Dear all, Please find the update for the latest gitea attached. Changelog: https://github.com/go-gitea/gitea/releases/tag/v1.7.1
I propose several changes to the port: 1. Change the location of configuration file: /etc/gitea/conf/app.ini -> /etc/gitea/app.ini There's no reason to add one more folder in path, the proposed location is the distribution's default (see https://github.com/go-gitea/gitea/tree/master/contrib/init) thus is more in-sync with other systems/documentation etc. Currently Gitea gets it's config location through the env variable passed on startup: GITEA_CUSTOM=${SYSCONFDIR}/gitea If the config isn't provided with "-c" switch, Gitea looks into GITEA_CUSTOM/conf directory. The problem is that GITEA_CUSTOM is also used for various custom public files like templates, images, avatars, robots.txt etc. This means that custom content should go to /etc/gitea/, e.g. /etc/gitea/robots.txt and so on. I think /etc/ is not good for these. Let custom content go to /var/gitea/custom. 2. Change _gitea user's home folder and shell: _gitea:787:_gitea:daemon:Gitea Account:/nonexistent:/sbin/nologin -> _gitea:787:_gitea:daemon:Gitea Account:/var/gitea:/bin/sh Current _gitea user's settings prevent Gitea from working with system sshd out of the box. If somebody finds it somehow impacts security, please let me know. 3. Logs should go to /var/log/gitea. Logs scattered throughout /var aren't good. 4. Remove bash from RUN_DEPENDS. I didn't find any necessity for bash. Gitea works fine with /bin/sh 5. Set chmod o= for /etc/gitea. Gitea's config contains some secret keys which are of no interest to Random J User. 6. Tighten initial config's defaults regarding unneeded information exposure. Usually Gitea is chosen as more controllable and private alternative or addendum to public services. I consider this cosmetic change can save some clicks for the target Gitea's audience. 7. Reflect information in the pkg README along with some other tips. -- With best regards, Pavel Korovin
Index: Makefile =================================================================== RCS file: /cvs/ports/www/gitea/Makefile,v retrieving revision 1.15 diff -u -p -r1.15 Makefile --- Makefile 28 Jan 2019 11:46:26 -0000 1.15 +++ Makefile 4 Feb 2019 22:01:24 -0000 @@ -2,7 +2,7 @@ COMMENT = compact self-hosted Git service -VERSION = 1.7.0 +VERSION = 1.7.1 GH_ACCOUNT = go-gitea GH_PROJECT = gitea GH_TAGNAME = v${VERSION} @@ -23,8 +23,7 @@ MODULES = lang/go MODGO_ENV = PATH="${PORTPATH}" CFLAGS="${CFLAGS}" MODGO_FLAGS += -tags "sqlite cert" -RUN_DEPENDS = devel/git \ - shells/bash +RUN_DEPENDS = devel/git ALL_TARGET = code.gitea.io/${GH_PROJECT} WRKSRC = ${MODGO_WORKSPACE}/src/${ALL_TARGET} Index: distinfo =================================================================== RCS file: /cvs/ports/www/gitea/distinfo,v retrieving revision 1.8 diff -u -p -r1.8 distinfo --- distinfo 28 Jan 2019 11:46:26 -0000 1.8 +++ distinfo 4 Feb 2019 22:01:24 -0000 @@ -1,2 +1,2 @@ -SHA256 (gitea-1.7.0.tar.gz) = L91NUbIvQMA+alXAZdr7z60WyhSt9PCTzu2J5ZSA9nk= -SIZE (gitea-1.7.0.tar.gz) = 20829587 +SHA256 (gitea-1.7.1.tar.gz) = eii6w2zwbhqQwt9pIlannSnMbmUqqJ9Md4M7moSBpUE= +SIZE (gitea-1.7.1.tar.gz) = 20834721 Index: patches/patch-custom_conf_app_ini_sample =================================================================== RCS file: /cvs/ports/www/gitea/patches/patch-custom_conf_app_ini_sample,v retrieving revision 1.3 diff -u -p -r1.3 patch-custom_conf_app_ini_sample --- patches/patch-custom_conf_app_ini_sample 28 Jan 2019 11:46:26 -0000 1.3 +++ patches/patch-custom_conf_app_ini_sample 4 Feb 2019 22:01:24 -0000 @@ -3,7 +3,7 @@ $OpenBSD: patch-custom_conf_app_ini_samp Index: custom/conf/app.ini.sample --- custom/conf/app.ini.sample.orig +++ custom/conf/app.ini.sample -@@ -7,12 +7,12 @@ +@@ -7,19 +7,19 @@ ; App name that shows in every page title APP_NAME = Gitea: Git with a cup of tea ; Change it if you run locally @@ -15,10 +15,19 @@ Index: custom/conf/app.ini.sample [repository] -ROOT = +-SCRIPT_TYPE = bash +ROOT = ${LOCALSTATEDIR}/gitea/gitea-repositories - SCRIPT_TYPE = bash ++SCRIPT_TYPE = sh ; Default ANSI charset ANSI_CHARSET = + ; Force every new repository to be private + FORCE_PRIVATE = false + ; Default privacy setting when creating a new repository, allowed values: last, private, public. Default is last which means the last setting used. +-DEFAULT_PRIVATE = last ++DEFAULT_PRIVATE = private + ; Global limit of repositories per user, applied at creation time. -1 means no limit + MAX_CREATION_LIMIT = -1 + ; Mirror sync queue length, increase if mirror syncing starts hanging @@ -52,7 +52,7 @@ LOCAL_WIKI_PATH = tmp/local-wiki ; Whether repository file uploads are enabled. Defaults to `true` ENABLED = true @@ -28,15 +37,33 @@ Index: custom/conf/app.ini.sample ; One or more allowed types, e.g. image/jpeg|image/png. Nothing means any file type ALLOWED_TYPES = ; Max size of each file in megabytes. Defaults to 3MB +@@ -82,7 +82,7 @@ THEME_COLOR_META_TAG = `#6cc644` + ; Max size of files to be displayed (default is 8MiB) + MAX_DISPLAY_FILE_SIZE = 8388608 + ; Whether the email of the user should be shown in the Explore Users page +-SHOW_USER_EMAIL = true ++SHOW_USER_EMAIL = false + ; Set the default theme for the Gitea install + DEFAULT_THEME = gitea + @@ -147,7 +147,7 @@ SSH_DOMAIN = %(DOMAIN)s ; The network interface the builtin SSH server should listen on SSH_LISTEN_HOST = ; Port number to be exposed in clone URL -SSH_PORT = 22 -+SSH_PORT = 2222 ++SSH_PORT = ; The port number the builtin SSH server should listen on SSH_LISTEN_PORT = %(SSH_PORT)s ; Root path of SSH directory, default is '~/.ssh', but you have to use '/home/git/.ssh'. +@@ -176,7 +176,7 @@ SSH_EXPOSE_ANONYMOUS = false + ; Indicate whether to check minimum key size with corresponding type + MINIMUM_KEY_SIZE_CHECK = false + ; Disable CDN even in "prod" mode +-OFFLINE_MODE = false ++OFFLINE_MODE = true + DISABLE_ROUTER_LOG = false + ; Generate steps: + ; $ ./gitea cert -ca=true -duration=8760h0m0s -host=myhost.example.com @@ -185,13 +185,13 @@ DISABLE_ROUTER_LOG = false ; not forget to export the private key): ; $ openssl pkcs12 -in cert.pfx -out cert.pem -nokeys @@ -72,7 +99,7 @@ Index: custom/conf/app.ini.sample HOST = 127.0.0.1:3306 NAME = gitea USER = root -@@ -230,7 +230,7 @@ PASSWD = +@@ -230,16 +230,16 @@ PASSWD = ; For MySQL, either "false" (default), "true", or "skip-verify" SSL_MODE = disable ; For "sqlite3" and "tidb", use an absolute path when you start gitea as service @@ -81,8 +108,10 @@ Index: custom/conf/app.ini.sample ; For "sqlite3" only. Query timeout SQLITE_TIMEOUT = 500 ; For iterate buffer, default is 50 -@@ -239,7 +239,7 @@ ITERATE_BUFFER_SIZE = 50 - LOG_SQL = true + ITERATE_BUFFER_SIZE = 50 + ; Show the database generated SQL +-LOG_SQL = true ++LOG_SQL = false [indexer] -ISSUE_INDEXER_PATH = indexers/issues.bleve @@ -90,7 +119,70 @@ Index: custom/conf/app.ini.sample ; repo indexer by default disabled, since it uses a lot of disk space REPO_INDEXER_ENABLED = false REPO_INDEXER_PATH = indexers/repos.bleve -@@ -386,8 +386,8 @@ HELO_HOSTNAME = +@@ -248,7 +248,7 @@ MAX_FILE_SIZE = 1048576 + + [admin] + ; Disallow regular (non-admin) users from creating organizations. +-DISABLE_REGULAR_ORG_CREATION = false ++DISABLE_REGULAR_ORG_CREATION = true + + [security] + ; Whether the installer is disabled +@@ -288,7 +288,7 @@ DISABLE_GIT_HOOKS = false + ; - <username>.livejournal.com + ; + ; Whether to allow signin in via OpenID +-ENABLE_OPENID_SIGNIN = true ++ENABLE_OPENID_SIGNIN = false + ; Whether to allow registering via OpenID + ; Do not include to rely on rhw DISABLE_REGISTRATION setting + ;ENABLE_OPENID_SIGNUP = true +@@ -314,11 +314,11 @@ REGISTER_EMAIL_CONFIRM = false + ; gitea.io,example.com + EMAIL_DOMAIN_WHITELIST= + ; Disallow registration, only allow admins to create accounts. +-DISABLE_REGISTRATION = false ++DISABLE_REGISTRATION = true + ; Allow registration only using third-party services, it works only when DISABLE_REGISTRATION is false + ALLOW_ONLY_EXTERNAL_REGISTRATION = false + ; User must sign in to view anything. +-REQUIRE_SIGNIN_VIEW = false ++REQUIRE_SIGNIN_VIEW = true + ; Mail notification + ENABLE_NOTIFY_MAIL = false + ; More detail: https://github.com/gogits/gogs/issues/165 +@@ -335,10 +335,10 @@ RECAPTCHA_SECRET = + RECAPTCHA_SITEKEY = + ; Default value for KeepEmailPrivate + ; Each new user will get the value of this setting copied into their profile +-DEFAULT_KEEP_EMAIL_PRIVATE = false ++DEFAULT_KEEP_EMAIL_PRIVATE = true + ; Default value for AllowCreateOrganization + ; Every new user will have rights set to create organizations depending on this setting +-DEFAULT_ALLOW_CREATE_ORGANIZATION = true ++DEFAULT_ALLOW_CREATE_ORGANIZATION = false + ; Default value for EnableDependencies + ; Repositories will use dependencies by default depending on this setting + DEFAULT_ENABLE_DEPENDENCIES = true +@@ -355,7 +355,7 @@ DEFAULT_ALLOW_ONLY_CONTRIBUTORS_TO_TRACK_TIME = true + ; Default value for the domain part of the user's email address in the git log + ; if he has set KeepEmailPrivate to true. The user's email will be replaced with a + ; concatenation of the user name in lower case, "@" and NO_REPLY_ADDRESS. +-NO_REPLY_ADDRESS = noreply.example.org ++NO_REPLY_ADDRESS = noreply.example.com + + [webhook] + ; Hook task queue length, increase if webhook shooting starts hanging +@@ -377,7 +377,7 @@ SUBJECT = %(APP_NAME)s + ; Gmail: smtp.gmail.com:587 + ; QQ: smtp.qq.com:465 + ; Note, if the port ends with "465", SMTPS will be used. Using STARTTLS on port 587 is recommended per RFC 6409. If the server supports STARTTLS it will always be used. +-HOST = ++HOST = localhost:25 + ; Disable HELO operation when hostnames are different. + DISABLE_HELO = + ; Custom hostname for HELO operation, if no value is provided, one is retrieved from system. +@@ -386,18 +386,18 @@ HELO_HOSTNAME = SKIP_VERIFY = ; Use client certificate USE_CERTIFICATE = false @@ -101,6 +193,18 @@ Index: custom/conf/app.ini.sample ; Should SMTP connection use TLS IS_TLS_ENABLED = false ; Mail from address, RFC 5322. This can be just an email address, or the `"Name" <em...@example.com>` format +-FROM = ++FROM = gi...@example.com + ; Mailer user name and password + USER = + ; Use PASSWD = `your password` for quoting if you use special characters in the password. + PASSWD = + ; Send mails as plain text +-SEND_AS_PLAIN_TEXT = false ++SEND_AS_PLAIN_TEXT = true + ; Enable sendmail (override SMTP) + USE_SENDMAIL = false + ; Specify an alternative sendmail binary @@ -420,13 +420,13 @@ ITEM_TTL = 16h [session] @@ -126,6 +230,15 @@ Index: custom/conf/app.ini.sample ; Max Width and Height of uploaded avatars. This is to limit the amount of RAM ; used when resizing the image. AVATAR_MAX_WIDTH = 4096 +@@ -448,7 +448,7 @@ AVATAR_MAX_HEIGHT = 3072 + ; or a custom avatar source, like: http://cn.gravatar.com/avatar/ + GRAVATAR_SOURCE = gravatar + ; This value will always be true in offline mode. +-DISABLE_GRAVATAR = false ++DISABLE_GRAVATAR = true + ; Federated avatar lookup uses DNS to discover avatar associated + ; with emails, see https://www.libravatar.org + ; This value will always be false in offline mode or when Gravatar is disabled. @@ -458,7 +458,7 @@ ENABLE_FEDERATED_AVATAR = false ; Whether attachments are enabled. Defaults to `true` ENABLED = true @@ -135,12 +248,16 @@ Index: custom/conf/app.ini.sample ; One or more allowed types, e.g. image/jpeg|image/png ALLOWED_TYPES = image/jpeg|image/png|application/zip|application/gzip ; Max size of each file. Defaults to 4MB -@@ -473,14 +473,14 @@ MAX_FILES = 5 - FORMAT = +@@ -470,17 +470,17 @@ MAX_FILES = 5 + ; Specifies the format for fully outputted dates. Defaults to RFC1123 + ; Special supported values are ANSIC, UnixDate, RubyDate, RFC822, RFC822Z, RFC850, RFC1123, RFC1123Z, RFC3339, RFC3339Nano, Kitchen, Stamp, StampMilli, StampMicro and StampNano + ; For more information about the format see http://golang.org/pkg/time/#pkg-constants +-FORMAT = ++FORMAT = RFC1123Z [log] -ROOT_PATH = -+ROOT_PATH = ${LOCALSTATEDIR}/gitea/log ++ROOT_PATH = ${LOCALSTATEDIR}/log/gitea ; Either "console", "file", "conn", "smtp" or "database", default is "console" ; Use comma to separate multiple modes, e.g. "console, file" -MODE = console @@ -153,13 +270,34 @@ Index: custom/conf/app.ini.sample ; For "console" mode only [log.console] -@@ -643,6 +643,9 @@ ko-KR = ko - [U2F] +@@ -640,12 +640,15 @@ sr-SP = sr + sv-SE = sv + ko-KR = ko + +-[U2F] ++;[U2F] ; Two Factor authentication with security keys ; https://developers.yubico.com/U2F/App_ID.html -+PROTOCOL = http -+DOMAIN = localhost -+HTTP_PORT = 3000 - APP_ID = %(PROTOCOL)s://%(DOMAIN)s:%(HTTP_PORT)s/ +-APP_ID = %(PROTOCOL)s://%(DOMAIN)s:%(HTTP_PORT)s/ ++;PROTOCOL = http ++;DOMAIN = localhost ++;HTTP_PORT = 3000 ++;APP_ID = %(PROTOCOL)s://%(DOMAIN)s:%(HTTP_PORT)s/ ; Comma seperated list of truisted facets - TRUSTED_FACETS = %(PROTOCOL)s://%(DOMAIN)s:%(HTTP_PORT)s/ +-TRUSTED_FACETS = %(PROTOCOL)s://%(DOMAIN)s:%(HTTP_PORT)s/ ++;TRUSTED_FACETS = %(PROTOCOL)s://%(DOMAIN)s:%(HTTP_PORT)s/ + + ; Extension mapping to highlight class + ; e.g. .toml=ini +@@ -654,9 +657,9 @@ TRUSTED_FACETS = %(PROTOCOL)s://%(DOMAIN)s:%(HTTP_PORT + [other] + SHOW_FOOTER_BRANDING = false + ; Show version information about Gitea and Go in the footer +-SHOW_FOOTER_VERSION = true ++SHOW_FOOTER_VERSION = false + ; Show template execution time in the footer +-SHOW_FOOTER_TEMPLATE_LOAD_TIME = true ++SHOW_FOOTER_TEMPLATE_LOAD_TIME = false + + [markup.asciidoc] + ENABLED = false Index: patches/patch-main_go =================================================================== RCS file: /cvs/ports/www/gitea/patches/patch-main_go,v retrieving revision 1.4 diff -u -p -r1.4 patch-main_go --- patches/patch-main_go 28 Jan 2019 11:46:26 -0000 1.4 +++ patches/patch-main_go 4 Feb 2019 22:01:24 -0000 @@ -5,7 +5,7 @@ Gets shown in the footer. Index: main.go --- main.go.orig +++ main.go -@@ -23,7 +23,7 @@ import ( +@@ -24,7 +24,7 @@ import ( ) // Version holds the current Gitea version Index: pkg/MESSAGE =================================================================== RCS file: pkg/MESSAGE diff -N pkg/MESSAGE --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ pkg/MESSAGE 4 Feb 2019 22:01:24 -0000 @@ -0,0 +1,10 @@ +If you are upgrading from ${PKGSTEM}-<1.7.1, please note the following changes: + +* Configuration file location has changed from ${SYSCONFDIR}/${PKGSTEM}/conf/app.ini + to ${SYSCONFDIR}/${PKGSTEM}/app.ini + +* GITEA_CUSTOM directory location has changed from ${SYSCONFDIR}/${PKGSTEM} + to ${LOCALSTATEDIR}/${PKGSTEM}/custom + +* Default ROOT_PATH for logs has changed from ${LOCALSTATEDIR}/${PKGSTEM}/log + to ${LOCALSTATEDIR}/log/${PKGSTEM} Index: pkg/PLIST =================================================================== RCS file: /cvs/ports/www/gitea/pkg/PLIST,v retrieving revision 1.9 diff -u -p -r1.9 PLIST --- pkg/PLIST 28 Jan 2019 11:46:26 -0000 1.9 +++ pkg/PLIST 4 Feb 2019 22:01:25 -0000 @@ -1,20 +1,24 @@ @comment $OpenBSD: PLIST,v 1.9 2019/01/28 11:46:26 pvk Exp $ @newgroup _gitea:787 -@newuser _gitea:787:_gitea:daemon:Gitea Account:/nonexistent:/sbin/nologin +@newuser _gitea:787:_gitea:daemon:Gitea Account:/var/gitea:/bin/sh @rcscript ${RCDIR}/gitea @bin sbin/gitea share/doc/pkg-readmes/${PKGSTEM} share/gitea/ share/gitea/conf/ +@mode 750 @owner _gitea @group _gitea -@sample ${SYSCONFDIR}/gitea/conf/ +@sample ${SYSCONFDIR}/gitea/ +@mode @owner @group share/gitea/conf/app.ini.sample +@mode 640 @owner _gitea @group _gitea -@sample ${SYSCONFDIR}/gitea/conf/app.ini +@sample ${SYSCONFDIR}/gitea/app.ini +@mode @owner @group share/gitea/options/ @@ -2451,4 +2455,6 @@ share/gitea/templates/user/settings/twof @mode 750 @owner _gitea @group _gitea -@sample /var/gitea/ +@sample ${LOCALSTATEDIR}/gitea/ +@sample ${LOCALSTATEDIR}/gitea/custom/ +@sample ${LOCALSTATEDIR}/log/gitea/ Index: pkg/README =================================================================== RCS file: /cvs/ports/www/gitea/pkg/README,v retrieving revision 1.2 diff -u -p -r1.2 README --- pkg/README 4 Sep 2018 12:46:24 -0000 1.2 +++ pkg/README 4 Feb 2019 22:01:25 -0000 @@ -4,15 +4,48 @@ $OpenBSD: README,v 1.2 2018/09/04 12:46: | Running ${PKGSTEM} on OpenBSD +----------------------------------------------------------------------- -Gitea can be setup to serve HTTP requests on its own, or can run behind -HTTP proxy like relayd(8) or nginx(8). Another option is to let OpenBSD -httpd(8) serve HTTP requests and pass it to Gitea via FastCGI protocol. +Initial configuration +===================== +By default ${PKGSTEM} listens on all configured IP addresses, TCP port 3000. +If this is not wanted behavior, either adjust your pf(4) rules or change +HTTP_ADDR/HTTP_PORT in ${SYSCONFDIR}/gitea/app.ini. -Example configuration for httpd(8) and Gitea communicating via FastCGI -====================================================================== +To complete inital configuration, point your browser to +http://gitea.example.com:3000 and press "Sign In". Usually you'll need to +configure SSH Server Domain/Port, Gitea HTTP Listen Port/Base URL, E-Mail +Settings and Administrator Account Settings. + +On OpenBSD, initial ${PKGSTEM} configuration has the following restrictions: + + - Self-Registration is disabled + - Sign-In is required to view the content + - E-Mail addresses are not shown + - Server runs in "offline" mode, which means that external services such as + Gravatar/OpenID are not used + - New repositories have "private" checkbox checked by default + +Adjust these configuration settings according to your requirements. + +Running ${PKGSTEM} with PostsgreSQL +============================== +If you want to use ${PKGSTEM} with PostgreSQL as backend database, please note +that pq library used by ${PKGSTEM} does not support SCRAM authentication yet. +If your PostgreSQL server uses SCRAM authentication by default, consider making +an exception for _gitea user by forcing it to use either MD5 or peer +authentication. Adjust pg_hba.conf accordingly. + +Configuring HTTP access +======================= +By default ${PKGSTEM} serves HTTP requests on its own. +It can also be configured to run behind HTTP proxy like relayd(8) or nginx(8). + +Another option is to let OpenBSD httpd(8) serve HTTP(S) requests and pass it +to ${PKGSTEM} via FastCGI protocol: + +Example configuration for httpd(8) and ${PKGSTEM} communicating via FastCGI +---------------------------------------------------------------------- Relevant configuration directives in ${SYSCONFDIR}/httpd.conf: ------------------------------------------------------ # An HTTPS server using SSL/TLS server "gitea.example.com" { @@ -20,11 +53,10 @@ Relevant configuration directives in ${S tls certificate "/etc/ssl/gitea.example.com.pem" tls key "/etc/ssl/private/gitea.example.com.key" connection { max requests 500, timeout 3600 } - location "/*" { fastcgi socket ":10787" } + location "*" { fastcgi socket ":10787" } } -Relevant configuration directives in ${SYSCONFDIR}/gitea/conf/app.ini: -------------------------------------------------------------- +Relevant configuration directives in ${SYSCONFDIR}/gitea/app.ini: [server] PROTOCOL = fcgi @@ -33,3 +65,8 @@ Relevant configuration directives in ${S HTTP_ADDR = 127.0.0.1 HTTP_PORT = 10787 LOCAL_ROOT_URL = https://gitea.example.com/ + +Customizing ${PKGSTEM} +================= +For custom public files, templates, gitignores, labels, licenses and READMEs, +please use ${LOCALSTATEDIR}/gitea/custom directory. Index: pkg/gitea.rc =================================================================== RCS file: /cvs/ports/www/gitea/pkg/gitea.rc,v retrieving revision 1.4 diff -u -p -r1.4 gitea.rc --- pkg/gitea.rc 11 Jan 2018 19:27:11 -0000 1.4 +++ pkg/gitea.rc 4 Feb 2019 22:01:25 -0000 @@ -4,7 +4,7 @@ daemon="${TRUEPREFIX}/sbin/gitea" daemon_user="_gitea" -daemon_flags="web" +daemon_flags="web -c ${SYSCONFDIR}/gitea/app.ini" . /etc/rc.d/rc.subr @@ -14,7 +14,7 @@ rc_reload=NO rc_start() { ${rcexec} "env HOME=${LOCALSTATEDIR}/gitea USER=${daemon_user} \ GITEA_WORK_DIR=${TRUEPREFIX}/share/gitea \ - GITEA_CUSTOM=${SYSCONFDIR}/gitea \ + GITEA_CUSTOM=${LOCALSTATEDIR}/gitea/custom \ ${daemon} ${daemon_flags}" }