119 lines
4.8 KiB
Django/Jinja
119 lines
4.8 KiB
Django/Jinja
{#- -*- coding: utf-8 -*- #}
|
|
{#- vim: ft=jinja #}
|
|
|
|
{#- If latest was specified, query the official download server for the latest version. -#}
|
|
|
|
{%- if "latest" == mapdata.version -%}
|
|
{%- set latest = salt["http.query"](
|
|
mapdata.lookup.pkg.latest,
|
|
decode=True, decode_type="json"
|
|
)["dict"]["latest"]["version"]
|
|
-%}
|
|
{%- do mapdata.update({"version": latest}) -%}
|
|
{%- endif -%}
|
|
|
|
|
|
{#-
|
|
If paths are different than default, they need to be specified in the config and the service
|
|
needs to grant read/write permissions.
|
|
CUSTOM_PATH and WORKDIR are environment variables.
|
|
I'm not sure about `log` tbh. Per the official docs, the default is empty.
|
|
This might cause duplicate entries if the user did not specify in all-lowercase.
|
|
Also, it will not overwrite custom configuration, which might make the installation fail.
|
|
-#}
|
|
|
|
{%- do mapdata.update({"_rw": []}) -%}
|
|
|
|
{%- for path in [
|
|
("app_data_path", "server", mapdata.lookup.paths.data, mapdata.lookup.paths.work | path_join("data")),
|
|
("root_path", "log", mapdata.lookup.paths.log, mapdata.lookup.paths.work | path_join("log")),
|
|
("root", "repository", mapdata.lookup.paths.repos, mapdata.lookup.paths.data | path_join("gitea-repositories")),
|
|
] -%}
|
|
{%- set var, topic, current, default = path -%}
|
|
{%- if current != default -%}
|
|
{%- do mapdata | update_dict_key_value("config:" ~ topic, {var: current}) -%}
|
|
{#- log directory is handled in service template -#}
|
|
{%- if topic != "log" -%}
|
|
{%- do mapdata._rw.append(current) -%}
|
|
{%- endif -%}
|
|
{%- endif -%}
|
|
{%- endfor -%}
|
|
|
|
|
|
{#-
|
|
If the secrets were not provided, generate them here. Since grains.get_or_set_hash was
|
|
removed, there is no easy way to cache the random value to avoid changing it over and over.
|
|
It cannot be read from `app.ini` since the configparser serializer throws an exception.
|
|
|
|
Generating it here avoids
|
|
a) calling the gitea binary in the app.ini template (`gitea generate secret SECRET_KEY`)
|
|
b) and special-casing to avoid regenerating those secrets every run.
|
|
|
|
The INTERNAL_TOKEN has a special format, but it can be configured to be read from a separate file.
|
|
-#}
|
|
|
|
{%- set current_cached = {} -%}
|
|
{%- set cache_updated = [] -%}
|
|
{%- set cache_file = mapdata.lookup.paths.conf | path_join(".saltcache.yml") -%}
|
|
{%- if salt["file.file_exists"](cache_file) -%}
|
|
{%- do current_cached.update(salt["jinja.import_yaml"](cache_file)) -%}
|
|
{%- else -%}
|
|
{%- do salt["file.mkdir"](mapdata.lookup.paths.conf) -%}
|
|
{%- endif -%}
|
|
{%- for var, val in current_cached.items() -%}
|
|
{%- do mapdata | set_dict_key_value(var, val) -%}
|
|
{%- endfor -%}
|
|
{%- if not mapdata | traverse("config:security:secret_key", "") -%}
|
|
{%- do current_cached.update({"config:security:secret_key": salt["random.get_str"](64, punctuation=false)}) -%}
|
|
{%- do cache_updated.append(true) -%}
|
|
{%- endif -%}
|
|
|
|
{%- for jwt in ["config:oauth2:jwt_secret", "config:server:lfs_jwt_secret"] -%}
|
|
{%- if not mapdata | traverse(jwt, "") -%}
|
|
{%- do current_cached.update({jwt: salt["random.get_str"](43, chars="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-")}) -%}
|
|
{%- do cache_updated.append(true) -%}
|
|
{%- endif -%}
|
|
{%- endfor -%}
|
|
|
|
{%- if cache_updated -%}
|
|
{%- for var, val in current_cached.items() -%}
|
|
{%- do mapdata | set_dict_key_value(var, val) -%}
|
|
{%- endfor -%}
|
|
{%- do salt["file.write"](cache_file, salt["slsutil.serialize"]("yaml", current_cached)) -%}
|
|
{%- do salt["file.set_mode"](cache_file, "0600") -%}
|
|
{%- endif -%}
|
|
|
|
{%- do mapdata.update({"_generate_token": false}) -%}
|
|
{%- if not mapdata.config | traverse("security:internal_token") -%}
|
|
{%- do mapdata.config | update_dict_key_value("security", {"internal_token_uri": mapdata.lookup.paths.internal_token_uri}) -%}
|
|
{%- if "file://" == mapdata.lookup.paths.internal_token_uri[:7] -%}
|
|
{%- do mapdata.update({"_generate_token": true}) -%}
|
|
{%- endif -%}
|
|
{%- endif -%}
|
|
|
|
{%- do mapdata.config | update_dict_key_value("security", {"install_lock": true}) -%}
|
|
|
|
|
|
{#-
|
|
Automatically configure the socket path to use the one provided by Systemd.
|
|
-#}
|
|
|
|
{%- if "unix" in mapdata.config | traverse("server:protocol", "") -%}
|
|
{%- do mapdata.config.server.update({"http_addr": "/run/gitea/gitea.socket"}) -%}
|
|
{%- endif -%}
|
|
|
|
|
|
{#-
|
|
Automatically configure basic service dependencies.
|
|
Memcached/Redis are not as easy to discover (multiple settings)
|
|
and therefore need to be provided manually.
|
|
-#}
|
|
|
|
{%- if mapdata.config | traverse("database:db_type", "mysql") in ["mysql", "postgres", "mssql"] -%}
|
|
{%- set db_type = mapdata.config | traverse("database:db_type", "mysql") -%}
|
|
{%- if db_type not in mapdata.service.wants and salt["service.available"](db_type) -%}
|
|
{#- MariaDB usually provides `mysql.service` as well. -#}
|
|
{%- do mapdata.service.wants.append(db_type) -%}
|
|
{%- endif -%}
|
|
{%- endif -%}
|