132 lines
4.6 KiB
Smarty
132 lines
4.6 KiB
Smarty
#cloud-config
|
|
|
|
# Notes on Container-Optimized OS (COS):
|
|
# - /var is mounted noexec, so executable scripts must live under /var/lib/google
|
|
# (one of the exec-allowed writable paths on COS).
|
|
# - Mount units use systemd-escape(1) naming: /mnt/disks/forgejo-data becomes
|
|
# mnt-disks-forgejo\x2ddata.mount. We avoid hardcoding the escaped name in
|
|
# dependencies by using RequiresMountsFor=, which lets systemd resolve it.
|
|
|
|
write_files:
|
|
- path: /etc/systemd/system/mnt-disks-forgejo\x2ddata.mount
|
|
content: |
|
|
[Unit]
|
|
Description=Mount Forgejo data disk
|
|
Before=docker.service
|
|
|
|
[Mount]
|
|
What=/dev/disk/by-id/google-forgejo-data
|
|
Where=/mnt/disks/forgejo-data
|
|
Type=ext4
|
|
Options=defaults,nofail
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
- path: /var/lib/forgejo/Caddyfile
|
|
content: |
|
|
${domain} {
|
|
reverse_proxy forgejo:3000
|
|
encode gzip
|
|
}
|
|
|
|
- path: /var/lib/google/forgejo/fetch-secrets.sh
|
|
permissions: '0755'
|
|
content: |
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
TOKEN=$(curl -sf -H "Metadata-Flavor: Google" \
|
|
"http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" \
|
|
| python3 -c "import sys,json;print(json.load(sys.stdin)['access_token'])")
|
|
fetch() {
|
|
curl -sf -H "Authorization: Bearer $TOKEN" \
|
|
"https://secretmanager.googleapis.com/v1/projects/${project_id}/secrets/$1/versions/latest:access" \
|
|
| python3 -c "import sys,json,base64;print(base64.b64decode(json.load(sys.stdin)['payload']['data']).decode())"
|
|
}
|
|
mkdir -p /run
|
|
umask 077
|
|
{
|
|
echo "FORGEJO__security__SECRET_KEY=$(fetch forgejo-secret-key)"
|
|
echo "FORGEJO__security__INTERNAL_TOKEN=$(fetch forgejo-internal-token)"
|
|
} > /run/forgejo-secrets.env
|
|
|
|
- path: /etc/systemd/system/forgejo-stack.service
|
|
content: |
|
|
[Unit]
|
|
Description=Forgejo + Caddy + Watchtower
|
|
After=network-online.target docker.service
|
|
RequiresMountsFor=/mnt/disks/forgejo-data
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=true
|
|
ExecStartPre=/var/lib/google/forgejo/fetch-secrets.sh
|
|
ExecStartPre=-/usr/bin/docker network create web
|
|
ExecStart=/usr/bin/docker run -d --name caddy --network web \
|
|
-p 80:80 -p 443:443 \
|
|
-v /mnt/disks/forgejo-data/caddy:/data \
|
|
-v /var/lib/forgejo/Caddyfile:/etc/caddy/Caddyfile:ro \
|
|
--restart=unless-stopped \
|
|
${caddy_image}
|
|
ExecStart=/usr/bin/docker run -d --name forgejo --network web \
|
|
-e FORGEJO__server__DISABLE_SSH=true \
|
|
-e FORGEJO__server__ROOT_URL=https://${domain}/ \
|
|
-e FORGEJO__service__DISABLE_REGISTRATION=true \
|
|
-e FORGEJO__database__DB_TYPE=sqlite3 \
|
|
--env-file /run/forgejo-secrets.env \
|
|
-v /mnt/disks/forgejo-data/forgejo:/data \
|
|
--restart=unless-stopped \
|
|
${forgejo_image}
|
|
ExecStart=/usr/bin/docker run -d --name watchtower \
|
|
-v /var/run/docker.sock:/var/run/docker.sock \
|
|
--restart=unless-stopped \
|
|
containrrr/watchtower --cleanup --schedule "0 0 4 * * *"
|
|
ExecStop=/usr/bin/docker stop watchtower forgejo caddy
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
- path: /var/lib/google/forgejo/backup.sh
|
|
permissions: '0755'
|
|
content: |
|
|
#!/bin/bash
|
|
set -euo pipefail
|
|
STAMP=$(date -u +%Y%m%dT%H%M%SZ)
|
|
docker exec forgejo sqlite3 /data/gitea/gitea.db ".backup '/data/gitea/snapshot.db'"
|
|
tar czf /tmp/forgejo-$STAMP.tar.gz -C /mnt/disks/forgejo-data forgejo
|
|
docker run --rm -v /tmp:/tmp google/cloud-sdk:slim \
|
|
gsutil cp /tmp/forgejo-$STAMP.tar.gz gs://${gcs_backup_bucket}/
|
|
rm /tmp/forgejo-$STAMP.tar.gz
|
|
docker exec forgejo rm -f /data/gitea/snapshot.db
|
|
|
|
- path: /etc/systemd/system/forgejo-backup.service
|
|
content: |
|
|
[Unit]
|
|
Description=Backup Forgejo to GCS
|
|
After=forgejo-stack.service
|
|
Requires=forgejo-stack.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/var/lib/google/forgejo/backup.sh
|
|
|
|
- path: /etc/systemd/system/forgejo-backup.timer
|
|
content: |
|
|
[Unit]
|
|
Description=Nightly Forgejo backup
|
|
|
|
[Timer]
|
|
OnCalendar=*-*-* 03:30:00
|
|
Persistent=true
|
|
|
|
[Install]
|
|
WantedBy=timers.target
|
|
|
|
runcmd:
|
|
- mkdir -p /mnt/disks/forgejo-data
|
|
- if ! blkid /dev/disk/by-id/google-forgejo-data; then mkfs.ext4 -F /dev/disk/by-id/google-forgejo-data; fi
|
|
- systemctl daemon-reload
|
|
- mkdir -p /mnt/disks/forgejo-data/forgejo /mnt/disks/forgejo-data/caddy
|
|
- systemctl enable --now forgejo-stack.service
|
|
- systemctl enable --now forgejo-backup.timer
|