mirror of
https://github.com/go-gitea/gitea.git
synced 2026-10-01 20:34:59 +00:00
TheFox0x7
1b1274486c
Introduces gitproxy module which spawns a small forward proxy as scanner for git calls Replaces hostmatcher with matchlist which supports port rules Deprecates ALLOWED_DOMAINS/BLOCKED_DOMAINS and ALLOW_LOCALNETWORKS settings in migration in favor of full names we have in security configs. Removes `external` preset in favor of lax/strict modes, strict mode requiring explicit ports if they aren't standard http/s ones. Breaking changes: - `external` preset no longer works as deny rule. To enforce that, use `strict` mode and allow ranges to connect to - Wildcards are no longer accepted in IP addresses - `*` is no longer allowed as entry in lists - domain rules now use curl like syntax `*.example.com` matching subdomains but not `example.com`, `example.com` matching itself and all subdomains. `example.*` is not a valid rule - In the default `lax` mode, `[security] ALLOWED_HOST_LIST` no longer restricts public hosts, set `EGRESS_MODE = strict` to keep an exclusive list. A startup warning flags this - Invalid list entries are logged at startup, invalid `BLOCKED_HOST_LIST`/`BLOCKED_DOMAINS` entries stop it Docs: https://gitea.com/gitea/docs/pulls/557 Signed-off-by: wxiaoguang <wxiaoguang@gmail.com> Co-authored-by: silverwind <me@silverwind.io> Co-authored-by: bircni <bircni@icloud.com> Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
110 lines
3.0 KiB
Handlebars
110 lines
3.0 KiB
Handlebars
WORK_PATH = {{TEST_WORK_PATH}}
|
|
APP_NAME = Gitea: Git with a cup of tea
|
|
RUN_MODE = prod
|
|
|
|
[database]
|
|
DB_TYPE = mysql
|
|
HOST = {{TEST_MYSQL_HOST}}
|
|
NAME = {{TEST_MYSQL_DBNAME}}
|
|
USER = {{TEST_MYSQL_USERNAME}}
|
|
PASSWD = {{TEST_MYSQL_PASSWORD}}
|
|
SSL_MODE = disable
|
|
|
|
[indexer]
|
|
REPO_INDEXER_ENABLED = true
|
|
ISSUE_INDEXER_TYPE = elasticsearch
|
|
ISSUE_INDEXER_CONN_STR = http://elastic:changeme@elasticsearch:9200
|
|
|
|
[queue.issue_indexer]
|
|
TYPE = level
|
|
|
|
[queue]
|
|
TYPE = immediate
|
|
|
|
[queue.code_indexer]
|
|
TYPE = immediate
|
|
|
|
[queue.push_update]
|
|
TYPE = immediate
|
|
|
|
[queue.webhook_sender]
|
|
TYPE = immediate
|
|
|
|
[repository.signing]
|
|
SIGNING_KEY = none
|
|
|
|
[server]
|
|
SSH_DOMAIN = localhost
|
|
HTTP_PORT = 3001
|
|
ROOT_URL = http://localhost:3001/
|
|
LOCAL_ROOT_URL = http://127.0.0.1:3001/
|
|
DISABLE_SSH = false
|
|
SSH_LISTEN_HOST = localhost
|
|
SSH_PORT = 2201
|
|
BUILTIN_SSH_SERVER_USER = git
|
|
START_SSH_SERVER = true
|
|
|
|
LFS_START_SERVER = true
|
|
LFS_JWT_SECRET = Tv_MjmZuHqpIY6GFl12ebgkRAMt4RlWt0v4EHKSXO0w
|
|
SSH_TRUSTED_USER_CA_KEYS = ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCb4DC1dMFnJ6pXWo7GMxTchtzmJHYzfN6sZ9FAPFR4ijMLfGki+olvOMO5Fql1/yGnGfbELQa1S6y4shSvj/5K+zUFScmEXYf3Gcr87RqilLkyk16RS+cHNB1u87xTHbETaa3nyCJeGQRpd4IQ4NKob745mwDZ7jQBH8AZEng50Oh8y8fi8skBBBzaYp1ilgvzG740L7uex6fHV62myq0SXeCa+oJUjq326FU8y+Vsa32H8A3e7tOgXZPdt2TVNltx2S9H2WO8RMi7LfaSwARNfy1zu+bfR50r6ef8Yx5YKCMz4wWb1SHU1GS800mjOjlInLQORYRNMlSwR1+vLlVDciOqFapDSbj+YOVOawR0R1aqlSKpZkt33DuOBPx9qe6CVnIi7Z+Px/KqM+OLCzlLY/RS+LbxQpDWcfTVRiP+S5qRTcE3M3UioN/e0BE/1+MpX90IGpvVkA63ILYbKEa4bM3ASL7ChTCr6xN5XT+GpVJveFKK1cfNx9ExHI4rzYE=
|
|
|
|
[mailer]
|
|
ENABLED = true
|
|
PROTOCOL = dummy
|
|
FROM = mysql-integration-test@gitea.io
|
|
|
|
[migrations]
|
|
ALLOWED_HOST_LIST = private, loopback
|
|
|
|
[service]
|
|
REGISTER_EMAIL_CONFIRM = false
|
|
REGISTER_MANUAL_CONFIRM = false
|
|
DISABLE_REGISTRATION = false
|
|
ENABLE_CAPTCHA = false
|
|
REQUIRE_SIGNIN_VIEW = false
|
|
DEFAULT_KEEP_EMAIL_PRIVATE = false
|
|
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
|
|
NO_REPLY_ADDRESS = noreply.example.org
|
|
ENABLE_NOTIFY_MAIL = true
|
|
|
|
[session]
|
|
PROVIDER = file
|
|
|
|
[log]
|
|
MODE = {{TEST_LOGGER}}
|
|
ENABLE_SSH_LOG = true
|
|
logger.xorm.MODE = file
|
|
|
|
[log.test]
|
|
LEVEL = Info
|
|
COLORIZE = true
|
|
|
|
[log.file]
|
|
LEVEL = Debug
|
|
|
|
[security]
|
|
INSTALL_LOCK = true
|
|
SECRET_KEY = 9pCviYTWSb
|
|
INTERNAL_TOKEN = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE0OTU1NTE2MTh9.hhSVGOANkaKk3vfCd2jDOIww4pUk0xtg9JRde5UogyQ
|
|
DISABLE_QUERY_AUTH_TOKEN = true
|
|
|
|
[packages]
|
|
ENABLED = true
|
|
|
|
[email.incoming]
|
|
; temporarily disabled because the incoming mail tests are flaky due to the IMAP server (during integration tests) couldn't be not ready in time sometimes.
|
|
ENABLED = false
|
|
HOST = smtpimap
|
|
PORT = 993
|
|
USERNAME = debug@localdomain.test
|
|
PASSWORD = debug
|
|
USE_TLS = true
|
|
SKIP_TLS_VERIFY = true
|
|
REPLY_TO_ADDRESS = incoming+%{token}@localhost
|
|
|
|
[actions]
|
|
ENABLED = true
|
|
|
|
[webhook]
|
|
ALLOWED_HOST_LIST = 127.0.0.1
|