infra(forgejo): add Forgejo service config and documentation for git.bollwerk.online
This commit is contained in:
Jens Reinemann
parent
557a4bcaf8
commit
96375cb9ea
1 changed files with 67 additions and 2 deletions
|
|
@ -36,6 +36,7 @@
|
|||
| Docker CE | 29.5.0 | apt (Docker repo) | `docker.service` |
|
||||
| Docker Compose | v5.1.3 | docker-compose-plugin (apt) | – |
|
||||
| Caddy | v2.11.3 | apt (caddy repo) | `caddy.service` |
|
||||
| Forgejo | latest | Docker (codeberg.org/forgejo/forgejo) | – (Docker) |
|
||||
| OpenSSH Server | Debian-Standard | apt | `ssh.service` |
|
||||
| cron | Debian-Standard | apt | `cron.service` |
|
||||
| rsyslog | Debian-Standard | apt | `rsyslog.service` |
|
||||
|
|
@ -72,9 +73,10 @@ apt-get install -y caddy
|
|||
/opt/
|
||||
├── bollwerk/ # Bollwerk App-Stack
|
||||
│ ├── Dockerfile # Bollwerk-Server Image
|
||||
│ ├── docker-compose.yml # App + DB + Backup
|
||||
│ ├── docker-compose.yml # App + DB + Backup + Forgejo
|
||||
│ ├── server.jar # Aktuelles Server-JAR
|
||||
│ ├── data/ # App-Datendateien (persistent)
|
||||
│ ├── forgejo/ # Forgejo-Daten (persistent)
|
||||
│ └── backup/
|
||||
│ ├── Dockerfile # Backup-Container Image
|
||||
│ └── backup.sh # Backup-Script (pg_dump + Rotation)
|
||||
|
|
@ -130,6 +132,26 @@ services:
|
|||
depends_on:
|
||||
- db
|
||||
|
||||
forgejo:
|
||||
image: codeberg.org/forgejo/forgejo:latest
|
||||
container_name: bollwerk-forgejo
|
||||
restart: unless-stopped
|
||||
ports:
|
||||
- "127.0.0.1:3000:3000"
|
||||
- "2222:22"
|
||||
environment:
|
||||
- USER_UID=1000
|
||||
- USER_GID=1000
|
||||
- FORGEJO__server__DOMAIN=git.bollwerk.online
|
||||
- FORGEJO__server__ROOT_URL=https://git.bollwerk.online/
|
||||
- FORGEJO__server__SSH_PORT=2222
|
||||
- FORGEJO__server__SSH_LISTEN_PORT=22
|
||||
- FORGEJO__service__DISABLE_REGISTRATION=true
|
||||
volumes:
|
||||
- ./forgejo:/data
|
||||
- /etc/timezone:/etc/timezone:ro
|
||||
- /etc/localtime:/etc/localtime:ro
|
||||
|
||||
backup:
|
||||
build: ./backup
|
||||
container_name: bollwerk-backup
|
||||
|
|
@ -169,6 +191,39 @@ ENTRYPOINT ["java", "-Xmx768m", "-jar", "server.jar"]
|
|||
- **Rotation:** Älteste `.sql.gz`-Dateien werden gelöscht, sobald `/backups/` 1 GB überschreitet
|
||||
- **Speicherort:** Docker-Volume `backup_data`, eingebunden in `/backups/`
|
||||
|
||||
### Forgejo (Git-Server)
|
||||
|
||||
- **Image:** `codeberg.org/forgejo/forgejo:latest`
|
||||
- **Domain:** `git.bollwerk.online`
|
||||
- **Web-UI:** Port 3000 (nur lokal, Caddy reverse-proxied auf HTTPS)
|
||||
- **SSH-Git:** Port 2222 (extern erreichbar)
|
||||
- **Daten:** `/opt/bollwerk/forgejo/` (bind-mount)
|
||||
- **Datenbank:** SQLite (in `/data/forgejo/forgejo.db` innerhalb des Containers)
|
||||
- **Registrierung:** Deaktiviert (`DISABLE_REGISTRATION=true`)
|
||||
|
||||
#### Ersteinrichtung nach Start
|
||||
|
||||
1. `https://git.bollwerk.online/` aufrufen – Forgejo zeigt den Setup-Wizard
|
||||
2. Einstellungen im Wizard:
|
||||
- **Site Title:** Bollwerk Git
|
||||
- **Admin-User:** Benutzername und Passwort setzen
|
||||
- **E-Mail:** SMTP über `mail.bollwerk.online:587` (optional, kann später)
|
||||
3. Nach Ersteinrichtung: Repo anlegen, Test-Push via HTTPS und SSH
|
||||
|
||||
#### Git-Clone-URLs
|
||||
|
||||
```bash
|
||||
# HTTPS
|
||||
git clone https://git.bollwerk.online/<user>/<repo>.git
|
||||
|
||||
# SSH (Port 2222)
|
||||
git clone ssh://git@git.bollwerk.online:2222/<user>/<repo>.git
|
||||
# oder in ~/.ssh/config:
|
||||
# Host git.bollwerk.online
|
||||
# Port 2222
|
||||
# User git
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Mail-Stack: `/opt/mail/`
|
||||
|
|
@ -227,6 +282,13 @@ bollwerk.online {
|
|||
}
|
||||
}
|
||||
|
||||
git.bollwerk.online {
|
||||
reverse_proxy localhost:3000 {
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
header_up X-Forwarded-Host {host}
|
||||
}
|
||||
}
|
||||
|
||||
mail.bollwerk.online {
|
||||
reverse_proxy localhost:8888 {
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
|
|
@ -235,8 +297,9 @@ mail.bollwerk.online {
|
|||
}
|
||||
```
|
||||
|
||||
- Caddy übernimmt automatisch TLS via Let's Encrypt für `bollwerk.online` und `mail.bollwerk.online`
|
||||
- Caddy übernimmt automatisch TLS via Let's Encrypt für `bollwerk.online`, `git.bollwerk.online` und `mail.bollwerk.online`
|
||||
- Der Bollwerk-Server ist nur lokal auf Port 8080 gebunden (nicht direkt von außen erreichbar)
|
||||
- Forgejo ist nur lokal auf Port 3000 gebunden (HTTPS via Caddy, SSH-Git direkt auf Port 2222)
|
||||
- Snappymail-Webmail ist nur lokal auf Port 8888 gebunden
|
||||
|
||||
---
|
||||
|
|
@ -248,12 +311,14 @@ mail.bollwerk.online {
|
|||
| 22 | TCP | SSH | Extern |
|
||||
| 80 | TCP | Caddy (HTTP→HTTPS) | Extern |
|
||||
| 443 | TCP | Caddy (HTTPS) | Extern |
|
||||
| 2222 | TCP | Forgejo SSH (Git) | Extern |
|
||||
| 25 | TCP | Maddy SMTP | Extern |
|
||||
| 143 | TCP | Maddy IMAP | Extern |
|
||||
| 465 | TCP | Maddy SMTPS | Extern |
|
||||
| 587 | TCP | Maddy Submission | Extern |
|
||||
| 993 | TCP | Maddy IMAPS | Extern |
|
||||
| 5432 | TCP | PostgreSQL | Nur lokal (127.0.0.1) |
|
||||
| 3000 | TCP | Forgejo (Web UI) | Nur lokal (127.0.0.1) |
|
||||
| 8080 | TCP | Bollwerk-Server | Nur lokal (127.0.0.1) |
|
||||
| 8888 | TCP | Snappymail | Nur lokal (127.0.0.1) |
|
||||
|
||||
|
|
|
|||
Loading…
Reference in a new issue