123 lines
4.8 KiB
Markdown
123 lines
4.8 KiB
Markdown
# Forgejo (git service) of the S2I2S project
|
|
|
|
One VM, `m1.xlarge` (RAM 16 - VCPUs 8), Ubuntu 24.04, 20 GB of root disk, with
|
|
**two interfaces**:
|
|
|
|
| Interface | Address | Use |
|
|
|---|---|---|
|
|
| main private network | `10.10.0.165` | traffic from the L7 HAPROXY load balancers, administration, monitoring |
|
|
| `postgresql-srv-net` | from the DHCP pool | the only way to the database |
|
|
|
|
and **one 200 GB SSD volume** (`CephSSD`, `enable_online_resize`) on `/dev/vdb`,
|
|
for the repositories and the attachments.
|
|
|
|
The resources live in [`../../modules/forgejo`](../../modules/forgejo), which
|
|
also carries the sizing and the service ports as defaults, so another project can
|
|
instantiate it with a handful of lines. (The first version of this workspace
|
|
declared the resources inline, like `s2i2s/mailbackup-relay` does: they were
|
|
moved into a module when the sizing of the services was moved out of
|
|
`../variables`.)
|
|
|
|
Only what belongs to this project is set in `main.tf`: the address on the main
|
|
private network, which comes from the address plan in
|
|
[`../variables`](../variables) (`basic_services_ip.forgejo`), and the IDs read
|
|
from the other workspaces.
|
|
|
|
Security groups on the ports:
|
|
|
|
* `default_for_all` and `traffic_to_forgejo_from_the_main_load_balancers` on the
|
|
main network port. The second one opens
|
|
`forgejo_server_data.service_ports` (**3000**, see below) from each L7 load
|
|
balancer: change that list if the service listens elsewhere.
|
|
* `vm_access_to_the_postgresql_service`, taken from the `postgresql` workspace,
|
|
on the port in the dedicated network of the database.
|
|
|
|
## Names
|
|
|
|
| Name | Type | Managed here |
|
|
|---|---|---|
|
|
| `forgejo.s2i2s.cloud.isti.cnr.it` | A → `10.10.0.165` | yes, internal name used by the playbooks and by the load balancer |
|
|
| `git.s2i2s.cloud.isti.cnr.it` | CNAME → `main-lb.s2i2s.cloud.isti.cnr.it.` | yes |
|
|
| `gitea-s2i2s.isti.cnr.it` | the name of the service being migrated | no: it lives in the `isti.cnr.it` zone and is moved by hand at the migration |
|
|
|
|
Both public names are served by the L7 load balancers: the `forgejo` entry of
|
|
`haproxy_l7_services` in
|
|
`group_vars/main_haproxy_l7/main_haproxy_l7.yml` of `infrastructure-playbooks`
|
|
sends them to `10.10.0.165:3000`.
|
|
|
|
## TLS: no nginx here
|
|
|
|
Only the L7 load balancers talk to this VM, so forgejo terminates the TLS
|
|
connection itself with the certificate that `os-bootstrap` requests from the
|
|
[internal CA](../../../infrastructure-playbooks/docs/internal_ca.md) of the
|
|
project — there is no nginx in front of it, and the unix socket setup of the
|
|
on-premise host (`group_vars/git_server`) does not apply here.
|
|
|
|
In `app.ini`:
|
|
|
|
```ini
|
|
[server]
|
|
PROTOCOL = https
|
|
HTTP_PORT = 3000
|
|
CERT_FILE = /etc/pki/certs/forgejo.s2i2s.cloud.isti.cnr.it.pem
|
|
KEY_FILE = /etc/pki/keys/forgejo.s2i2s.cloud.isti.cnr.it-key.pem
|
|
```
|
|
|
|
Port 3000 keeps forgejo away from the privileged ports, so
|
|
`forgejo_bind_privileged_ports` stays false.
|
|
|
|
**Mind the permissions of the key.** `os-bootstrap` installs it as
|
|
`root:root 0440`, and forgejo runs as `git`: as it is, the service cannot read
|
|
it. Either give the key a group that `git` belongs to, or set an ACL on
|
|
`/etc/pki/keys` — the `user_services_perms` role of the playbooks already does
|
|
this kind of thing for other services.
|
|
|
|
The load balancer verifies the certificate against the internal CA **and** its
|
|
name (`verify_host` in the service definition), which the certificate satisfies
|
|
because `os-bootstrap` puts the FQDN and every address of the VM among the SANs.
|
|
|
|
## Git over SSH
|
|
|
|
No floating IP on this VM: the traffic goes through the load balancers.
|
|
|
|
```
|
|
client :22 -> Octavia TCP listener -> HAPROXY L7 :2222 -> forgejo :2222
|
|
```
|
|
|
|
The public port stays 22, so the clone URLs need no port. The port 22 of this VM
|
|
belongs to sshd (that is how ansible gets in), so forgejo has to use its
|
|
**builtin SSH server on 2222** (`forgejo_server_data.ssh_port`): in `app.ini`,
|
|
`START_SSH_SERVER = true` and `SSH_LISTEN_PORT = 2222`, with `SSH_PORT = 22`
|
|
advertised in the clone URLs. The `app.ini` file is not managed by the forgejo
|
|
role.
|
|
|
|
The listener, its pool and its health monitor are in
|
|
`../project-setup/octavia.tf`; the ingress rule on the load balancers is in
|
|
`../project-setup/haproxy.tf`; the rule that lets the load balancers reach 2222
|
|
here is in this workspace.
|
|
|
|
## Order of the applies
|
|
|
|
```
|
|
main_net_dns_router -> project-setup -> postgresql -> forgejo
|
|
```
|
|
|
|
This workspace reads the state of all three.
|
|
|
|
```bash
|
|
tofu init
|
|
tofu plan -out=forgejo.plan
|
|
tofu apply forgejo.plan
|
|
```
|
|
|
|
After the apply, regenerate the ansible inventory in
|
|
`infrastructure-playbooks`, which reads this state:
|
|
|
|
```bash
|
|
ansible-playbook tofu-inventory.yml --diff
|
|
```
|
|
|
|
The playbook that configures the service is `git-server.yml` (role `forgejo`),
|
|
which currently targets the `git_server` group: the generated inventory puts
|
|
this VM in `forgejo_cloud`, under `openstack_s2i2s`.
|