vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Blame · deploy/cloud-init/vole.yaml

Line attribution on main · 135 line(s)

View file History

04e063ca Keenan Nemetz 3d ago	1	#cloud-config
	2	# A Vole instance on a fresh Ubuntu or Debian machine, ready in a few minutes.
	3	#
51624dc6 Keenan Nemetz 3d ago	4	# Each placeholder below is a value the caller supplies, and render.sh fills them
	5	# in: a placeholder is a dollar sign followed by a name in braces, so shell
	6	# variables in the script at the bottom are written without braces and are left
	7	# alone. scripts/check-deploy.py renders this file the same way to check it.
04e063ca Keenan Nemetz 3d ago	8	#
	9	# What this file does, in order: cloud-init installs git and curl, writes the
	10	# configuration and the admin's SSH key to /opt/vole-deploy, then runs
	11	# vole-first-boot, which installs the package, puts the configuration in place,
	12	# creates the instance admin, and starts the service. Nothing here is specific to
	13	# a cloud provider; see docs/deploy/ for which machine to give it to.
	14
	15	hostname: ${hostname}
	16	fqdn: ${hostname}
	17	manage_etc_hosts: true
	18
	19	package_update: true
	20	packages:
	21	- git
	22	- ca-certificates
	23	- curl
	24
	25	write_files:
	26	# Two configurations are staged and the boot script installs the one that
	27	# ${tls_mode} names: "acme" lets Vole obtain its own certificate, "proxy"
	28	# expects a TLS proxy in front. Editing the installed /etc/vole/vole.toml is
	29	# the normal way to change either afterwards.
	30	- path: /opt/vole-deploy/vole.acme.toml
	31	permissions: "0644"
	32	content: \|
	33	# Written by cloud-init. This is the whole configuration; see
	34	# docs/configuration.md for every setting.
	35	data_dir = "/var/lib/vole/data"
	36
	37	# Vole obtains and renews its own TLS certificate, so no proxy is needed.
	38	# Port 80 answers the certificate challenge and redirects to HTTPS.
	39	http_addr = ":80"
	40	https_addr = ":443"
	41	public_url = "https://${hostname}"
	42	acme_email = "${admin_email}"
	43
	44	# The only write transport: Git over SSH, authenticated by key.
	45	ssh_addr = "0.0.0.0:2222"
	46
	47	instance_name = "${instance_name}"
	48
	49	- path: /opt/vole-deploy/vole.proxy.toml
	50	permissions: "0644"
	51	content: \|
	52	# Written by cloud-init. This is the whole configuration; see
	53	# docs/configuration.md for every setting.
	54	data_dir = "/var/lib/vole/data"
	55
	56	# Nothing terminates TLS here. Put a proxy in front that keeps the Host
	57	# header and forwards the client address, then uncomment the last line.
	58	http_addr = "127.0.0.1:8080"
	59	public_url = "https://${hostname}"
	60	# git_http_client_ip_header = "X-Forwarded-For"
	61
	62	# The only write transport: Git over SSH, authenticated by key.
	63	ssh_addr = "0.0.0.0:2222"
	64
	65	instance_name = "${instance_name}"
	66
	67	# Ports below 1024 need one capability from the hardened unit. Only the ACME
	68	# configuration binds one.
	69	- path: /opt/vole-deploy/bind.conf
	70	permissions: "0644"
	71	content: \|
72	[Service]
73	CapabilityBoundingSet=CAP_NET_BIND_SERVICE
74	AmbientCapabilities=CAP_NET_BIND_SERVICE
75
76	# The first account, and an instance admin. A public key is not a secret, so
77	# this stays readable; the account keeps its own copy in users.db.
78	- path: /opt/vole-deploy/admin.pub
79	permissions: "0644"
80	content: \|
81	${admin_ssh_key}
82
83	- path: /usr/local/sbin/vole-first-boot
84	permissions: "0755"
85	content: \|
86	#!/bin/sh
87	# One-time setup for a Vole instance. cloud-init runs this once, on first
88	# boot. It is safe to run again: the package install is skipped when vole
89	# is already there, and the account is only created if it does not exist.
90	set -eu
91
92	ADMIN='${admin_account}'
93	PACKAGE_URL='${vole_package_url}'
94	TLS_MODE='${tls_mode}'
95	LOG=/var/log/vole-first-boot.log
96
97	exec >>"$LOG" 2>&1
98	echo "== vole first boot $(date -u +%Y-%m-%dT%H:%M:%SZ) =="
99
100	# The package creates the service account, /var/lib/vole, and the database
101	# and repository tree the shipped config names. Installing it before the
102	# configuration is written means the shipped conffile is replaced on
103	# purpose, which is the documented way to configure an instance.
104	if ! command -v vole >/dev/null 2>&1; then
105	echo "downloading $PACKAGE_URL"
106	curl -fsSL --retry 5 --retry-delay 2 -o /opt/vole-deploy/vole.deb "$PACKAGE_URL"
107	DEBIAN_FRONTEND=noninteractive apt-get install -y /opt/vole-deploy/vole.deb
108	rm -f /opt/vole-deploy/vole.deb
109	fi
110
111	install -m 0644 "/opt/vole-deploy/vole.$TLS_MODE.toml" /etc/vole/vole.toml
112	if [ "$TLS_MODE" = "acme" ]; then
113	install -d -m 0755 /etc/systemd/system/vole.service.d
114	install -m 0644 /opt/vole-deploy/bind.conf /etc/systemd/system/vole.service.d/bind.conf
115	fi
116	systemctl daemon-reload
117
118	# An account name is permanent, so this creates it once and leaves it alone
119	# on a later run.
120	if su -s /bin/sh vole -c "vole admin --config /etc/vole/vole.toml account show '$ADMIN'" >/dev/null 2>&1; then
121	echo "account $ADMIN already exists"
122	else
123	su -s /bin/sh vole -c "vole admin --config /etc/vole/vole.toml account create '$ADMIN' --key /opt/vole-deploy/admin.pub --role admin"
124	fi
125
126	systemctl enable --now vole
127	echo "vole is running on https://${hostname}"
128
129	runcmd:
130	- /usr/local/sbin/vole-first-boot
131
132	final_message: >-
133	Vole is up. Open https://${hostname} to sign in, or clone
134	ssh://git@${hostname}:2222/ once you have created a repository. Setup output is
135	in /var/log/vole-first-boot.log.