mirror of
https://github.com/RayLabsHQ/gitea-mirror.git
synced 2026-03-25 07:07:41 +03:00
0000a03ad6
* fix: improve reverse proxy support for subdomain deployments (#63) - Add X-Accel-Buffering: no header to SSE endpoint to prevent Nginx from buffering the event stream - Auto-detect trusted origin from Host/X-Forwarded-* request headers so the app works behind a proxy without manual env var configuration - Add prominent reverse proxy documentation to advanced docs page explaining BETTER_AUTH_URL, PUBLIC_BETTER_AUTH_URL, and BETTER_AUTH_TRUSTED_ORIGINS are mandatory for proxy deployments - Add reverse proxy env var comments and entries to both docker-compose.yml and docker-compose.alt.yml - Add dedicated reverse proxy configuration section to .env.example * fix: address review findings for reverse proxy origin detection - Fix x-forwarded-proto multi-value handling: take first value only and validate it is "http" or "https" before using - Update comment to accurately describe auto-detection scope: helps with per-request CSRF checks but not callback URL validation - Restore startup logging of static trusted origins for debugging * fix: handle multi-value x-forwarded-host in chained proxy setups x-forwarded-host can be comma-separated (e.g. "proxy1.example.com, proxy2.example.com") in chained proxy setups. Take only the first value, matching the same handling already applied to x-forwarded-proto. * test: add unit tests for reverse proxy origin detection Extract resolveTrustedOrigins into a testable exported function and add 11 tests covering: - Default localhost origins - BETTER_AUTH_URL and BETTER_AUTH_TRUSTED_ORIGINS env vars - Invalid URL handling - Auto-detection from x-forwarded-host + x-forwarded-proto - Multi-value header handling (chained proxy setups) - Invalid proto rejection (only http/https allowed) - Deduplication - Fallback to host header when x-forwarded-host absent
93 lines
4.4 KiB
YAML
93 lines
4.4 KiB
YAML
# Gitea Mirror deployment configuration
|
|
# Standard deployment with automatic database maintenance
|
|
|
|
services:
|
|
gitea-mirror:
|
|
image: ${DOCKER_REGISTRY:-ghcr.io}/${DOCKER_IMAGE:-raylabshq/gitea-mirror}:${DOCKER_TAG:-latest}
|
|
build:
|
|
context: .
|
|
dockerfile: Dockerfile
|
|
platforms:
|
|
- linux/amd64
|
|
- linux/arm64
|
|
cache_from:
|
|
- ${DOCKER_REGISTRY:-ghcr.io}/${DOCKER_IMAGE:-raylabshq/gitea-mirror}:${DOCKER_TAG:-latest}
|
|
container_name: gitea-mirror
|
|
restart: unless-stopped
|
|
ports:
|
|
- "4321:4321"
|
|
volumes:
|
|
- gitea-mirror-data:/app/data
|
|
# Mount custom CA certificates - choose one option:
|
|
# Option 1: Mount individual CA certificates from certs directory
|
|
# - ./certs:/app/certs:ro
|
|
# Option 2: Mount system CA bundle (if your CA is already in system store)
|
|
# - /etc/ssl/certs/ca-certificates.crt:/etc/ssl/certs/ca-certificates.crt:ro
|
|
environment:
|
|
# For a complete list of all supported environment variables, see:
|
|
# docs/ENVIRONMENT_VARIABLES.md or .env.example
|
|
- NODE_ENV=production
|
|
- DATABASE_URL=file:data/gitea-mirror.db
|
|
- HOST=0.0.0.0
|
|
- PORT=4321
|
|
- BETTER_AUTH_SECRET=${BETTER_AUTH_SECRET:-your-secret-key-change-this-in-production}
|
|
- BETTER_AUTH_URL=${BETTER_AUTH_URL:-http://localhost:4321}
|
|
# REVERSE PROXY: If you access Gitea Mirror through a reverse proxy (e.g. Nginx, Caddy, Traefik),
|
|
# you MUST set these three variables to your external URL. Example:
|
|
# BETTER_AUTH_URL=https://gitea-mirror.example.com
|
|
# PUBLIC_BETTER_AUTH_URL=https://gitea-mirror.example.com
|
|
# BETTER_AUTH_TRUSTED_ORIGINS=https://gitea-mirror.example.com
|
|
- PUBLIC_BETTER_AUTH_URL=${PUBLIC_BETTER_AUTH_URL:-http://localhost:4321}
|
|
- BETTER_AUTH_TRUSTED_ORIGINS=${BETTER_AUTH_TRUSTED_ORIGINS:-}
|
|
# Optional: ENCRYPTION_SECRET will be auto-generated if not provided
|
|
# - ENCRYPTION_SECRET=${ENCRYPTION_SECRET:-}
|
|
# GitHub/Gitea Mirror Config
|
|
- GITHUB_USERNAME=${GITHUB_USERNAME:-}
|
|
- GITHUB_TOKEN=${GITHUB_TOKEN:-}
|
|
- GITHUB_EXCLUDED_ORGS=${GITHUB_EXCLUDED_ORGS:-}
|
|
- SKIP_FORKS=${SKIP_FORKS:-false}
|
|
- PRIVATE_REPOSITORIES=${PRIVATE_REPOSITORIES:-false}
|
|
- MIRROR_ISSUES=${MIRROR_ISSUES:-false}
|
|
- MIRROR_WIKI=${MIRROR_WIKI:-false}
|
|
- MIRROR_STARRED=${MIRROR_STARRED:-false}
|
|
- MIRROR_ORGANIZATIONS=${MIRROR_ORGANIZATIONS:-false}
|
|
- PRESERVE_ORG_STRUCTURE=${PRESERVE_ORG_STRUCTURE:-false}
|
|
- ONLY_MIRROR_ORGS=${ONLY_MIRROR_ORGS:-false}
|
|
- SKIP_STARRED_ISSUES=${SKIP_STARRED_ISSUES:-false}
|
|
- MIRROR_ISSUE_CONCURRENCY=${MIRROR_ISSUE_CONCURRENCY:-3}
|
|
- MIRROR_PULL_REQUEST_CONCURRENCY=${MIRROR_PULL_REQUEST_CONCURRENCY:-5}
|
|
- GITEA_URL=${GITEA_URL:-}
|
|
- GITEA_TOKEN=${GITEA_TOKEN:-}
|
|
- GITEA_USERNAME=${GITEA_USERNAME:-}
|
|
- GITEA_ORGANIZATION=${GITEA_ORGANIZATION:-github-mirrors}
|
|
- GITEA_ORG_VISIBILITY=${GITEA_ORG_VISIBILITY:-public}
|
|
- DELAY=${DELAY:-3600}
|
|
# Scheduling and Sync Configuration (Issue #72 fixes)
|
|
- SCHEDULE_ENABLED=${SCHEDULE_ENABLED:-false}
|
|
- GITEA_MIRROR_INTERVAL=${GITEA_MIRROR_INTERVAL:-8h}
|
|
- AUTO_IMPORT_REPOS=${AUTO_IMPORT_REPOS:-true}
|
|
- AUTO_MIRROR_REPOS=${AUTO_MIRROR_REPOS:-false}
|
|
# Repository Cleanup Configuration
|
|
- CLEANUP_DELETE_IF_NOT_IN_GITHUB=${CLEANUP_DELETE_IF_NOT_IN_GITHUB:-false}
|
|
- CLEANUP_ORPHANED_REPO_ACTION=${CLEANUP_ORPHANED_REPO_ACTION:-archive}
|
|
- CLEANUP_DRY_RUN=${CLEANUP_DRY_RUN:-true}
|
|
# Optional: Skip TLS verification (insecure, use only for testing)
|
|
# - GITEA_SKIP_TLS_VERIFY=${GITEA_SKIP_TLS_VERIFY:-false}
|
|
# Header Authentication (for Reverse Proxy SSO)
|
|
- HEADER_AUTH_ENABLED=${HEADER_AUTH_ENABLED:-false}
|
|
- HEADER_AUTH_USER_HEADER=${HEADER_AUTH_USER_HEADER:-X-Authentik-Username}
|
|
- HEADER_AUTH_EMAIL_HEADER=${HEADER_AUTH_EMAIL_HEADER:-X-Authentik-Email}
|
|
- HEADER_AUTH_NAME_HEADER=${HEADER_AUTH_NAME_HEADER:-X-Authentik-Name}
|
|
- HEADER_AUTH_AUTO_PROVISION=${HEADER_AUTH_AUTO_PROVISION:-false}
|
|
- HEADER_AUTH_ALLOWED_DOMAINS=${HEADER_AUTH_ALLOWED_DOMAINS:-}
|
|
healthcheck:
|
|
test: ["CMD", "wget", "--no-verbose", "--tries=3", "--spider", "http://localhost:4321/api/health"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 5
|
|
start_period: 15s
|
|
|
|
# Define named volumes for database persistence
|
|
volumes:
|
|
gitea-mirror-data: # Database volume
|