zomas/homepage-nuova
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
f5c763be7bea98d3a77560c8046b6f8b950167dc
homepage-nuova/install_gitea_vps.sh
T
zomas f5c763be7b Gitea theme: capital theta (circle+H) logo + homepage senza badge 
- Logo/favicon ridisegnati come theta maiuscola: cerchio (anello)
  con 'H' centrata, clearance verificata (non tocca l'anello); ring
  ispessito per la favicon; centratura ottica verificata.
- Rimosso il badge 'Self-hosted Git' dal hero della homepage (era
  esteticamente di troppo) - CSS e markup.
- Aggiornati generate_theta.py, README, home.tmpl; caricati sul VPS in
  staging (md5 locali == remoti); tarball ricostruito.
- Salvataggio iniziale dell'intero admin pack in git.
2026-09-01 16:54:15 +02:00

250 lines
9.6 KiB
Bash
Raw Blame History

# Installazione Gitea su VPS OVH — copia/incolla (root/sudo)
# Obbiettivo: git.zomas.net (Gitea dietro Apache; non tocca zomas.net / zomas.org)
# VPS: Debian 12, 4 vCPU, 7.6GB RAM
# Chi esegue: TU (root o sudo). Esegui i blocchi in ordine.
#
# ⚠️ PREREQUISITO DNS: prima del Passo 5 deve risolvere pubblicamente:
# dig +short git.zomas.net -> deve tornare 145.239.94.49
# (finché dà NXDOMAIN, SALTA il Passo 5 e resta solo in HTTP)
#
###############################################################################
# PASSO 1 — Installa Gitea (binario ufficiale + utente dedicato + sqlite)
###############################################################################
apt-get update && apt-get upgrade -y
apt-get install -y git sqlite3 curl wget
# utente di sistema dedicato (senza login)
adduser --system --group --disabled-password --home /var/lib/gitea gitea
mkdir -p /etc/gitea /var/lib/gitea/custom /var/lib/gitea/data /var/lib/gitea/log
chown -R root:gitea /etc/gitea
chown -R gitea:gitea /var/lib/gitea/
chmod -R g+rws /var/lib/gitea/
chmod -R g+rw /var/lib/gitea/
# ultima versione stabile
VERSION=$(curl -sL https://dl.gitea.com/gitea/version.json | python3 -c "import sys,json;print(json.load(sys.stdin)['latest']['version'])" 2>/dev/null || echo "1.22.0")
echo "Installazione Gitea $VERSION"
curl -sL -o /tmp/gitea "https://dl.gitea.com/gitea/$VERSION/gitea-$VERSION-linux-amd64"
# sposta e rendi eseguibile
install -o root -g root -m 755 /tmp/gitea /usr/local/bin/gitea
/usr/local/bin/gitea --version
###############################################################################
# PASSO 2 — Configurazione Gitea (app.ini)
###############################################################################
cat > /etc/gitea/app.ini <<'EOF'
RUN_USER = gitea
RUN_MODE = prod
[server]
; porta INTERNA: Apache farà da proxy verso questa
HTTP_PORT = 3000
HTTP_ADDR = 127.0.0.1
ROOT_URL = https://git.zomas.net/
DOMAIN = git.zomas.net
DISABLE_SSH = false
SSH_PORT = 2222
LFS_START_SERVER = true
[database]
DB_TYPE = sqlite3
PATH = /var/lib/gitea/data/gitea.db
[repository]
ROOT = /var/lib/gitea/data/gitea-repositories
[service]
DISABLE_REGISTRATION = false ; metti true quando vuoi bloccare le iscrizioni esterne
EOF
chown -R gitea:gitea /etc/gitea
###############################################################################
# PASSO 3 — Servizio systemd
###############################################################################
tee /etc/systemd/system/gitea.service >/dev/null <<'EOF'
[Unit]
Description=Gitea (Git with a cup of tea)
After=syslog.target
After=network.target
[Service]
RestartSec=2s
Type=simple
User=gitea
Group=gitea
WorkingDirectory=/var/lib/gitea/
ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini
Restart=always
Environment=USER=gitea HOME=/var/lib/gitea GITEA_WORK_DIR=/var/lib/gitea
[Install]
WantedBy=multi-user.target
EOF
systemctl daemon-reload
systemctl enable gitea
systemctl start gitea
systemctl status gitea --no-pager | head -15
# verifica locale (deve rispondere HTTP)
curl -sI http://127.0.0.1:3000 | head -3
###############################################################################
# PASSO 4 — Virtualhost Apache (reverse proxy verso Gitea)
###############################################################################
# abilita i moduli necessario (i siti zomas.net/zomas.org NON vengono toccati)
a2enmod proxy_http proxy ssl
systemctl reload apache2
# virtualhost HTTP (redirect -> https)
cat > /etc/apache2/sites-available/git.zomas.net.conf <<'EOF'
<VirtualHost *:80>
ServerName git.zomas.net
Redirect permanent / https://git.zomas.net/
</VirtualHost>
EOF
# virtualhost HTTPS (proxy verso Gitea su 127.0.0.1:3000) — certbot poi aggiunge il SSL
cat > /etc/apache2/sites-available/git.zomas.net-ssl.conf <<'EOF'
<VirtualHost *:443>
ServerName git.zomas.net
CustomLog /var/log/apache2/git.zomas.net-access.log combined
ErrorLog /var/log/apache2/git.zomas.net-error.log
ProxyPreserveHost On
RequestHeader set Host %{HTTP_HOST}e
ProxyRequests Off
ProxyPass / http://127.0.0.1:3000/
ProxyPassReverse / http://127.0.0.1:3000/
</VirtualHost>
EOF
# abilita i virtualhost (mantenendo net/org intatti)
a2ensite git.zomas.net.conf
a2ensite git.zomas.net-ssl.conf
systemctl reload apache2
# verifica: il vhost :80 deve rispondere
curl -sI http://127.0.0.1:80 -H "Host: git.zomas.net" | head -3
###############################################################################
# PASSO 5 — Certificato HTTPS con Let's Encrypt
# ⚠️ FAI SOLO QUANDO git.zomas.net risolve pubblicamente (dig +short = 145.239.94.49)
###############################################################################
# richiedi il certificato per git.zomas.net (usa il vhost :80 come challenge)
certbot --apache -d git.zomas.net
# quando ti chiede il redirect HTTP->HTTPS scegli: 2
systemctl reload apache2
# verifica finale HTTPS
curl -sI https://git.zomas.net | head -3
###############################################################################
# PRIMO ACCESSO (dopo il Passo 3, già funziona in HTTP)
###############################################################################
# Apri nel browser: https://git.zomas.net (o http:// se non hai ancora il passo 5)
# Al primo avvio Gitea mostra la pagina di installazione:
# - DB: SQLite3
# - Path DB: /var/lib/gitea/data/gitea.db
# - URL: https://git.zomas.net/
# - Crea l'account amministratore (utente final, nome, email, password)
# Si può rilanciare la procedura con: su gitea -s /bin/bash -c "cd /var/lib/gitea && /usr/local/bin/gitea admin create-user --username admin --password 'ScegliPasswordSicura' --email [email protected] --admin"
# (poi applica via web)
#
# Nota SSH: Gitea usa la porta 2222 per git over SSH (oltre alla web). Da client:
# git clone ssh://[email protected]:2222/<utente>/<repo>.git
###############################################################################
# PASSO 6 — Certificati Let's Encrypt per origine (plugin dns-cloudflare)
# ⚠️ da eseguire come ROOT sul VPS. Il token CF è già in /tmp/cloudflare_tmp.ini
# Genera i cert con challenge DNS: funziona anche con i record messi "proxied".
# NON tocca i vhost esistenti di zomas.net / zomas.org (stesso --cert-name).
###############################################################################
set -ea
mkdir -p /root/.config/letsencrypt
[ -f /tmp/cloudflare_tmp.ini ] && { cp /tmp/cloudflare_tmp.ini /root/.config/letsencrypt/cloudflare.ini; chmod 600 /root/.config/letsencrypt/cloudflare.ini; } || { echo "Manca /tmp/cloudflare_tmp.ini"; exit 1; }
echo "=== 1/3 zomas.net + www ==="
certbot certonly --dns-cloudflare \
--dns-cloudflare-credentials /root/.config/letsencrypt/cloudflare.ini \
--dns-cloudflare-propagation-seconds 60 \
-d zomas.net -d www.zomas.net \
--cert-name zomas.net --non-interactive --agree-tos -m [email protected] --force-renewal
echo "=== 2/3 zomas.org + www ==="
certbot certonly --dns-cloudflare \
--dns-cloudflare-credentials /root/.config/letsencrypt/cloudflare.ini \
--dns-cloudflare-propagation-seconds 60 \
-d zomas.org -d www.zomas.org \
--cert-name zomas.org --non-interactive --agree-tos -m [email protected] --force-renewal
echo "=== 3/3 git.zomas.net ==="
certbot certonly --dns-cloudflare \
--dns-cloudflare-credentials /root/.config/letsencrypt/cloudflare.ini \
--dns-cloudflare-propagation-seconds 60 \
-d git.zomas.net \
--cert-name git.zomas.net --non-interactive --agree-tos -m [email protected]
echo "=== file generati in /etc/letsencrypt/live ==="
ls -la /etc/letsencrypt/live/
echo "=== certificati git ==="
ls -la /etc/letsencrypt/live/git.zomas.net/
###############################################################################
# PASSO 7 — (dopo aver generato i cert) Completare il vhost SSL di git
# e riabilitarlo. Il certificato git ora esiste in live/git.zomas.net.
# ⚠️ Leggi il contenuto di git.zomas.net-ssl.conf e COMPLETA il blocco
# aggiungendo: SSLEngine on + SSLCertificateFile/Key con i path git.
# Esempio (sostituisci tutto il contenuto del file):
###############################################################################
cat > /etc/apache2/sites-available/git.zomas.net-ssl.conf <<'EOF'
<VirtualHost *:443>
ServerName git.zomas.net
CustomLog /var/log/apache2/git.zomas.net-access.log combined
ErrorLog /var/log/apache2/git.zomas.net-error.log
SSLEngine on
Include /etc/letsencrypt/options-ssl-apache.conf
SSLCertificateFile /etc/letsencrypt/live/git.zomas.net/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/git.zomas.net/privkey.pem
ProxyPreserveHost On
RequestHeader set Host %{HTTP_HOST}e
ProxyRequests Off
ProxyPass / http://127.0.0.1:3000/
ProxyPassReverse / http://127.0.0.1:3000/
</VirtualHost>
EOF
# riabilita il vhost SSL di git (dopo aver verificato che i cert esistono)
a2ensite git.zomas.net-ssl.conf
apache2ctl configtest
systemctl reload apache2
# verifica certificato da linea di comando
curl -sk -o /dev/null -w "https git (via IP/SNI) HTTP %{http_code}\n" https://127.0.0.1 -H "Host: git.zomas.net" --resolve git.zomas.net:443:127.0.0.1
###############################################################################
# PASSO 8 — Pannello Cloudflare: attiva il proxy (arancio) SOLO sui record web
# ⚠️ NON toccare: MX, mail.*, sole, calendar, docs, _dmarc, SPF, SRV
# Metti "Proxy (arancio)" su:
# - git.zomas.net (già arancio)
# - zomas.net (A)
# - www.zomas.net (CNAME)
# - zomas.org (A)
# - www.zomas.org (CNAME)
# Poi in SSL/TLS -> Overview seleziona: "Full (strict)"
###############################################################################
Reference in New Issue View Git Blame Copy Permalink