mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-10-18 13:21:53 +02:00
ARUNAVO RAYandGitHub
c6157cdaad
* fix(security): guard connection tests, close sign-up and scope SSO providers Fixes the four privately reported issues GHSA-9m33-xfrc-5jxw, GHSA-6m23-28hh-gjh2, GHSA-2hpx-83vg-gm45 and GHSA-5pp8-r7f5-6q8p. - The Gitea and GitHub test-connection routes require a signed-in user. They were the only non-public API routes without a guard and made a server side request to any URL in the body. - Email sign-up is refused server side once an account exists unless AUTH_ALLOW_SIGNUP=true. Only the signup page redirected before; the endpoint accepted new accounts from anyone reaching the instance. - SSO providers are scoped to their owner for list, update and delete, and the client secret is never returned. An empty secret on update keeps the stored one, and the form says so. - HttpError messages carry the status only; the upstream body stays on the response field for logs and never reaches API clients. - A narrow outbound guard for user supplied URLs (connection tests, OIDC discovery, ntfy, Gotify, Apprise, webhook): link local and cloud metadata addresses are refused, host names are resolved and checked, and redirects are not followed. Private networks stay allowed since mirroring to a LAN Gitea is the normal deployment. * fix(security): pin plain http requests to the checked address The guard resolved a host name and checked its addresses, but fetch resolved the name a second time, so a name that changes its answer between the two lookups could still reach a link local address. Plain http requests now go to the address the check saw, with the original name in the Host header. https keeps the name: the certificate is validated against it and the metadata services speak no TLS.
236 lines
9.0 KiB
Bash
236 lines
9.0 KiB
Bash
# Gitea Mirror Configuration
|
|
# Copy this to .env and update with your values
|
|
|
|
# ===========================================
|
|
# CORE CONFIGURATION
|
|
# ===========================================
|
|
|
|
# Application Configuration
|
|
NODE_ENV=production
|
|
HOST=0.0.0.0
|
|
PORT=4321
|
|
# Optional application base path (use "/" for root, or "/mirror" for subpath deployments)
|
|
BASE_URL=/
|
|
|
|
# Database Configuration
|
|
# For self-hosted, SQLite is used by default
|
|
DATABASE_URL=sqlite://data/gitea-mirror.db
|
|
|
|
# Security
|
|
# Generate with: openssl rand -base64 32
|
|
BETTER_AUTH_SECRET=change-this-to-a-secure-random-string-in-production
|
|
BETTER_AUTH_URL=http://localhost:4321
|
|
# ENCRYPTION_SECRET=optional-encryption-key-for-token-encryption # Generate with: openssl rand -base64 48
|
|
# Better Auth log verbosity: debug | info | warn | error (default: warn).
|
|
# Set to "debug" to trace SSO/OIDC sign-in and callback issues.
|
|
# BETTER_AUTH_LOG_LEVEL=debug
|
|
|
|
# ===========================================
|
|
# REVERSE PROXY CONFIGURATION
|
|
# ===========================================
|
|
# REQUIRED when accessing Gitea Mirror through a reverse proxy (Nginx, Caddy, Traefik, etc.).
|
|
# Without these, sign-in will fail with "invalid origin" errors and pages may appear blank.
|
|
#
|
|
# Set all three to your external URL, e.g.:
|
|
# BETTER_AUTH_URL=https://gitea-mirror.example.com
|
|
# PUBLIC_BETTER_AUTH_URL=https://gitea-mirror.example.com
|
|
# BETTER_AUTH_TRUSTED_ORIGINS=https://gitea-mirror.example.com
|
|
#
|
|
# If your app is served from a path prefix (e.g. https://git.example.com/mirror), set:
|
|
# BASE_URL=/mirror
|
|
# BETTER_AUTH_URL=https://git.example.com
|
|
# PUBLIC_BETTER_AUTH_URL=https://git.example.com
|
|
# BETTER_AUTH_TRUSTED_ORIGINS=https://git.example.com
|
|
#
|
|
# BETTER_AUTH_URL - Used server-side for auth callbacks and redirects
|
|
# PUBLIC_BETTER_AUTH_URL - Used client-side (browser) for auth API calls
|
|
# BETTER_AUTH_TRUSTED_ORIGINS - Comma-separated list of origins allowed to make auth requests
|
|
# (e.g. https://gitea-mirror.example.com,https://alt.example.com)
|
|
PUBLIC_BETTER_AUTH_URL=http://localhost:4321
|
|
# BETTER_AUTH_TRUSTED_ORIGINS=
|
|
|
|
# ===========================================
|
|
# HTTPS / TLS (Optional)
|
|
# ===========================================
|
|
# Set BOTH to have the server terminate TLS directly (no reverse proxy needed).
|
|
# Leave unset when TLS is handled upstream by Nginx/Traefik/Caddy.
|
|
# SERVER_CERT_PATH=/etc/ssl/gitea-mirror/cert.pem
|
|
# SERVER_KEY_PATH=/etc/ssl/gitea-mirror/key.pem
|
|
|
|
# ===========================================
|
|
# DOCKER CONFIGURATION (Optional)
|
|
# ===========================================
|
|
|
|
# Docker Registry Configuration
|
|
DOCKER_REGISTRY=ghcr.io
|
|
DOCKER_IMAGE=raylabshq/gitea-mirror
|
|
DOCKER_TAG=latest
|
|
|
|
# ===========================================
|
|
# GITHUB CONFIGURATION
|
|
# All settings can also be configured via web UI
|
|
# ===========================================
|
|
|
|
# Basic GitHub Settings
|
|
# GITHUB_USERNAME=your-github-username
|
|
# GITHUB_TOKEN=your-github-personal-access-token
|
|
# GITHUB_TYPE=personal # Options: personal, organization
|
|
|
|
# GitHub Enterprise (GHES / GHEC with data residency)
|
|
# Leave unset for standard github.com. Examples:
|
|
# GHES (self-hosted): https://ghe.example.com/api/v3
|
|
# GHEC data residency: https://api.TENANT.ghe.com
|
|
# GH_API_URL=https://ghe.example.com/api/v3
|
|
|
|
# Repository Selection
|
|
# PRIVATE_REPOSITORIES=false
|
|
# PUBLIC_REPOSITORIES=true
|
|
# INCLUDE_ARCHIVED=false
|
|
# SKIP_FORKS=false
|
|
# MIRROR_STARRED=false
|
|
# MIRROR_STARRED_LISTS=homelab,dottools # Optional: comma-separated star list names; empty = all starred repos
|
|
# STARRED_REPOS_ORG=starred # Organization name for starred repos
|
|
# STARRED_REPOS_MODE=dedicated-org # dedicated-org | preserve-owner
|
|
|
|
# Organization Settings
|
|
# MIRROR_ORGANIZATIONS=false
|
|
# PRESERVE_ORG_STRUCTURE=false
|
|
# ONLY_MIRROR_ORGS=false
|
|
|
|
# Mirror Strategy
|
|
# MIRROR_STRATEGY=preserve # Options: preserve, single-org, flat-user, mixed
|
|
|
|
# Advanced GitHub Settings
|
|
# SKIP_STARRED_ISSUES=false # Enable lightweight mode for starred repos
|
|
|
|
# ===========================================
|
|
# GITEA CONFIGURATION
|
|
# All settings can also be configured via web UI
|
|
# ===========================================
|
|
|
|
# Basic Gitea Settings
|
|
# GITEA_URL=http://gitea:3000
|
|
# GITEA_EXTERNAL_URL=https://gitea.example.com # Optional: used only for UI links
|
|
# GITEA_TOKEN=your-local-gitea-token
|
|
# GITEA_USERNAME=your-local-gitea-username
|
|
# GITEA_ORGANIZATION=github-mirrors # Default organization for single-org strategy
|
|
|
|
# Repository Settings
|
|
# GITEA_ORG_VISIBILITY=public # Options: public, private, limited, default
|
|
# GITEA_MIRROR_INTERVAL=8h # Mirror sync interval (e.g., 30m, 1h, 8h, 24h) - automatically enables scheduler
|
|
# GITEA_LFS=false # Enable LFS support
|
|
# GITEA_CREATE_ORG=true # Auto-create organizations
|
|
# GITEA_PRESERVE_VISIBILITY=false # Preserve GitHub repo visibility in Gitea
|
|
|
|
# Template Settings (for using repository templates)
|
|
# GITEA_TEMPLATE_OWNER=template-owner
|
|
# GITEA_TEMPLATE_REPO=template-repo
|
|
|
|
# Topic Settings
|
|
# GITEA_ADD_TOPICS=true # Add topics to repositories
|
|
# GITEA_TOPIC_PREFIX=gh- # Prefix for topics
|
|
|
|
# Fork Handling
|
|
# GITEA_FORK_STRATEGY=reference # Options: skip, reference, full-copy
|
|
|
|
# ===========================================
|
|
# MIRROR OPTIONS
|
|
# Control what gets mirrored from GitHub
|
|
# ===========================================
|
|
|
|
# Release and Metadata
|
|
# MIRROR_RELEASES=false # Mirror GitHub releases
|
|
# RELEASE_LIMIT=10 # Maximum number of releases to mirror per repository
|
|
# MIRROR_WIKI=false # Mirror wiki content
|
|
|
|
# Issue Tracking (requires MIRROR_METADATA=true)
|
|
# MIRROR_METADATA=false # Master toggle for metadata mirroring
|
|
# MIRROR_ISSUES=false # Mirror issues
|
|
# MIRROR_PULL_REQUESTS=false # Mirror pull requests
|
|
# MIRROR_LABELS=false # Mirror labels
|
|
# MIRROR_MILESTONES=false # Mirror milestones
|
|
|
|
# ===========================================
|
|
# AUTOMATION CONFIGURATION
|
|
# Schedule automatic mirroring
|
|
# ===========================================
|
|
|
|
# Basic Schedule Settings
|
|
# SCHEDULE_ENABLED=false # When true, auto-imports and mirrors all repos on startup (v3.5.3+)
|
|
# SCHEDULE_INTERVAL=3600 # Interval in seconds or cron expression (e.g., "0 2 * * *")
|
|
# GITEA_MIRROR_INTERVAL=8h # Mirror sync interval (5m, 30m, 1h, 8h, 24h, 1d, 7d) - also triggers auto-start
|
|
# AUTO_IMPORT_REPOS=true # Automatically discover and import new GitHub repositories during syncs
|
|
# DELAY=3600 # Legacy: same as SCHEDULE_INTERVAL, kept for backward compatibility
|
|
|
|
# Execution Settings
|
|
# SCHEDULE_CONCURRENT=false # Allow concurrent mirror operations
|
|
# SCHEDULE_BATCH_SIZE=10 # Number of repos to process in parallel
|
|
# SCHEDULE_PAUSE_BETWEEN_BATCHES=5000 # Pause between batches (ms)
|
|
|
|
# Retry Configuration
|
|
# SCHEDULE_RETRY_ATTEMPTS=3
|
|
# SCHEDULE_RETRY_DELAY=60000 # Delay between retries (ms)
|
|
# SCHEDULE_TIMEOUT=3600000 # Max time for a mirror operation (ms)
|
|
# SCHEDULE_AUTO_RETRY=true
|
|
|
|
# Update Detection
|
|
# SCHEDULE_ONLY_MIRROR_UPDATED=false # Only mirror repos with updates
|
|
# SCHEDULE_UPDATE_INTERVAL=86400000 # Check for updates interval (ms)
|
|
# SCHEDULE_SKIP_RECENTLY_MIRRORED=true
|
|
# SCHEDULE_RECENT_THRESHOLD=3600000 # Skip if mirrored within this time (ms)
|
|
|
|
# Maintenance
|
|
# SCHEDULE_CLEANUP_BEFORE_MIRROR=false # Run cleanup before mirroring
|
|
|
|
# Notifications
|
|
# SCHEDULE_NOTIFY_ON_FAILURE=true
|
|
# SCHEDULE_NOTIFY_ON_SUCCESS=false
|
|
# SCHEDULE_LOG_LEVEL=info # Options: error, warn, info, debug
|
|
# SCHEDULE_TIMEZONE=UTC
|
|
|
|
# ===========================================
|
|
# DATABASE CLEANUP CONFIGURATION
|
|
# Automatic cleanup of old events and data
|
|
# ===========================================
|
|
|
|
# Basic Cleanup Settings
|
|
# CLEANUP_ENABLED=false
|
|
# CLEANUP_RETENTION_DAYS=7 # Days to keep events
|
|
|
|
# Repository Cleanup (v3.4.0+)
|
|
# CLEANUP_DELETE_FROM_GITEA=false # Delete repos from Gitea
|
|
# CLEANUP_DELETE_IF_NOT_IN_GITHUB=false # Auto-remove repos that no longer exist in GitHub
|
|
# CLEANUP_ORPHANED_REPO_ACTION=archive # Options: skip, archive, delete
|
|
# CLEANUP_DRY_RUN=true # Test mode without actual deletion (set to false for production)
|
|
|
|
# Protected Repositories (comma-separated)
|
|
# CLEANUP_PROTECTED_REPOS=important-repo,critical-project
|
|
|
|
# Cleanup Execution
|
|
# CLEANUP_BATCH_SIZE=10
|
|
# CLEANUP_PAUSE_BETWEEN_DELETES=2000 # Pause between deletions (ms)
|
|
|
|
# ===========================================
|
|
# AUTHENTICATION CONFIGURATION
|
|
# ===========================================
|
|
|
|
# Login page: tab that opens first when both email and SSO are available
|
|
# AUTH_DEFAULT_METHOD=email # email or sso
|
|
# AUTH_ALLOW_SIGNUP=false # true keeps email sign-up open after the first account
|
|
|
|
# Header Authentication (for Reverse Proxy SSO)
|
|
# Enable automatic authentication via reverse proxy headers
|
|
# HEADER_AUTH_ENABLED=false
|
|
# HEADER_AUTH_USER_HEADER=X-Authentik-Username
|
|
# HEADER_AUTH_EMAIL_HEADER=X-Authentik-Email
|
|
# HEADER_AUTH_NAME_HEADER=X-Authentik-Name
|
|
# HEADER_AUTH_AUTO_PROVISION=false
|
|
# HEADER_AUTH_ALLOWED_DOMAINS=example.com,company.org
|
|
|
|
# ===========================================
|
|
# OPTIONAL FEATURES
|
|
# ===========================================
|
|
|
|
# TLS/SSL Configuration
|
|
# GITEA_SKIP_TLS_VERIFY=false # WARNING: Only use for testing
|