlM8Lx1zm/Al+AYdhdToCQNDF
+vLLuHkMqh3OLG3yxS142BUHDrd0KaiY+sxoUQjVjo7PHpLZRJKGZCxSS6vPr9I+o
+OTDO2h7rWdTtodmkSz9+NnUD1cGYWwL8j4Cpi4yozg+8Gbtywnm/q0TPMYhyiBbn
+hU+sowfmo1RPn2aQnxSS55L7cMTNzP95cU4FQDNzYhget9X5UJJPWdSRcknykMcQ
+oAo0IfswMDC7LWf8uObZo/0DQeGBVBx2y/+Ir9dt5MhcrmO/U+fCF+O2xwARAQAB
+zRhUZWFib3QgPHRlYWJvdEBnaXRlYS5pbz7CwZQEEwEIAD4CGwMFCwkIBwIGFQoJ
+CAsCBBYCAwECHgECF4AWIQR8nmgVJZRoiGLWKvYtmugG7BWS4gUCXvKlFgUJB4X+
+7QAKCRAtmugG7BWS4nDAEADttD9mPkKlrUhpJxPbzblstIsv5OvTGjemjrTJc6UT
+HsjUe1eZ3+QsHN0TGZEP0WigA1hseA4j+7/S8CeYeAf7K7LS4KVGJ9AlZC1xEuII
+HnQURNWOubEDuRkuYvK2HZ5sEQfRbgW6q8bLAHGvsqQG7fw8elwpERI5y0qDZZhX
+iVNqMmeaCnLVp5GTS6j7+gT7ySqwun+02K5UjtUjhDdyu4fyPctPcNkI2kzcXUnv
+TeAOPZSgdvmF8SlG27K0pXn+aeGopLamt2dD2nXQgwECMYfu9vFEEqn9TN899eVe
+EWeLMBmBWDMfE3NPDTitKyGwQ1XGa+SRt3kVuIClZVa8hiCdl0AZcReHmUK9L0i5
+hggQQfeoPofAJUbM4PzjKjaJ/P328T5o/Rz7QQaRUudPPdTvoxi4DojynBwqjg0g
+pagywiNfzH8LOTVFXjRhbmhy8w1zs5z4rCIZZo3fC6Dk2MwgcJEolbCC+7iEu/R7
+kziTisMA2l0TTYIjuaFveTHorS6VfzK/xdq3OhY6YEEDHnch5mnQ3Lxms9z6H2GC
+FnVeXJR90qNDy91lGFtCQ5ks4xzW1NqNDJRlWn4+sw7rD/41scEeVZGWKuohm3cQ
+r39OX1W8xo1eesk6wniHmwr5x6RZi6tVuKi+0UkXu8E3ez2rde3BicdWESpvbFdM
+zMLBlAQTAQgAPhYhBHyeaBUllGiIYtYq9i2a6AbsFZLiBQJbLw0pAhsDBQkDwmcA
+BQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEC2a6AbsFZLiw44P/0MpkiOcklDm
+T3yGJPzVotanLpzzwxLRFACBlecNo5RfZlwn4lnVu4ZAfcKHdCgQAtHtMqEjz5Ue
+6PLuDCdIxSVlK1WsegCKT/jzl36TTw035nlo1ahgrqVx3XU4WLq4/LwOASfZZQcV
+9BR6wH8WE6cbxbsNDPgeIygwUwAoQR54D07Ztwtbu6QXU5RXBgGhZAap0S59buGI
+TtY4B6hhjMQkcBkafFDdskrgZjH9GFqvS1qchgWFfnxK0Q1ZT1qXDgQJR2ZALf4X
+5u7zWSOcPRMNA/2rA+Oh2jyNnkxAkMpwA6OTiyaA0xo3lups1vx/CYGCQurBpAHt
+KITVaVx5PGoHpJN1QEBJrFdcC8xiVd25qUYMSbjAVRXI9EFSPy5JZBlsYeFnQ0Qw
+WnIQCRAQe0DI9oZkk7BAuptCdMRXo+GO85c6w6nMbuKOiakE6djyXst6Vle0pCOT
+81F8G+DF8crDl3VKE6IPmq5N0XX0lRYDL7XkNUaqO0iEA/gtfWAYtSUWiHwcnzW5
+C6fHMRa8sG0R1CluPOabhAs2pQnaFAwGDRyFRYcfmKro9267I8eiydq1z8y8tl3B
+XPYWsvZgZuLF5ahgNjYB9XRQZWMXVboraiiwQsCHeMzG/2Uas/idPQfA1TU0CDHn
+9/LktcnScN7BHQEi5lkxmadLfzn8uNtmzsFNBFsvDSkBEADYL0eMn3ZZfk5EV+Zb
+4FmBZw4+/3nhMInX6PMzu/3WxczcORQtgzN0/VQ19OHhsv8I29Pr+SPOaDm0ASdM
+gzNYq//qdKYgQsjAaGHzGcgomGYqV9Bix0MpK5yuo+IKD6q5cQAeqFD/h82+TCiW
+7G+y2Hxgeu9MAvvTp8pU4pk1WbNrgTZvhOxwbrRv2AGzxsUxgqyj5ox30dvIo8n5
+WsoXpl0OOlpLRg9U7uBNMmUu12TOlEE4HFO5xjRO5EwfKWAHP6EUGk0JLTfAMQ/A
+MZa5WeWqeWzV/Pni6/RpuAmY2SEu/+gro1XqytkeQCV877WcC0VT/C1QihuvNGy3
+ovv7j4Qroh2L6NgeAyym01OqI5bV4+EJ+6cIbC4ohQAfj6nhY/E/6bkYmzs1uwMv
+SULVjFAtRD8m3lypy0xHTX64N5yICi65WVTuFUqDQiFfjP9Si2BS08mBM5lCOC/F
+wtkAMC0IRfNSYNdAjo0BDh59Yana5vfW1VNNCHD7ZG08cOBaHhg+qiZK8t28UX6r
+kxDxghk2HEw3sxKEW7pJoHc5OiltL5/4Oq2AVC/Sm63VeeDlfVu8qj4xMikyjVG0
+c86XOpoCDxlzmKbG5YYiUGER1WCTB9uuJ3e6AO+3wAJ8p2s8NB6f3vWeeyzZhtsm
+41Amge/sZggSQGqytjPydTxGxQARAQABwsF8BBgBCAAmAhsMFiEEfJ5oFSWUaIhi
+1ir2LZroBuwVkuIFAl7yokcFCQeF/B4ACgkQLZroBuwVkuKAag/9EYvfWSBC34sz
+MCeZ3CZpJJzshF54l7+RG3pujxLbZZdgpmCTWZ4QM+oyqb+iSTO+9H0txLvI8sah
+o3kd1PbgefBhWlxq4sAYOpNJ1ymHVB0FOvHUo1YbzkmyRZL1KbSRZKfyc6E3crQN
+djeSFF6H46rOrLe2K2Dq3cRzoIoYcI3aDofKXlwM4nzb/HMQ/DzCRwS1ETwvdhVz
+hoWTJlF37fzKLN8Bcwgfyc6tbN5xeywVnSYdavWpuCa1x+jmeeIUiXuMXVpw50rZ
+tLJCOkczS3dSfzNMc37QmwtT5N/rrHfQKutuBKCmmBlspLAEVUx2R3dssbpn59Rp
+QTOZ25WYRT8dFQGvxt+oin0FNxf9s9m0wzcor26bOdOnayKsHShIJWYIrxzLQl/s
+vpGEk7vaBfAwYuaCK2x198j+zTgufZ7Kq0RCul9l6Pec3yxOo7cLI5Efh9K9kh12
+2FUgGCKrf5WVGUi3/n/RPhJw+RiRuERLGBxi+vXDrdt7hrntOiJej3MsPdzo02B/
+9Q9sjU4S45NM0XyQpnUAqTY+z2zth97Z04aSR/wasHg7o3rLNPX3w/eIvqXTPmzr
+7KsqzPaPXPQ5WX3qSKQGLCiSrmjxQiprS0LXlmvW2xEiJERYFR2vovqpiLXwz+SF
+45cewQ6ABG0T1Fa70kpMvWA1+vqMUCLCwXwEGAEIACYWIQR8nmgVJZRoiGLWKvYt
+mugG7BWS4gUCWy8NKQIbDAUJA8JnAAAKCRAtmugG7BWS4sKID/9CF5QnNyKsfJoB
++CuNNW1GN8JRcd9z9fmwrCtZr0STuP3tgJY96euM4xvUqbfuI+nLw0fa8yXOEOrr
+jMGyqzzMyaFiyFyXLEISQN+HMDMbsJHmvfeC0RUERtfAlVwrjebjDQetHTqJjSf/
+//ZXJ6yfdO1Boz0Jik4U198GK8mVBVJrFtM28KRyiPpqoZEvCGEx3Gylk18yOtJn
+tOR9H/u0xV34X7mXcrPbaf3D+uYgUPeHcWlI0H7mjl60RdImesFXGSL40B0MG6vx
+XRHiH+j+32dvovNQPKPPOcJGxyep2AvQQDsY262FM9JUIX0Kx2WMsSAAveJ8549f
+fIRfyLegO3XGv107jCAjdD7KW8LLaKJsBcy9AtdWrjDuStmJo2yIWoUlg2Vd59//
+qu0pEUJLm5lZEVXa/bLspPIxedLstlwrasapczMOktb5d/igt9OIUFUaEjaQUGKp
+yhHBm9zJD06cJs9MfvqEubuJzSsxkrOK2senPYw/RotV0zfrtxefv6SKYmSDOy6x
+Y0W2Gtrn3PhOkIdnT4L58e+5mQc1cWqbbbTnVpEc31HX22kSzqWtWxbTcE3Y4SMO
+D9LvC7jhn6fNN9VBmSsFO5Mn70o4tqQrAueSJptVAvMwse4OaBNJn9XzeIwxbLoo
+vDuICSramSXhNM6enfBeDy66tnLnFs7BTQRbLw2xARAA2jnRSZFdkcAwygf8BoyG
+9HurVqFb0t5SRZHEjFIl6wmdvlk13KszvyzRJ+8IEL3QQtdwTKZAMYT9Hamclvwi
+iF92/12HwsTK1Ijn/ayAsWmHFhXvqlEaKtm/39Mj6M4b6wPkl5vy/TYoxj3CDGl8
+gWQHo/RmYOcDl61Twswt4uonUm4fO9V8x19mhxbap6CDsh6Eh64SxXRkyXaY1UPr
+d4V/TslyBsLz5L5sgIVVTvnNitSAnGhy77CwUiv3DkvoK6lc7/JvH1zf50/v3ueq
+uhTABeMuhdD5Vz7Zq6GYOSkDh/gPCfgBeL0W/vpWSVLyQC0dkC94yxN9R5SHKcae
+++IFFhSa3CNPiBLhZ/6dl3K1MV4rJ0CY++RbYNHdrmQFA95HpiSfqcOGBZU5YfV+
+ErlsVqZFqBMP7edZtgT9kKW8NPQdLdm4aClzBATnkI0wgAozq2FBacFosuNEUVCW
+ap6vaJ1L0cJeIC7kzOmp3T/W/klECfxHenEIoH5XlsIugHMAtdnWzAZv8LnLfCo7
+FsuUZXD7PhNvavNJUdQ2EaKC/DSy0++6Il1wKvt26RPaMM0JtEdCO3AMoXVtfqLp
+0Er4FBUpHV6OtaVhlnqOhHh6O/AlmX8z90Okc/u+UBtwhgcXFyM3oA9JKEAIthFB
+i9871frBAbXS8Z9YJESLpQ0AEQEAAcLDsgQYAQgAJgIbAhYhBHyeaBUllGiIYtYq
+9i2a6AbsFZLiBQJe8qJ3BQkHhfvGAkDBdCAEGQEIAB0WIQTMZLHbZ6u+7KsktkVf
+w0Yyl1P0sAUCWy8NsQAKCRBfw0Yyl1P0sMVTD/9tr7HkTQie+SPOrL/6BJr1/cAh
+U5Xv58IkMsuBmPO6uqmMar5gvvbebaafprB7MjK3b2pwTeaHvnSkeRDqMzpEWiy3
+sBN1S1wedXnEOmGYB8CTyDzgV3DmGHbnvCmQv9agtiEgaGqR1xaZCkUQmjhTIVnp
+ATyx14kZgxcLYhKYybI1w7YrZPJcGEt/ENUZQRNKac2/tu/GqiNnZ0ppCc0l7N9Z
+OoboqgzBXKGDbYJ97WO8XnGqrHK0CDUVao2ji+xd6bi9aLXb0sNeRGeOKVqaHYg2
+NA/KdnPTQj8JnmSaZmpvFJJiLXiB/zjNWouYPNNRQidGhjHYlHgNz/mCkRBHhOhi
+Pwz2ui15GSl8dUecNMkJaon+9NAmA2L7N0J5PA1ZB4ywrgc1ZSjxdRxTGGVrM0H+
+2R4ILA/gEYWRPLwEpOekX4Vlc2MEajSA+eGlBVF/Qb5B8+u4Aegwsz1Iy+yYxJ/q
+xSS2xwDVvI1utifUfF/AXgM5FvW1+3KmpaMTpr/+KHtUIdkM/DT62J9j+aCTcyXw
+AFlli2FsbvZBHEoir/EqJdFjxhXXnZmb85w2/eJTapQQ5lxAzeurRrhurl+Ai+cN
+SpJC++jAusIJ86mA7iZPyEic2G93ivcyolhGJnkeUBlTJui6Spk48NcHlNl+H3kw
+NST+DIIlHK5RxG7n3AkQLZroBuwVkuI8LhAAkhidYnGWLKv09OUz9LEjEu2nmXTr
+Nz/ww6gWlWfhML//T3Mgp/FYoZRXWcMNYysm2UDHtl9atrMReoSnCeza/n0Dzw+e
+6AR1wJGS0B9JqFARt4o4/pbOEC1kTWSKxh41YQbJdECU/c0ZnbotuMoG8SlKjCNm
+NZNVL8XGykXDTiaCIWVMArMjG1RH6Bn5weXrMoQTHTd0Brr7HyHxSCb8RBeNZmdf
+Ivy0uSuI/frobxm32x7+yCprNnH0ZLP4czQq80sdaId/KmfHRTmhJSyXxjEivrZZ
+oMUIECIPE9rggBaO24iCfUfr7k4oGxpaccPvnrGoEa2BxR4JERUPR2QPc6QnT3B7
+hJF2OPP//VITg6RlgeU7wzX0eLJDxvoE72y0fb7qfpjtcYn1T5TkJNrGuzpoPrUt
+i1c/PdN/RH2+6Quh+wKawD3PhYn8BXqdhgh4m9SRhXL06N2djg7oz7J79+z+sPH1
+Em1rRPA0ZmtXcxbWFd4S2ufG4X679NlJNAOE7p8HexvXS1FQmRC+beN/rJjNtS+z
+CS8HfcWchNmwAJ6VfTJRGmaH5DOwR37PerxzqZPXEHcNzuSj0IsXepdEYgqLFFjm
+lVIWQqeqbFcHl6hW4TpboaSHskzvZwE/qlfT8JK5RvhNhB720JX/Kp7mp5NTtkKV
+Cfp07Zd/lD9Pjs/Cw7IEGAEIACYCGwIWIQR8nmgVJZRoiGLWKvYtmugG7BWS4gUC
+XRR5WwUJA8afKgJAwXQgBBkBCAAdFiEEzGSx22ervuyrJLZFX8NGMpdT9LAFAlsv
+DbEACgkQX8NGMpdT9LDFUw//ba+x5E0Invkjzqy/+gSa9f3AIVOV7+fCJDLLgZjz
+urqpjGq+YL723m2mn6awezIyt29qcE3mh750pHkQ6jM6RFost7ATdUtcHnV5xDph
+mAfAk8g84Fdw5hh257wpkL/WoLYhIGhqkdcWmQpFEJo4UyFZ6QE8sdeJGYMXC2IS
+mMmyNcO2K2TyXBhLfxDVGUETSmnNv7bvxqojZ2dKaQnNJezfWTqG6KoMwVyhg22C
+fe1jvF5xqqxytAg1FWqNo4vsXem4vWi129LDXkRnjilamh2INjQPynZz00I/CZ5k
+mmZqbxSSYi14gf84zVqLmDzTUUInRoYx2JR4Dc/5gpEQR4ToYj8M9roteRkpfHVH
+nDTJCWqJ/vTQJgNi+zdCeTwNWQeMsK4HNWUo8XUcUxhlazNB/tkeCCwP4BGFkTy8
+BKTnpF+FZXNjBGo0gPnhpQVRf0G+QfPruAHoMLM9SMvsmMSf6sUktscA1byNbrYn
+1HxfwF4DORb1tftypqWjE6a//ih7VCHZDPw0+tifY/mgk3Ml8ABZZYthbG72QRxK
+Iq/xKiXRY8YV152Zm/OcNv3iU2qUEOZcQM3rq0a4bq5fgIvnDUqSQvvowLrCCfOp
+gO4mT8hInNhvd4r3MqJYRiZ5HlAZUyboukqZOPDXB5TZfh95MDUk/gyCJRyuUcRu
+59wJEC2a6AbsFZLiqc0QAJNsa5yUKbwrukXnbl0VV9Vdu3/PwmmilZZfc2LtGUK8
+v7ZgXOuNN8+g2fFLZ83SgbG5hKmvEf+dR39D9I0B+mOUKEYNik7oerhmyO2qrJ2y
+VNxGN8S66b9lTDi4BZHN1b76Tt9NqbebCvodlu+Hb52PPaXsPLisWHaFrpcpff6R
+fnZCUKDfeD/uyrtV68PqdNFdiXxVj9A96key3IesCD3xL5eXHyl855bh/17GyhIz
+pPQvOUVBwFla0Zm3fiNRxYFy9hATzbGwd3itMEyLDQamjT08L9xqQYgpdBW2seMF
+HOvivLlaet3dxY9g5WUj62CTpObxq4b/u8mXjE2wx+1QTx0ZHaFjv3FkGGZUQFC8
+yS1S6tGjdsdBW1v+YAyQhHR8SJ/d7UleczfbcL3zrWQPMmhmlQupz+LcHhFpPSOJ
+Denj+nB+e9zI+d7v3L8NfXhGXqBy1PuirK8Fux03pt7oYo5w7T0P26EDR6w7uk20
+Rr5b7p6BGuPo8TQ4OTdNtBAXalhXc6C2cUIuJMK23Gr8Uz+MymiIzF+IZILPQIsH
+mvwH4QbUB7igBTtq2HfFC7kr6z+RQBgfx449TbpW1RSjQ5kUxSIO4srkFIaHfI9c
+tcM4WIhK2l8lT0/H1GZ14gsSzMlIyQu/oQzkw97fZrSgV2vH2yeiYueVTHFItfme
+wsOyBBgBCAAmFiEEfJ5oFSWUaIhi1ir2LZroBuwVkuIFAlsvDbECGwIFCQHhM4AC
+QAkQLZroBuwVkuLBdCAEGQEIAB0WIQTMZLHbZ6u+7KsktkVfw0Yyl1P0sAUCWy8N
+sQAKCRBfw0Yyl1P0sMVTD/9tr7HkTQie+SPOrL/6BJr1/cAhU5Xv58IkMsuBmPO6
+uqmMar5gvvbebaafprB7MjK3b2pwTeaHvnSkeRDqMzpEWiy3sBN1S1wedXnEOmGY
+B8CTyDzgV3DmGHbnvCmQv9agtiEgaGqR1xaZCkUQmjhTIVnpATyx14kZgxcLYhKY
+ybI1w7YrZPJcGEt/ENUZQRNKac2/tu/GqiNnZ0ppCc0l7N9ZOoboqgzBXKGDbYJ9
+7WO8XnGqrHK0CDUVao2ji+xd6bi9aLXb0sNeRGeOKVqaHYg2NA/KdnPTQj8JnmSa
+ZmpvFJJiLXiB/zjNWouYPNNRQidGhjHYlHgNz/mCkRBHhOhiPwz2ui15GSl8dUec
+NMkJaon+9NAmA2L7N0J5PA1ZB4ywrgc1ZSjxdRxTGGVrM0H+2R4ILA/gEYWRPLwE
+pOekX4Vlc2MEajSA+eGlBVF/Qb5B8+u4Aegwsz1Iy+yYxJ/qxSS2xwDVvI1utifU
+fF/AXgM5FvW1+3KmpaMTpr/+KHtUIdkM/DT62J9j+aCTcyXwAFlli2FsbvZBHEoi
+r/EqJdFjxhXXnZmb85w2/eJTapQQ5lxAzeurRrhurl+Ai+cNSpJC++jAusIJ86mA
+7iZPyEic2G93ivcyolhGJnkeUBlTJui6Spk48NcHlNl+H3kwNST+DIIlHK5RxG7n
+3ObXD/9LLcRZs7ZoJmdFdvsN99UE7JMAyXolx3BJrlASmeo7X64TCXA7jx+IX+3S
+mhEPobcUelbTbb42xRpJgP+Z+rll55LyK/dKsic2nhiPo1FvmFTehtP/NvOGeuP3
+LRHs8KlyR6Jb4JLin8afhHjiKq8c28kVjVMfrX1SxLlhz4gQOsLoirXEUWe6Qyz+
+pUjDQFUJlxeie/ga/58hzaRU1QbDLPVXbjOQBc2qGL17PuykOYXweoPmqo42y2HQ
+CcQ+4zcLWBX2IUJNrOTSDMiYeR83Bw8z1XIr4mKmPG4ifF1GFml0yZjwZccx/po6
+LtowadMt5GIzxuEIawAG7pREbKwzXpI41vOVz2w3H9Q8a70eo3PXECuQ1hDM4/uN
+vwmL2/8Xq7PONE0DahD6QFSNX+zWs3Y80CJwQJH/qJp/wGeyAfgm5tPXci4yxGkF
+QEHnpKx/93oBKe4upPmGV6gcNvBNHNxUKQH0izjZUkTPHULN1aBfYomjsMlPqeD8
+VKhQYreKXJ51IM4H7EWR6OB2yDxH3aozIo0PjYZ/lLGfb+LP4wuT4eRTm1/7Svy5
+d+ZkXzhUPI9b4FjwXEjaFTq6hBv/niVjn+kw+vL/g4v6DZ7qDAqFvXdrc4gd8A8d
+tA7klbdai0zV9RaL9coX8nDDhKW2YJweW7V4YlinKRC/oSsStg==
+=TBFA
+-----END PGP PUBLIC KEY BLOCK-----

gitea/init.sls

@@ -0,0 +1,7 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+include:
+  - .package
+  - .config
+  - .service

gitea/libmapstack.jinja

@@ -0,0 +1,315 @@
+{#- -*- coding: utf-8 -*- #}
+{#- vim: ft=jinja #}
+
+{#- Get the `tplroot` from `tpldir` #}
+{%- set tplroot = tpldir.split("/")[0] %}
+{%- from tplroot ~ "/libmatchers.jinja" import parse_matchers, query_map with context %}
+
+{%- set _default_config_dirs = [
+      "parameters/",
+      tplroot ~ "/parameters"
+    ] %}
+
+{%- macro mapstack(
+      matchers,
+      defaults=None,
+      dirs=_default_config_dirs,
+      log_prefix="libmapstack: "
+    ) %}
+{#-
+    Load configuration in the order of `matchers` and merge
+    successively the values with `defaults`.
+
+    The `matchers` are processed using `libmatchers.jinja` to select
+    the configuration sources from where the values are loaded.
+
+    Parameters:
+
+      - `matchers`: list of matchers in the form
+        `[<TYPE>[:<OPTION>[:<DELIMITER>]]@]<QUERY>`
+
+      - `defaults`: dictionary of default values to start the merging,
+        they are considered built-ins. It must conform to the same
+        layout as the YAML files: a mandatory `values` key and two
+        optional `strategy` and `merge_lists` keys.
+
+      - `dirs`: list of directory where to look-up the configuration
+        file matching the matchers, by default a global `salt://parameters/`
+        and a per formula `salt://<tplroot>/parameters`
+
+      - `log_prefix`: prefix used in the log outputs, by default it is
+        `libmapstack: `
+
+    Example: On a Debian system with `roles=["nginx/server", "telegraf"]`
+
+      {%- set settings = mapstack(
+            matchers=[
+              "Y:G@os_family",
+              "I@" ~ tplroot,
+              "Y:C@roles",
+            ],
+            dirs=["defaults", tplroot ~ "/parameters"],
+          )
+          | load_yaml %}
+
+      This will merge the values:
+
+        - starting with the default empty dictionary `{}` (no
+          `defaults` parameter)
+
+        - from the YAML files
+
+          - `salt://defaults/os_family/Debian.yaml`
+
+          - `salt://{{ tplroot }}/parameters/os_family/Debian.yaml`
+
+        - from the pillar `salt["pillar.get"](tplroot)`
+
+        - from the `nginx/server` YAML files:
+
+          - `salt://defaults/roles/nginx/server.yaml`
+
+          - `salt://{{ tplroot }}/parameters/roles/nginx/server.yaml`
+
+        - from the `telegraf` YAML files:
+
+          - `salt://defaults/roles/telegraf.yaml`
+
+          - `salt://{{ tplroot }}/parameters/roles/telegraf.yaml`
+
+    Each YAML file and the `defaults` parameters must conform to the
+    following layout:
+
+      - a mandatory `values` key to store the configuration values
+
+      - two optional keys to configure the use of `salt.slsutil.merge`
+
+        - an optional `strategy` key to configure the merging
+          strategy, for example `strategy: 'recurse'`, the default is
+          `smart`
+
+        - an optional `merge_lists` key to configure if lists should
+          be merged or overridden for the `recurse` and `overwrite`
+          strategies, for example `merge_lists: 'true'`
+#}
+{%-   set stack = defaults | default({"values": {} }, boolean=True) %}
+
+{#-   Build configuration file names based on matchers #}
+{%-   set config_get_strategy = salt["config.get"](tplroot ~ ":strategy", None) %}
+{%-   set matchers = parse_matchers(
+        matchers,
+        config_get_strategy=config_get_strategy,
+        log_prefix=log_prefix
+      )
+      | load_yaml %}
+
+{%-   do salt["log.debug"](
+        log_prefix
+        ~ "built-in configuration:\n"
+        ~ {"values": defaults | traverse("values")}
+        | yaml(False)
+      ) %}
+
+{%-   for param_dir in dirs %}
+{%-     for matcher in matchers %}
+{#-       `slsutil.merge` options from #}
+{#-       1. the `value` #}
+{#-       2. the `defaults` #}
+{#-       3. the built-in #}
+{%-       set strategy = matcher.value
+          | traverse(
+            "strategy",
+            defaults
+            | traverse(
+              "strategy",
+              "smart"
+            )
+          ) %}
+{%-       set merge_lists = matcher.value
+          | traverse(
+            "merge_lists",
+            defaults
+            | traverse(
+              "merge_lists",
+              False
+            )
+          )
+          | to_bool %}
+
+{%-       if matcher.type in query_map.keys() %}
+{#-         No value is an empty list, must be a dict for `stack.update` #}
+{%-         set normalized_value = matcher.value | default({}, boolean=True) %}
+
+{#-         Merge in `mapdata.<query>` instead of directly in `mapdata` #}
+{%-         set is_sub_key = matcher.option | default(False) == "SUB" %}
+{%-         if is_sub_key %}
+{#-           Merge values with `mapdata.<key>`, `<key>` and `<key>:lookup` are merged together #}
+{%-           set value = { matcher.query | regex_replace(":lookup$", ""): normalized_value } %}
+{%-         else %}
+{%-           set value = normalized_value %}
+{%-         endif %}
+
+{%-         do salt["log.debug"](
+              log_prefix
+              ~ "merge "
+              ~ "sub key " * is_sub_key
+              ~ "'"
+              ~ matcher.query
+              ~ "' retrieved with '"
+              ~ matcher.query_method
+              ~ "', merge: strategy='"
+              ~ strategy
+              ~ "', lists='"
+              ~ merge_lists
+              ~ "':\n"
+              ~ value
+              | yaml(False)
+            ) %}
+
+{%-         do stack.update(
+              {
+                "values": salt["slsutil.merge"](
+                  stack["values"],
+                  value,
+                  strategy=strategy,
+                  merge_lists=merge_lists,
+                )
+              }
+            ) %}
+
+{%-       else %}
+{#-         Load YAML file matching the grain/pillar/... #}
+{#-         Fallback to use the source name as a direct filename #}
+
+{%-         if matcher.value is sequence and matcher.value | length == 0 %}
+{#-           Mangle `matcher.value` to use it as literal path #}
+{%-           set query_parts = matcher.query.split("/") %}
+{%-           set yaml_dirname = query_parts[0:-1] | join("/") %}
+{%-           set yaml_names = query_parts[-1] %}
+{%-         else %}
+{%-           set yaml_dirname = matcher.query %}
+{%-           set yaml_names = matcher.value %}
+{%-         endif %}
+
+{#-         Some configuration return list #}
+{%-         if yaml_names is string %}
+{%-           set yaml_names = [yaml_names] %}
+{%-         elif yaml_names is sequence %}
+{#-           Convert to strings if it's a sequence of numbers #}
+{%-           set yaml_names = yaml_names | map("string") | list %}
+{%-         else %}
+{%-           set yaml_names = [yaml_names | string] %}
+{%-         endif %}
+
+{#-         Try to load a `.yaml.jinja` file for each `.yaml` file #}
+{%-         set all_yaml_names = [] %}
+{%-         for name in yaml_names %}
+{%-           set extension = name.rpartition(".")[2] %}
+{%-           if extension not in ["yaml", "jinja"] %}
+{%-             do all_yaml_names.extend([name ~ ".yaml", name ~ ".yaml.jinja"]) %}
+{%-           elif extension == "yaml" %}
+{%-             do all_yaml_names.extend([name, name ~ ".jinja"]) %}
+{%-           else %}
+{%-             do all_yaml_names.append(name) %}
+{%-           endif %}
+{%-         endfor %}
+
+{#-         `yaml_dirname` can be an empty string with literal path like `myconf.yaml` #}
+{%-         set yaml_dir = [
+              param_dir,
+              yaml_dirname
+            ]
+            | select
+            | join("/") %}
+
+{%-         for yaml_name in all_yaml_names %}
+{%-           set yaml_filename = [
+                yaml_dir.rstrip("/"),
+                yaml_name
+              ]
+              | select
+              | join("/") %}
+
+{%-           do salt["log.debug"](
+                log_prefix
+                ~ "load configuration values from "
+                ~ yaml_filename
+              ) %}
+{%-           load_yaml as yaml_values %}
+{%-             include yaml_filename ignore missing %}
+{%-           endload %}
+
+{%-           if yaml_values %}
+{%-             do salt["log.debug"](
+                  log_prefix
+                  ~ "loaded configuration values from "
+                  ~ yaml_filename
+                  ~ ":\n"
+                  ~ yaml_values
+                  | yaml(False)
+                ) %}
+
+{#-             `slsutil.merge` options from #}
+{#-             1. the `value` #}
+{#-             2. the `defaults` #}
+{#-             3. the built-in #}
+{%-             set strategy = yaml_values
+                  | traverse(
+                    "strategy",
+                    defaults
+                    | traverse(
+                      "strategy",
+                      "smart"
+                    )
+                  ) %}
+{%-             set merge_lists = yaml_values
+                  | traverse(
+                    "merge_lists",
+                    defaults
+                    | traverse(
+                      "merge_lists",
+                      False
+                    )
+                  )
+                  | to_bool %}
+{%-             do stack.update(
+                  {
+                    "values": salt["slsutil.merge"](
+                      stack["values"],
+                      yaml_values
+                      | traverse("values", {}),
+                      strategy=strategy,
+                      merge_lists=merge_lists,
+                    )
+                  }
+                ) %}
+{%-             do salt["log.debug"](
+                  log_prefix
+                  ~ "merged configuration values from "
+                  ~ yaml_filename
+                  ~ ", merge: strategy='"
+                  ~ strategy
+                  ~ "', merge_lists='"
+                  ~ merge_lists
+                  ~ "':\n"
+                  ~ {"values": stack["values"]}
+                  | yaml(False)
+                ) %}
+{%-           endif %}
+{%-         endfor %}
+{%-       endif %}
+{%-     endfor %}
+{%-   endfor %}
+
+{%-   do salt["log.debug"](
+        log_prefix
+        ~ "final configuration values:\n"
+        ~ {"values": stack["values"]}
+        | yaml(False)
+      ) %}
+
+{#- Output stack as YAML, caller should use with something like #}
+{#- `{%- set config = mapstack(matchers=["foo"]) | load_yaml %}` #}
+{{ stack | yaml }}
+
+{%- endmacro %}

gitea/libmatchers.jinja

@@ -0,0 +1,222 @@
+{#- -*- coding: utf-8 -*- #}
+{#- vim: ft=jinja #}
+
+{#- Get the `tplroot` from `tpldir` #}
+{%- set tplroot = tpldir.split("/")[0] %}
+{%- from tplroot ~ "/libsaltcli.jinja" import cli with context %}
+
+{%- set query_map = {
+      "C": "config.get",
+      "G": "grains.get",
+      "I": "pillar.get",
+    } %}
+
+{#- When no part before `@` is provided: #}
+{#-   - define a YAML file path, noted `Y` #}
+{#-   - use `salt["config.get"]`, noted `C` #}
+{#-   - use colon `:` delimiter for querying #}
+{%- set _defaults = {
+      "type": "Y",
+      "query_type": "C",
+      "query_delimiter": ":"
+    } %}
+
+{%- macro parse_matchers(
+      matchers,
+      config_get_strategy=None,
+      log_prefix="libmatchers: "
+    ) %}
+{#-   matcher format is `[<TYPE>[:<OPTION>[:DELIMITER]]@]<KEY>` #}
+{#-   each matcher has a type: #}
+{#-   - `Y` to build a YAML file name (the default when no type is set) #}
+{#-   - `C` to lookup values with `config.get` #}
+{#-   - `G` to lookup values with `grains.get` #}
+{#-   - `I` to lookup values with `pillar.get` #}
+{#-   The `YAML` type option can define query type to build the file name: #}
+{#-   - `C` for query with `config.get` (the default when to query type is set) #}
+{#-   - `G` for query with `grains.get` #}
+{#-   - `I` for query with `pillar.get` #}
+{#-   With `DELIMITER`, you can choose a different delimiter when doing queries #}
+{%-   set parsed_matchers = [] %}
+{%-   for matcher in matchers %}
+{%-     do salt["log.debug"](
+          log_prefix
+          ~ "process matcher: '"
+          ~ matcher
+          ~ "'"
+        ) %}
+
+{%-     set parsed = {} %}
+{%-     set matcher_parts = matcher.split('@') %}
+{%-     if matcher_parts | length == 1 %}
+{#-       By default we load YAML files for config looked up by `config.get` #}
+{%-       do parsed.update(
+            {
+              "type": _defaults["type"],
+              "option": None,
+              "query_method": query_map[_defaults["query_type"]],
+              "query_delimiter": _defaults["query_delimiter"],
+              "query": matcher
+            }
+          ) %}
+{%-       do salt["log.debug"](
+            log_prefix
+            ~ "use built-in defaults for matcher:\n"
+            ~ parsed
+            | yaml(False)
+            | indent(4, True)
+          ) %}
+{%-     else %}
+{%-       do salt["log.debug"](
+            log_prefix
+            ~ "parse matcher: '"
+            ~ matcher
+            ~ "'"
+          ) %}
+{%-       set metadatas = matcher_parts[0].split(":") %}
+{%-       do parsed.update(
+            {
+              "query": matcher_parts[1]
+            }
+          ) %}
+{%-       if metadatas | length == 1 %}
+{%-         do parsed.update(
+              {
+                "type": metadatas[0],
+                "option": "C",
+                "query_delimiter": ":"
+              }
+            ) %}
+{%-         do salt["log.debug"](
+              log_prefix
+              ~ "parse as 1 metadata matcher:\n"
+              ~ parsed
+              | yaml(False)
+              | indent(4, True)
+            ) %}
+{%-       elif metadatas | length == 2 %}
+{%-         do parsed.update(
+              {
+                "type": metadatas[0],
+                "option": metadatas[1],
+                "query_delimiter": ":"
+              }
+            ) %}
+{%-         do salt["log.debug"](
+              log_prefix
+              ~ "parse as 2 metadata matcher:\n"
+              ~ parsed
+              | yaml(False)
+              | indent(4, True)
+            ) %}
+{%-       elif metadatas | length == 3 %}
+{%-         do parsed.update(
+              {
+                "type": metadatas[0],
+                "option": metadatas[1],
+                "query_delimiter": metadatas[2] | default(":", boolean=True)
+              }
+            ) %}
+{%-         do salt["log.debug"](
+              log_prefix
+              ~ "parse as 3 metadata matcher:\n"
+              ~ parsed
+              | yaml(False)
+              | indent(4, True)
+            ) %}
+{%-       elif metadatas | length == 4 %}
+{#-         The delimiter is `:` #}
+{%-         do parsed.update(
+              {
+                "type": metadatas[0],
+                "option": metadatas[1],
+                "query_delimiter": ":"
+              }
+            ) %}
+{%-         do salt["log.debug"](
+              log_prefix
+              ~ "parse as 4 metadata matcher:\n"
+              ~ parsed
+              | yaml(False)
+              | indent(4, True)
+            ) %}
+{%-       endif %}
+{%-     endif %}
+
+{#-     The `<OPTION>` has different meaning based on type #}
+{%-     if query_map.get(parsed.type, False) %}
+{%-       do parsed.update(
+            {
+              "query_method": query_map[parsed.type]
+            }
+          ) %}
+{%-     else %}
+{%-       do parsed.update(
+            {
+              "query_method": query_map[
+                parsed.option
+                | default("C", boolean=True)
+              ]
+            }
+          ) %}
+{%-     endif %}
+
+{#-     Add `merge:` option to `salt["config.get"]` if configured #}
+{%-     if cli not in ["ssh", "unknown"] and parsed.query_method == "config.get" and config_get_strategy %}
+{%-       set query_opts = {
+            "merge": config_get_strategy,
+            "delimiter": parsed.query_delimiter,
+          } %}
+{%-       set query_opts_msg = (
+            ", delimiter='"
+            ~ parsed.query_delimiter
+            ~ "', merge: strategy='"
+            ~ config_get_strategy
+            ~ "'"
+          ) %}
+{%-     else %}
+{%-       if cli in ["ssh", "unknown"] %}
+{%-         do salt["log.warning"](
+              log_prefix
+              ~ "the 'delimiter' and 'merge' options of 'config.get' are skipped when the salt command type is '"
+              ~ cli
+              ~ "'"
+            ) %}
+{%-       endif %}
+{%-       set query_opts = {} %}
+{%-       set query_opts_msg = "" %}
+{%-     endif %}
+
+{%-     do salt["log.debug"](
+          log_prefix
+          ~ "lookup '"
+          ~ parsed.query
+          ~ "' with '"
+          ~ parsed.query_method
+          ~ "'"
+          ~ query_opts_msg
+        ) %}
+{%-     set values = salt[parsed.query_method](
+          parsed.query,
+          default=[],
+          **query_opts
+        ) %}
+{%-     do parsed.update(
+          {
+            "value": values
+          }
+        ) %}
+
+{%-     do parsed_matchers.append(parsed) %}
+
+{%-   endfor %}
+{%-   do salt["log.debug"](
+        log_prefix
+        ~ "parsed matchers:\n"
+        ~ parsed_matchers
+        | yaml(False)
+        | indent(4, True)
+      ) %}
+
+{{ parsed_matchers | yaml }}
+{%- endmacro %}

gitea/libsaltcli.jinja

@@ -0,0 +1,18 @@
+{#- -*- coding: utf-8 -*- #}
+{#- vim: ft=jinja #}
+
+{#- Get the relevant values from the `opts` dict #}
+{%- set opts_cli = opts.get('__cli', '') %}
+{%- set opts_masteropts_cli = opts | traverse('__master_opts__:__cli', '') %}
+
+{#- Determine the type of salt command being run #}
+{%- if opts_cli == 'salt-minion' %}
+{%-   set cli = 'minion' %}
+{%- elif opts_cli == 'salt-call' %}
+{%-   set cli = 'ssh' if opts_masteropts_cli in ('salt-ssh', 'salt-master') else 'local' %}
+{%- elif opts_cli %}
+{%-   set cli = 'api' %}
+{%- else %}
+{%-   set cli = 'unknown' %}
+{%- endif %}
+{%- do salt['log.debug']('[libsaltcli] the salt command type has been identified to be: ' ~ cli) %}

gitea/libtofs.jinja

@@ -0,0 +1,115 @@
+{%- macro files_switch(
+      source_files,
+      lookup=None,
+      default_files_switch=["id", "os_family"],
+      indent_width=6,
+      use_subpath=False
+    ) %}
+{#-
+    Returns a valid value for the "source" parameter of a "file.managed"
+    state function. This makes easier the usage of the Template Override and
+    Files Switch (TOFS) pattern.
+    Params:
+      * source_files: ordered list of files to look for
+      * lookup: key under "<tplroot>:tofs:source_files" to prepend to the
+        list of source files
+      * default_files_switch: if there's no config (e.g. pillar)
+        "<tplroot>:tofs:files_switch" this is the ordered list of grains to
+        use as selector switch of the directories under
+        "<path_prefix>/files"
+      * indent_width: indentation of the result value to conform to YAML
+      * use_subpath: defaults to `False` but if set, lookup the source file
+        recursively from the current state directory up to `tplroot`
+    Example (based on a `tplroot` of `xxx`):
+    If we have a state:
+      Deploy configuration:
+        file.managed:
+          - name: /etc/yyy/zzz.conf
+          - source: {{ files_switch(
+                         ["/etc/yyy/zzz.conf", "/etc/yyy/zzz.conf.jinja"],
+                         lookup="Deploy configuration",
+                       ) }}
+          - template: jinja
+    In a minion with id=theminion and os_family=RedHat, it's going to be
+    rendered as:
+      Deploy configuration:
+        file.managed:
+          - name: /etc/yyy/zzz.conf
+          - source:
+            - salt://xxx/files/theminion/etc/yyy/zzz.conf
+            - salt://xxx/files/theminion/etc/yyy/zzz.conf.jinja
+            - salt://xxx/files/RedHat/etc/yyy/zzz.conf
+            - salt://xxx/files/RedHat/etc/yyy/zzz.conf.jinja
+            - salt://xxx/files/default/etc/yyy/zzz.conf
+            - salt://xxx/files/default/etc/yyy/zzz.conf.jinja
+          - template: jinja
+#}
+{#-   Get the `tplroot` from `tpldir` #}
+{%-   set tplroot = tpldir.split("/")[0] %}
+{%-   set path_prefix = salt["config.get"](tplroot ~ ":tofs:path_prefix", tplroot) %}
+{%-   set files_dir = salt["config.get"](tplroot ~ ":tofs:dirs:files", "files") %}
+{%-   set files_switch_list = salt["config.get"](
+        tplroot ~ ":tofs:files_switch", default_files_switch
+      ) %}
+{#-   Lookup source_files (v2), files (v1), or fallback to an empty list #}
+{%-   set src_files = salt["config.get"](
+        tplroot ~ ":tofs:source_files:" ~ lookup,
+        salt["config.get"](tplroot ~ ":tofs:files:" ~ lookup, []),
+      ) %}
+{#-   Append the default source_files #}
+{%-   set src_files = src_files + source_files %}
+{#-   Only add to [""] when supporting older TOFS implementations #}
+{%-   set path_prefix_exts = [""] %}
+{%-   if use_subpath and tplroot != tpldir %}
+{#-     Walk directory tree to find {{ files_dir }} #}
+{%-     set subpath_parts = tpldir.lstrip(tplroot).lstrip("/").split("/") %}
+{%-     for path in subpath_parts %}
+{%-       set subpath = subpath_parts[0 : loop.index] | join("/") %}
+{%-       do path_prefix_exts.append("/" ~ subpath) %}
+{%-     endfor %}
+{%-   endif %}
+{%-   for path_prefix_ext in path_prefix_exts | reverse %}
+{%-     set path_prefix_inc_ext = path_prefix ~ path_prefix_ext %}
+{#-     For older TOFS implementation, use `files_switch` from the config #}
+{#-     Use the default, new method otherwise #}
+{%-     set fsl = salt["config.get"](
+          tplroot ~ path_prefix_ext | replace("/", ":") ~ ":files_switch",
+          files_switch_list,
+        ) %}
+{#-     Append an empty value to evaluate as `default` in the loop below #}
+{%-     if "" not in fsl %}
+{%-       set fsl = fsl + [""] %}
+{%-     endif %}
+{%-     for fs in fsl %}
+{%-       for src_file in src_files %}
+{%-         if fs %}
+{%-           set fs_dirs = salt["config.get"](fs, fs) %}
+{%-         else %}
+{%-           set fs_dirs = salt["config.get"](
+                tplroot ~ ":tofs:dirs:default", "default"
+              ) %}
+{%-         endif %}
+{#-         Force the `config.get` lookup result as a list where necessary #}
+{#-         since we need to also handle grains that are lists #}
+{%-         if fs_dirs is string %}
+{%-           set fs_dirs = [fs_dirs] %}
+{%-         endif %}
+{%-         for fs_dir in fs_dirs %}
+{#-           strip empty elements by using a select #}
+{%-           set url = (
+                [
+                  "- salt:/",
+                  path_prefix_inc_ext.strip("/"),
+                  files_dir.strip("/"),
+                  fs_dir.strip("/"),
+                  src_file.strip("/"),
+                ]
+                | select
+                | join("/")
+              ) %}
+{{ url | indent(indent_width, true) }}
+{%-         endfor %}
+{%-       endfor %}
+{%-     endfor %}
+{%-   endfor %}
+{%- endmacro %}

gitea/map.jinja

@@ -0,0 +1,66 @@
+{#- -*- coding: utf-8 -*- #}
+{#- vim: ft=jinja #}
+
+{#- Get the `tplroot` from `tpldir` #}
+{%- set tplroot = tpldir.split("/")[0] %}
+{%- from tplroot ~ "/libmapstack.jinja" import mapstack with context %}
+
+{#- Where to lookup parameters source files #}
+{%- set formula_param_dir = tplroot ~ "/parameters" %}
+
+{#- List of sources to lookup for parameters #}
+{#- Fallback to previously used grains plus minion `id` #}
+{%- set map_sources = [
+      "Y:G@osarch",
+      "Y:G@os_family",
+      "Y:G@os",
+      "Y:G@osfinger",
+      "C@" ~ tplroot ~ ":lookup",
+      "C@" ~ tplroot,
+      "Y:G@id",
+    ] %}
+
+{%- set _map_settings = mapstack(
+      matchers=["map_jinja.yaml"],
+      defaults={
+        "values": {"sources": map_sources}
+      },
+      log_prefix="map.jinja configuration: ",
+    )
+    | load_yaml %}
+
+{%- set map_sources = _map_settings | traverse("values:sources") %}
+{%- do salt["log.debug"](
+      "map.jinja: load parameters from sources:\n"
+      ~ map_sources
+      | yaml(False)
+    ) %}
+
+{#- Load formula parameters values #}
+{%- set _formula_matchers = ["defaults.yaml"] + map_sources %}
+
+{%- set _formula_settings = mapstack(
+      matchers=_formula_matchers,
+      dirs=[formula_param_dir],
+      defaults={
+        "values": {},
+        "merge_strategy": salt["config.get"](tplroot ~ ":strategy", None),
+        "merge_lists": salt["config.get"](tplroot ~ ":merge_lists", False),
+      },
+      log_prefix="map.jinja: ",
+    )
+    | load_yaml %}
+
+{#- Make sure to track `map.jinja` configuration with `_mapdata` #}
+{%- do _formula_settings["values"].update(
+      {
+        "map_jinja": _map_settings["values"]
+      }
+    ) %}
+
+{%- do salt["log.debug"]("map.jinja: save parameters in variable 'mapdata'") %}
+{%- set mapdata = _formula_settings["values"] %}
+
+{#- Per formula post-processing of `mapdata` if it exists #}
+{%- do salt["log.debug"]("map.jinja: post-processing of 'mapdata'") %}
+{%- include tplroot ~ "/post-map.jinja" ignore missing %}

gitea/package/clean.sls

@@ -0,0 +1,33 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+{%- set tplroot = tpldir.split('/')[0] %}
+{%- set sls_config_clean = tplroot ~ '.config.clean' %}
+{%- from tplroot ~ "/map.jinja" import mapdata as gitea with context %}
+
+include:
+  - {{ sls_config_clean }}
+
+# This does not delete the working/data dirs to prevent accidental loss.
+Gitea package files are absent:
+  file.absent:
+    - names:
+      - {{ gitea.lookup.service.unit.format(name=gitea.lookup.service.name) }}
+      - {{ gitea.lookup.paths.bin | path_join('gitea') }}
+{%- for p in ['conf', 'custom', 'log'] %}
+      - {{ gitea.lookup.paths[p] }}
+{%- endfor %}
+      # to make sure this can be installed again (onchanges req in package.installed)
+      - /tmp/gitea-{{ gitea.version }}
+    - require:
+      - sls: {{ sls_config_clean }}
+
+Gitea user/group are absent:
+  user.absent:
+    - name: {{ gitea.lookup.user }}
+    - require:
+      - sls: {{ sls_config_clean }}
+  group.absent:
+    - name: {{ gitea.lookup.group }}
+    - require:
+      - sls: {{ sls_config_clean }}

gitea/package/init.sls

@@ -0,0 +1,5 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+include:
+  - .install

gitea/package/install.sls

@@ -0,0 +1,148 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+{%- set tplroot = tpldir.split('/')[0] %}
+{%- from tplroot ~ "/map.jinja" import mapdata as gitea with context %}
+{%- from tplroot ~ "/libtofs.jinja" import files_switch with context %}
+
+Gitea user/group is present:
+  user.present:
+    - name: {{ gitea.lookup.user }}
+    - home: {{ gitea.lookup.paths.home }}
+    - createhome: true  # does not work on Windows/MacOS
+    - shell: {{ gitea.lookup.shell }}
+    - empty_password: true
+    - fullname: Git Version Control
+    - system: true
+    - usergroup: {{ gitea.lookup.group == gitea.lookup.user }}
+{%- if gitea.lookup.group != gitea.lookup.user %}
+    - gid: {{ gitea.lookup.group }}
+    - require:
+      - group: {{ gitea.lookup.group }}
+  group.present:
+    - name: {{ gitea.lookup.group }}
+    - system: true
+{%- endif %}
+
+Requirements for managing Gitea are fulfilled:
+  pkg.installed:
+    - pkgs: {{ gitea.lookup.requirements | json }}
+  # needed to avoid exception when running gpg.get_key in unless below
+  cmd.run:
+    - name: gpg --list-keys
+    - unless:
+      - test -d "${GNUPG_HOME:-$HOME/.gnupg}"
+      # the above does not work somehow
+      - test -d /root/.gnupg
+
+Gitea is available:
+  file.managed:
+    - names:
+      - /tmp/gitea-{{ gitea.version }}:
+        - source: {{ gitea.lookup.pkg.source.format(version=gitea.version, arch=gitea.lookup.arch) }}
+        - source_hash: {{ gitea.lookup.pkg.source_hash.format(version=gitea.version, arch=gitea.lookup.arch) }}
+      - /tmp/gitea-{{ gitea.version }}.asc:
+        - source: {{ gitea.lookup.pkg.sig.format(version=gitea.version, arch=gitea.lookup.arch) }}
+        - skip_verify: true
+    - user: {{ gitea.lookup.user }}
+    - group: {{ gitea.lookup.group }}
+
+Gitea GPG key is present (received from keyserver):
+  gpg.present:
+    - name: {{ gitea.lookup.gpg.key }}
+    - keyserver: {{ gitea.lookup.gpg.keyserver }}
+
+Gitea GPG key is present (fallback):
+  file.managed:
+    - name: /tmp/gitea-key.asc
+    - source: salt://gitea/files/default/key.asc
+    - onfail:
+      - Gitea GPG key is present (received from keyserver)
+  module.run:
+    - gpg.import_key:
+      - filename: /tmp/gitea-key.asc
+    - onfail:
+      - Gitea GPG key is present (received from keyserver)
+    - require:
+      - file: /tmp/gitea-key.asc
+
+Gitea is verified:
+  module.run:
+    - gpg.verify:
+      - filename: /tmp/gitea-{{ gitea.version }}
+      - signature: /tmp/gitea-{{ gitea.version }}.asc
+    - require:
+      - Gitea is available
+    - require_any:
+      - Gitea GPG key is present (received from keyserver)
+      - Gitea GPG key is present (fallback)
+
+Gitea binary is absent if verification failed:
+  file.absent:
+    - name: /tmp/gitea-{{ gitea.version }}
+    - onfail:
+      - Gitea is verified
+
+Gitea directories are setup:
+  file.directory:
+    - names:
+{%- for p in ['conf', 'work', 'custom', 'data', 'log', 'repos'] %}
+      - {{ gitea.lookup.paths[p] }}
+{%- endfor %}
+    - makedirs: true
+    - user: {{ gitea.lookup.user }}
+    - group: {{ gitea.lookup.group }}
+    # This prevents the web-installer from functioning, would need 0770 on /etc/gitea.
+    - mode: '0750'
+
+Gitea binary is installed:
+  file.copy:
+    - name: {{ gitea.lookup.paths.bin | path_join('gitea') }}
+    - source: /tmp/gitea-{{ gitea.version }}
+    # in case the version changed, overwrite previous binary
+    - force: true
+    - makedirs: true
+    - user: {{ gitea.lookup.user }}
+    - group: {{ gitea.lookup.group }}
+    - mode: '0755'
+    # only run if a new version was downloaded
+    - onchanges:
+      - Gitea is available
+    - require:
+      - Gitea is verified
+
+Gitea service unit is available:
+  file.managed:
+    - name: {{ gitea.lookup.service.unit.format(name=gitea.lookup.service.name) }}
+    - source: {{ files_switch(
+                    ['gitea.service.j2'],
+                    lookup='Gitea service unit is available',
+                  ) }}
+    - template: jinja
+    - mode: '0644'
+    - user: root
+    - group: {{ gitea.lookup.rootgroup }}
+    - makedirs: true
+    - context: {{ {'gitea': gitea} | json }}
+    - require:
+      - Gitea binary is installed
+{%- if 'systemctl' | which %}
+  # this executes systemctl daemon-reload
+  module.run:
+    - service.systemctl_reload: []
+    - onchanges:
+      - file: {{ gitea.lookup.service.unit.format(name=gitea.lookup.service.name) }}
+{%- endif %}
+
+Gitea setup is finished:
+  test.show_notification:
+    - text: >-
+        Yay, Gitea setup is finished.
+        The web installer will not work, so make sure you have specified
+        at least the database configuration. The configuration will be installed
+        after this message.
+    - require:
+      - Gitea user/group is present
+      - Requirements for managing Gitea are fulfilled
+      - Gitea directories are setup
+      - Gitea binary is installed

gitea/parameters/defaults.yaml

@@ -0,0 +1,70 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set default values.
+---
+values:
+  lookup:
+    rootgroup: root
+    service:
+      name: gitea
+      unit: /etc/systemd/system/{name}.service
+    gpg:
+      key: 7C9E68152594688862D62AF62D9AE806EC1592E2
+      keyserver: keys.openpgp.org
+    group: git
+    paths:
+      bin: /opt/gitea
+      conf: /etc/opt/gitea
+      custom: /var/opt/gitea/custom
+      data: /var/opt/gitea/data
+      home: /var/opt/gitea/home
+      internal_token_uri: file:///etc/opt/gitea/internal_token
+      log: /var/opt/gitea/log
+      repos: /var/opt/gitea/data/gitea-repositories
+      work: /var/opt/gitea
+    pkg:
+      latest: https://dl.gitea.io/gitea/version.json
+      sig: https://dl.gitea.io/gitea/{version}/gitea-{version}-linux-{arch}.asc
+      source: https://dl.gitea.io/gitea/{version}/gitea-{version}-linux-{arch}
+      source_hash: https://dl.gitea.io/gitea/{version}/gitea-{version}-linux-{arch}.sha256  # yamllint disable-line rule:line-length
+    requirements:
+      - git
+      - gpg
+      - python-gnupg
+    shell: /bin/bash
+    user: git
+  config:
+    default:
+      app_name: Gitea
+      run_mode: prod
+      run_user: git
+    log:
+      level: Info
+      mode: console
+      stacktrace_level: None
+    repository.signing:
+      signing_key: default
+    server:
+      domain: localhost
+      http_addr: 0.0.0.0
+      http_port: 3000
+      protocol: http
+  database:
+    db_type: sqlite3
+    name: gitea
+    password: hunter1
+    user: root
+  secrets:
+    internal_token: ''
+    jwt_secret: ''
+    lfs_jwt_secret: ''
+    secret_key: ''
+  service:
+    requires_mount: []
+    wants: []
+  version: latest
+  # Just here for testing
+  added_in_defaults: defaults_value
+  winner: defaults
+...

gitea/parameters/map_jinja.yaml

@@ -0,0 +1,15 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set mapstack sources.
+---
+values:
+  sources:
+    - "Y:G@osarch"
+    - "Y:G@os_family"
+    - "Y:G@os"
+    - "Y:G@osfinger"
+    - "C@tool_global"
+    - "C@{{ tplroot }}"
+    - "Y:G@id"
+...

gitea/parameters/os_family/Arch.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('os_family') == Arch.
+#
+# You just need to add the key:values for this `os_family` that differ
+# from `defaults.yaml` + `<osarch>.yaml`.
+#
+# If you do not need to provide defaults via the `os_family` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    pkg_manager: pacman
+...

gitea/parameters/os_family/Debian.yaml

@@ -0,0 +1,21 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('os_family') == Debian.
+#
+# You just need to add the key:values for this `os_family` that differ
+# from `defaults.yaml` + `<osarch>.yaml`.
+#
+# If you do not need to provide defaults via the `os_family` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    pkg_manager: apt
+    requirements:
+      - git
+      - gpg
+      - python3-gnupg
+...

gitea/parameters/os_family/FreeBSD.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('os_family') == FreeBSD.
+#
+# You just need to add the key:values for this `os_family` that differ
+# from `defaults.yaml` + `<osarch>.yaml`.
+#
+# If you do not need to provide defaults via the `os_family` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    pkg_manager: pkg
+    rootgroup: wheel
+...

gitea/parameters/os_family/Gentoo.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('os_family') == Gentoo.
+#
+# You just need to add the key:values for this `os_family` that differ
+# from `defaults.yaml` + `<osarch>.yaml`.
+#
+# If you do not need to provide defaults via the `os_family` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    pkg_manager: portage
+...

gitea/parameters/os_family/MacOS.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('os_family') == MacOS.
+#
+# You just need to add the key:values for this `os_family` that differ
+# from `defaults.yaml` + `<osarch>.yaml`.
+#
+# If you do not need to provide defaults via the `os_family` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    pkg_manager: brew
+    rootgroup: wheel
+...

gitea/parameters/os_family/OpenBSD.yaml

@@ -0,0 +1,18 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('os_family') == OpenBSD.
+#
+# You just need to add the key:values for this `os_family` that differ
+# from `defaults.yaml` + `<osarch>.yaml`.
+#
+# If you do not need to provide defaults via the `os_family` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    pkg_manager: pkg
+    rootgroup: wheel
+...

gitea/parameters/os_family/RedHat.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('os_family') == RedHat.
+#
+# You just need to add the key:values for this `os_family` that differ
+# from `defaults.yaml` + `<osarch>.yaml`.
+#
+# If you do not need to provide defaults via the `os_family` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    pkg_manager: yum
+...

gitea/parameters/os_family/Suse.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('os_family') == Suse.
+#
+# You just need to add the key:values for this `os_family` that differ
+# from `defaults.yaml` + `<osarch>.yaml`.
+#
+# If you do not need to provide defaults via the `os_family` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    pkg_manager: zypper
+...

gitea/parameters/osarch/386.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('osarch') == 386.
+#
+# You just need to add the key:values for this `osarch` that differ
+# from `defaults.yaml`.
+#
+# If you do not need to provide defaults via the `osarch` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    arch: '386'
+...

gitea/parameters/osarch/amd64.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('osarch') == amd64.
+#
+# You just need to add the key:values for this `osarch` that differ
+# from `defaults.yaml`.
+#
+# If you do not need to provide defaults via the `osarch` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    arch: amd64
+...

gitea/parameters/osarch/arm64.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('osarch') == arm64.
+#
+# You just need to add the key:values for this `osarch` that differ
+# from `defaults.yaml`.
+#
+# If you do not need to provide defaults via the `osarch` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    arch: arm64
+...

gitea/parameters/osarch/armv6l.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('osarch') == armv6l.
+#
+# You just need to add the key:values for this `osarch` that differ
+# from `defaults.yaml`.
+#
+# If you do not need to provide defaults via the `osarch` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    arch: armv6l
+...

gitea/parameters/osarch/armv7l.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('osarch') == armv7l.
+#
+# You just need to add the key:values for this `osarch` that differ
+# from `defaults.yaml`.
+#
+# If you do not need to provide defaults via the `osarch` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    arch: armv7l
+...

gitea/parameters/osarch/ppc64le.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('osarch') == ppc64le.
+#
+# You just need to add the key:values for this `osarch` that differ
+# from `defaults.yaml`.
+#
+# If you do not need to provide defaults via the `osarch` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    arch: ppc64le
+...

gitea/parameters/osarch/s390x.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('osarch') == s390x.
+#
+# You just need to add the key:values for this `osarch` that differ
+# from `defaults.yaml`.
+#
+# If you do not need to provide defaults via the `osarch` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    arch: s390x
+...

gitea/parameters/osarch/x86_64.yaml

@@ -0,0 +1,17 @@
+# -*- coding: utf-8 -*-
+# vim: ft=yaml
+#
+# Set values specific to:
+#   salt['config.get']('osarch') == x86_64.
+#
+# You just need to add the key:values for this `osarch` that differ
+# from `defaults.yaml`.
+#
+# If you do not need to provide defaults via the `osarch` config,
+# you can remove this file or provide at least an empty dict, e.g.
+# values: {}
+---
+values:
+  lookup:
+    arch: amd64
+...

gitea/post-map.jinja

@@ -0,0 +1,65 @@
+{#- -*- coding: utf-8 -*- #}
+{#- vim: ft=jinja #}
+
+{#- If latest was specified, query the official download server for the latest version. -#}
+
+{%- if 'latest' == mapdata.version -%}
+  {%- set latest = salt['http.query'](
+        mapdata.lookup.pkg.latest,
+        decode=True, decode_type='json'
+      )['dict']['latest']['version']
+  -%}
+  {%- do mapdata.update({'version': latest}) -%}
+{%- endif -%}
+
+
+{#-
+    If paths are different than default, they need to be specified in the config.
+    CUSTOM_PATH and WORKDIR are environment variables.
+    I'm not sure about `log` tbh. Per the official docs, the default is empty.
+    This might cause duplicate entries if the user did not specify in all-lowercase.
+    Also, it will not overwrite custom configuration, which might make the installation fail.
+-#}
+
+{%- for path in [
+      ('app_data_path', 'server', mapdata.lookup.paths.data, mapdata.lookup.paths.work | path_join('data')),
+      ('root_path', 'log', mapdata.lookup.paths.log, mapdata.lookup.paths.work | path_join('log')),
+      ('root', 'repository', mapdata.lookup.paths.repos, mapdata.lookup.paths.data | path_join('gitea-repositories')),
+    ] -%}
+  {%- set var, topic, current, default = path -%}
+  {%- if current != default -%}
+    {%- do mapdata | update_dict_key_value('config:' ~ topic, {var: current}) -%}
+  {%- endif -%}
+{%- endfor -%}
+
+
+{#-
+    If the secrets were not provided, get them from a grain/generate and save them there.
+    This avoids
+      a) calling the gitea binary in the app.ini template (`gitea generate secret SECRET_KEY`)
+      b) and special-casing to avoid regenerating those secrets every run.
+
+    The INTERNAL_TOKEN has a special format, but it can be configured to be read from a separate file.
+-#}
+
+{%- if not mapdata.secrets.secret_key -%}
+  {%- set secret_key = salt['grains.get_or_set_hash'](
+        'gitea_secret_key',
+        length=64,
+        chars='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789',
+      )
+  -%}
+  {%- do mapdata.secrets.update({'secret_key': secret_key}) -%}
+{%- endif -%}
+
+{%- for jwt in ['jwt_secret', 'lfs_jwt_secret'] -%}
+  {%- if not mapdata.secrets[jwt] -%}
+    {%- set secret = salt['grains.get_or_set_hash'](
+          'gitea_' ~ jwt ,
+          length=43,
+          chars='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-',
+        )
+    -%}
+    {%- do mapdata.secrets.update({jwt: secret}) -%}
+  {%- endif -%}
+{%- endfor -%}

gitea/service/clean.sls

@@ -0,0 +1,10 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+{%- set tplroot = tpldir.split('/')[0] %}
+{%- from tplroot ~ "/map.jinja" import mapdata as gitea with context %}
+
+gitea-service-clean-service-dead:
+  service.dead:
+    - name: {{ gitea.lookup.service.name }}
+    - enable: False

gitea/service/init.sls

@@ -0,0 +1,5 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+include:
+  - .running

gitea/service/running.sls

@@ -0,0 +1,16 @@
+# -*- coding: utf-8 -*-
+# vim: ft=sls
+
+{%- set tplroot = tpldir.split('/')[0] %}
+{%- set sls_config_file = tplroot ~ '.config.file' %}
+{%- from tplroot ~ "/map.jinja" import mapdata as gitea with context %}
+
+include:
+  - {{ sls_config_file }}
+
+gitea-service-running-service-running:
+  service.running:
+    - name: {{ gitea.lookup.service.name }}
+    - enable: True
+    - watch:
+      - sls: {{ sls_config_file }}