Gitea On Loopback, A Config It Never Writes, A Repository Round-Tripped

gitea

Gitea from the upstream release binary (sha256-verified), as a hardened system service on loopback with sqlite and a root-owned configuration it never needs to write, for a proxy that terminates TLS. Original role for EL 10, live-tested with podman on Rocky Linux 10.

No package, so the checksum is the whole story. EL 10 carries no gitea; Gitea ships a release with a checksum file beside it. The role downloads both and has Ansible's get_url refuse the binary unless its SHA-256 is the one in the vendor's file, then installs it as root's in /usr/local/bin, pinned by gitea_version.

A service account, a hardened unit, a loopback listener. gitea is a system user with no shell that owns the data directory and nothing else; the unit runs with NoNewPrivileges, PrivateTmp, ProtectHome and ProtectSystem=strict. The listener is 127.0.0.1:3000 by default, for a proxy that authenticates or a client on the same host; the live test reads the listening sockets and expects loopback only.

A configuration Gitea never writes. Gitea wants three secrets in app.ini and writes them there itself when they are missing, which a root-owned 0640 file forbids. The role generates each once with gitea generate secret and points app.ini at the files (SECRET_KEY_URI, INTERNAL_TOKEN_URI, JWT_SECRET_URI), so the file stays root's and the service reads it. INSTALL_LOCK is on: there is no web installer, and registration is off; the first administrator is gitea admin user create, which is what the live test runs.

Proven by a repository. The live test creates a throwaway administrator with Gitea's own command (a second run finds it), creates a private repository through the API, reads it back authenticated, sees an anonymous request answered 404 for it, and deletes it. git is installed by the role; the built-in SSH server stays off, the host's OpenSSH being the usual door.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.