You've already forked helm-gitea
Rewrite init script (#178)
These changes rewrite the init script to be error aware, informative and have a bit more security awareness. During rewrite several hidden bugs could be identified and fixed, such as: - LDAP configuration options interpreted by the shell before passed to command - Finding multiple ldap ids instead of one during lookup when their names are almost identical e.g. `_my-ldap-auth` and `my-ldap-auth` - Properly filter auth sources by their types to prevent unintended type converting attempts that fail In addition to that the script is a bit cleaner. Some commands do not exist anymore and would cause false-positive errors during script execution. Helps for: #149 Reviewed-on: https://gitea.com/gitea/helm-chart/pulls/178 Reviewed-by: luhahn <luhahn@noreply.gitea.io> Reviewed-by: techknowlogick <techknowlogick@gitea.io> Co-authored-by: justusbunsi <justusbunsi@noreply.gitea.io> Co-committed-by: justusbunsi <justusbunsi@noreply.gitea.io>
This commit is contained in:
justusbunsi
committed by
techknowlogick
techknowlogick
parent
6a6eb35106
commit
9059229acb
@ -6,8 +6,11 @@ metadata:
|
||||
{{- include "gitea.labels" . | nindent 4 }}
|
||||
type: Opaque
|
||||
stringData:
|
||||
init_gitea.sh: |-
|
||||
#!/bin/bash
|
||||
init_directory_structure.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
{{- if .Values.initPreScript }}
|
||||
# BEGIN: initPreScript
|
||||
{{- with .Values.initPreScript -}}
|
||||
@ -16,6 +19,8 @@ stringData:
|
||||
# END: initPreScript
|
||||
{{- end }}
|
||||
|
||||
set -x
|
||||
|
||||
{{- if not .Values.image.rootless }}
|
||||
chown 1000:1000 /data
|
||||
{{- end }}
|
||||
@ -31,44 +36,90 @@ stringData:
|
||||
# Copy config file to writable volume
|
||||
cp /etc/gitea/conf/app.ini /data/gitea/conf/app.ini
|
||||
chmod a+rwx /data/gitea/conf/app.ini
|
||||
configure_gitea.sh: |-
|
||||
#!/usr/bin/env bash
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
{{- if include "db.servicename" . }}
|
||||
# Wait for database to become avialble
|
||||
nc -v -w2 -z {{ include "db.servicename" . }} {{ include "db.port" . }} && \
|
||||
# Connection retry inspired by https://gist.github.com/dublx/e99ea94858c07d2ca6de
|
||||
function test_db_connection() {
|
||||
local RETRY=0
|
||||
local MAX=30
|
||||
|
||||
echo 'Wait for database to become avialable...'
|
||||
until [ "${RETRY}" -ge "${MAX}" ]; do
|
||||
nc -vz -w2 {{ include "db.servicename" . }} {{ include "db.port" . }} && break
|
||||
RETRY=$[${RETRY}+1]
|
||||
echo "...not ready yet (${RETRY}/${MAX})"
|
||||
done
|
||||
|
||||
if [ "${RETRY}" -ge "${MAX}" ]; then
|
||||
echo "Database not reachable after '${MAX}' attempts!"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
test_db_connection
|
||||
{{- end }}
|
||||
{{- if not .Values.image.rootless }}
|
||||
su git -c ' \
|
||||
{{- end }}
|
||||
set -x; \
|
||||
gitea migrate; \
|
||||
|
||||
echo '==== BEGIN GITEA CONFIGURATION ===='
|
||||
|
||||
gitea migrate
|
||||
|
||||
{{- if or .Values.gitea.admin.existingSecret (and .Values.gitea.admin.username .Values.gitea.admin.password) }}
|
||||
gitea admin create-user --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email }} --admin --must-change-password=false \
|
||||
|| \
|
||||
gitea admin change-password --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" \
|
||||
|| \
|
||||
gitea admin user create --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email }} --admin --must-change-password=false \
|
||||
|| \
|
||||
gitea admin user change-password --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}"; \
|
||||
function configure_admin_user() {
|
||||
local ACCOUNT_ID=$(gitea admin user list --admin | grep -e "\s\+${GITEA_ADMIN_USERNAME}\s\+" | awk -F " " "{printf \$1}")
|
||||
if [[ -z "${ACCOUNT_ID}" ]]; then
|
||||
echo "No admin user '${GITEA_ADMIN_USERNAME}' found. Creating now..."
|
||||
gitea admin user create --admin --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}" --email {{ .Values.gitea.admin.email | quote }} --must-change-password=false
|
||||
echo '...created.'
|
||||
else
|
||||
echo "Admin account '${GITEA_ADMIN_USERNAME}' already exist. Running update to sync password..."
|
||||
gitea admin user change-password --username "${GITEA_ADMIN_USERNAME}" --password "${GITEA_ADMIN_PASSWORD}"
|
||||
echo '...password sync done.'
|
||||
fi
|
||||
}
|
||||
|
||||
configure_admin_user
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.gitea.ldap.enabled }}
|
||||
gitea admin auth add-ldap \
|
||||
{{- include "gitea.ldap_settings" . | nindent 6 }} \
|
||||
|| \
|
||||
( \
|
||||
export GITEA_AUTH_ID=$(gitea admin auth list | grep {{ .Values.gitea.ldap.name | quote }} | awk -F " " "{print \$1}"); \
|
||||
gitea admin auth update-ldap --id ${GITEA_AUTH_ID} \
|
||||
{{- include "gitea.ldap_settings" . | nindent 6 }} \
|
||||
) \
|
||||
function configure_ldap() {
|
||||
local LDAP_NAME={{ (printf "%s" .Values.gitea.ldap.name) | squote }}
|
||||
local GITEA_AUTH_ID=$(gitea admin auth list --vertical-bars | grep -E "\|${LDAP_NAME}\s+\|" | grep -iE '\|LDAP \(via BindDN\)\s+\|' | awk -F " " "{print \$1}")
|
||||
|
||||
if [[ -z "${GITEA_AUTH_ID}" ]]; then
|
||||
echo "No ldap configuration found with name '${LDAP_NAME}'. Installing it now..."
|
||||
gitea admin auth add-ldap {{- include "gitea.ldap_settings" . | indent 1 }}
|
||||
echo '...installed.'
|
||||
else
|
||||
echo "Existing ldap configuration with name '${LDAP_NAME}': '${GITEA_AUTH_ID}'. Running update to sync settings..."
|
||||
gitea admin auth update-ldap --id "${GITEA_AUTH_ID}" {{- include "gitea.ldap_settings" . | indent 1 }}
|
||||
echo '...sync settings done.'
|
||||
fi
|
||||
}
|
||||
|
||||
configure_ldap
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.gitea.oauth.enabled }}
|
||||
gitea admin auth add-oauth \
|
||||
{{- include "gitea.oauth_settings" . | nindent 6 }} \
|
||||
|| \
|
||||
( \
|
||||
export GITEA_AUTH_ID=$(gitea admin auth list | grep {{ .Values.gitea.oauth.name | quote }} | awk -F " " "{print \$1}"); \
|
||||
gitea admin auth update-oauth --id ${GITEA_AUTH_ID} \
|
||||
{{- include "gitea.oauth_settings" . | nindent 6 }} \
|
||||
) \
|
||||
{{- end }}
|
||||
{{- if not .Values.image.rootless }}
|
||||
'
|
||||
function configure_oauth() {
|
||||
local OAUTH_NAME={{ (printf "%s" .Values.gitea.oauth.name) | squote }}
|
||||
local AUTH_ID=$(gitea admin auth list --vertical-bars | grep -E "\|${OAUTH_NAME}\s+\|" | grep -iE '\|OAuth2\s+\|' | awk -F " " "{print \$1}")
|
||||
|
||||
if [[ -z "${AUTH_ID}" ]]; then
|
||||
echo "No oauth configuration found with name '${OAUTH_NAME}'. Installing it now..."
|
||||
gitea admin auth add-oauth {{- include "gitea.oauth_settings" . | indent 1 }}
|
||||
echo '...installed.'
|
||||
else
|
||||
echo "Existing oauth configuration with name '${OAUTH_NAME}': '${AUTH_ID}'. Running update to sync settings..."
|
||||
gitea admin auth update-oauth --id "${AUTH_ID}" {{- include "gitea.oauth_settings" . | indent 1 }}
|
||||
echo '...sync settings done.'
|
||||
fi
|
||||
}
|
||||
|
||||
configure_oauth
|
||||
{{- end }}
|
||||
|
||||
echo '==== END GITEA CONFIGURATION ===='
|
||||
|
||||
Reference in New Issue
Block a user