mirror of
https://github.com/hanzoai/forge.git
synced 2026-10-30 15:00:39 +00:00
zeekayandHanzo Dev
27cde39e36
Storage buckets, indexer names, the bleve analyzer, the lock prefix, SSH host keys, the markdown front-matter key, the container data paths, the RPM repo id and the API security scheme all read as this product now, and app.example.ini matches the code again. The upstream maintainer list and the changelog generator config went with the release history they belonged to, and the citation comments state the fact rather than link the issue. Three inert rules turn out to have been inert because they named a module path this tree does not use: gci grouped no first-party imports under prefix(), and depguard let models/migrations import models and modules/structs. They now name github.com/hanzoai/git. The config example also documented .gitea/workflows while the code has read .hanzo/workflows for some time. The authorized_keys marker follows the delegate-hook precedent: the new name is written and the old one is still recognised, because a marker we do not know is copied through as a hand-added key and leaves a revoked key authorized. The stored user_setting key keeps its value; only a migration may change that. Co-authored-by: Hanzo Dev <[email protected]>
76 lines
3.1 KiB
Bash
Executable File
76 lines
3.1 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
if [ ! -d /data/git/.ssh ]; then
|
|
mkdir -p /data/git/.ssh
|
|
fi
|
|
|
|
# Set the correct permissions on the .ssh directory and authorized_keys file,
|
|
# or sshd will refuse to use them and lead to clone/push/pull failures.
|
|
# It could happen when users have copied their data to a new volume and changed the file permission by accident,
|
|
# and it would be very hard to troubleshoot unless users know how to check the logs of sshd which is started by s6.
|
|
chmod 700 /data/git/.ssh
|
|
if [ -f /data/git/.ssh/authorized_keys ]; then
|
|
chmod 600 /data/git/.ssh/authorized_keys
|
|
fi
|
|
|
|
if [ ! -f /data/git/.ssh/environment ]; then
|
|
echo "GIT_CUSTOM=$GIT_CUSTOM" >| /data/git/.ssh/environment
|
|
chmod 600 /data/git/.ssh/environment
|
|
|
|
elif ! grep -q "^GIT_CUSTOM=$GIT_CUSTOM$" /data/git/.ssh/environment; then
|
|
sed -i /^GIT_CUSTOM=/d /data/git/.ssh/environment
|
|
echo "GIT_CUSTOM=$GIT_CUSTOM" >> /data/git/.ssh/environment
|
|
fi
|
|
|
|
if [ ! -f ${GIT_CUSTOM}/conf/app.ini ]; then
|
|
mkdir -p ${GIT_CUSTOM}/conf
|
|
|
|
# Set INSTALL_LOCK to true only if SECRET_KEY is not empty and
|
|
# INSTALL_LOCK is empty
|
|
if [ -n "$SECRET_KEY" ] && [ -z "$INSTALL_LOCK" ]; then
|
|
INSTALL_LOCK=true
|
|
fi
|
|
|
|
# Substitute the environment variables in the template
|
|
# APP_NAME is passed through empty on purpose: the default lives in one place,
|
|
# setting.AppName, so the container cannot brand the site title differently.
|
|
APP_NAME=${APP_NAME:-""} \
|
|
RUN_MODE=${RUN_MODE:-"prod"} \
|
|
DOMAIN=${DOMAIN:-"localhost"} \
|
|
SSH_DOMAIN=${SSH_DOMAIN:-"localhost"} \
|
|
HTTP_PORT=${HTTP_PORT:-"3000"} \
|
|
ROOT_URL=${ROOT_URL:-""} \
|
|
DISABLE_SSH=${DISABLE_SSH:-"false"} \
|
|
SSH_PORT=${SSH_PORT:-"22"} \
|
|
SSH_LISTEN_PORT=${SSH_LISTEN_PORT:-"${SSH_PORT}"} \
|
|
LFS_START_SERVER=${LFS_START_SERVER:-"false"} \
|
|
DB_TYPE=${DB_TYPE:-"sqlite3"} \
|
|
DB_HOST=${DB_HOST:-"localhost:3306"} \
|
|
DB_NAME=${DB_NAME:-"hanzo_git"} \
|
|
DB_USER=${DB_USER:-"root"} \
|
|
DB_PASSWD=${DB_PASSWD:-""} \
|
|
INSTALL_LOCK=${INSTALL_LOCK:-"false"} \
|
|
DISABLE_REGISTRATION=${DISABLE_REGISTRATION:-"false"} \
|
|
REQUIRE_SIGNIN_VIEW=${REQUIRE_SIGNIN_VIEW:-"false"} \
|
|
SECRET_KEY=${SECRET_KEY:-""} \
|
|
envsubst < /etc/templates/app.ini > ${GIT_CUSTOM}/conf/app.ini
|
|
|
|
chown ${USER}:git ${GIT_CUSTOM}/conf/app.ini
|
|
fi
|
|
|
|
# Replace app.ini settings with env variables in the form GIT__SECTION_NAME__KEY_NAME
|
|
# Fatal on failure: every deploy configures this server through GIT__* env alone,
|
|
# so a server that starts without the merge runs on whatever app.ini the volume
|
|
# happened to keep — the failure this line used to swallow.
|
|
environment-to-ini --config ${GIT_CUSTOM}/conf/app.ini || exit 1
|
|
|
|
# only chown if current owner is not already the ${USER}. No recursive check, to
|
|
# save time. /data holds the durable layout and /app/git the daemon binary. A
|
|
# volume an earlier release wrote keeps its own app.ini, and so its own data
|
|
# path, which is why a directory that is not there is skipped rather than made.
|
|
for dir in /data/forge /app/git /data/git; do
|
|
[[ -d ${dir} ]] || continue
|
|
if ! [[ $(ls -ld ${dir} | awk '{print $3}') = ${USER} ]]; then chown -R ${USER}:git ${dir}; fi
|
|
chmod 0755 ${dir}
|
|
done
|