summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-01-10Add initContainer to install git-http-backendPaul Buetow
- New initContainer installs git and copies git-http-backend to shared /tmp volume - Updated nginx config to use /tmp/git-http-backend - Removed apk add from cgit container (was failing due to non-root user)
2026-01-10Install git-daemon package for git-http-backend supportPaul Buetow
2026-01-10Enable HTTP git operations in repository configPaul Buetow
- Make /repos mount read-write on cgit container - Set http.receivepack=true and http.uploadpack=true in git config - Allows git clone/fetch/push via HTTP - Fixes 403 Forbidden error from git-http-backend
2026-01-10Fix nginx: copy fastcgi_params to /tmp and reference itPaul Buetow
- Copy /etc/nginx/fastcgi_params to /tmp/fastcgi_params - Update include path to /tmp/fastcgi_params - Fixes 'No such file or directory' error
2026-01-10Fix git-http-backend: insert location into existing server blockPaul Buetow
- Use sed to insert git-http-backend location into default.conf - Location must be inside server block, not separate file - Fixes nginx config syntax error
2026-01-10Fix: remove apk install, use git already in alpine-cgit imagePaul Buetow
2026-01-10Add git-http-backend for HTTP git operationsPaul Buetow
- Install git package in cgit container - Add nginx config for git-http-backend via fcgiwrap - Supports git clone/fetch/pull over HTTP at /conf.git/ path - cgit remains for web UI at /conf/ path - Eliminates need for SSH and SSH agent sidecar
2026-01-10Remove custom SSH agent sidecar - use ArgoCD native SSH supportPaul Buetow
- Removed SSH agent sidecar container - Removed custom SSH_AUTH_SOCK and SSH key volumes - ArgoCD will use native SSH support with: - Repository credential secret (git-server-repo-creds) - Known hosts ConfigMap (argocd-ssh-known-hosts-cm) - Much simpler and follows ArgoCD best practices
2026-01-10Add persistent ArgoCD configs for git-serverPaul Buetow
- git-server-repo-creds.yaml: Repository credential secret for SSH auth - git-server-known-hosts.yaml: SSH known_hosts for git-server - Ensures configs survive cluster restarts
2026-01-10Make ssh-agent socket world-readable (chmod 666)Paul Buetow
- Fixes permission denied error when repo-server accesses socket - Ensures changes survive cluster restart
2026-01-10Fix ssh-agent user creation - check if UID 999 exists firstPaul Buetow
- Check if UID 999 exists before creating user - Look up username for UID 999 dynamically - Fixes 'unknown user argocd' error
2026-01-10Fix ssh-agent sidecar: install openssh as root, run agent as user 999Paul Buetow
- Install openssh as root (has apk permissions) - Create argocd user (999) if needed - Use su to run ssh-agent as argocd user - Fixes 'permission denied' and 'ssh-agent not found' errors
2026-01-10Run SSH agent sidecar as argocd user (999)Paul Buetow
- Fixes permission denied error when repo-server tries to access socket - Both containers now run as same user for shared socket access
2026-01-10Add SSH agent sidecar to ArgoCD repo-serverPaul Buetow
- Create ssh-agent sidecar container to provide SSH_AUTH_SOCK - Share socket via emptyDir volume at /tmp/ssh-agent - Add SSH key from argocd-git-ssh-key secret to agent - Fixes 'SSH agent requested but SSH_AUTH_SOCK not-specified' errors
2026-01-10Use ArgoCD native repository credentials instead of manual SSH key mountPaul Buetow
- Remove custom SSH key volume and volumeMount - Remove SSH_AUTH_SOCK and GIT_SSH_COMMAND env vars - Let ArgoCD use repository credential secret (git-server-repo-creds)
2026-01-10Set SSH_AUTH_SOCK to /dev/null instead of empty stringPaul Buetow
2026-01-10Fix ArgoCD SSH agent errorPaul Buetow
- Set SSH_AUTH_SOCK to empty string to disable SSH agent - Add IdentitiesOnly=yes to GIT_SSH_COMMAND to use only the specified key - Fixes 'SSH agent requested but SSH_AUTH_SOCK not-specified' errors
2026-01-10add changePaul Buetow
2026-01-10Fix git-server non-root deploymentPaul Buetow
- Generate SSH host keys in initContainer with correct ownership - Remove deprecated UsePrivilegeSeparation from sshd_config - Fix NFS repository permissions (UID 1001, GID 33) - Configure git shared repository mode
2026-01-09remove testPaul Buetow
2026-01-09Remove SETUID/SETGID capabilities from cgit containerPaul Buetow
cgit doesn't need privilege escalation capabilities when running as UID 33 with writable /tmp for runtime files. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Final test: verify complete workflowPaul Buetow
2026-01-09Fix cgit nginx config - update correct socket path in default.confPaul Buetow
The fcgiwrap socket path is configured in /etc/nginx/conf.d/default.conf, not cgit.conf. Copy conf.d directory to /tmp and update socket path there. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add git safe.directory config to entrypoint for NFS compatibilityPaul Buetow
Configures git to trust all directories on startup, preventing 'dubious ownership' errors when accessing NFS-mounted repositories with different UIDs. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix cgit container permissions - use writable /tmp for runtime filesPaul Buetow
- Mount emptyDir volume at /tmp for cgit runtime files - Copy nginx.conf to /tmp and modify there (read-only /etc) - Move nginx PID file to /tmp/nginx.pid - Move fcgiwrap socket to /tmp/fcgiwrap.sock - Update cgit.conf to use new socket location Allows cgit to run as non-root (UID 33) without write access to /etc or /var. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Merge branch 'master' of ssh://r0:30022/repos/repos/confPaul Buetow
2026-01-09Use proper security contexts for NFS access without chownPaul Buetow
Changes: - Set fsGroup: 33 at pod level for proper NFS group access - Updated git user to UID 1001, GID 33 (www-data) to match NFS ownership - Run git-server container as UID 1001:33 (non-root) - Run cgit container as UID 33:33 (non-root) - Disabled SSH privilege separation (UsePrivilegeSeparation no) - Removed unnecessary capabilities (SETGID, SETUID, SYS_CHROOT) This follows the same pattern as filebrowser and webdav services, using security contexts instead of chown operations on NFS. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Test: verify push access worksPaul Buetow
2026-01-09Merge: resolve conflict, keep virtual-root and correct scan-pathPaul Buetow
2026-01-09Fix cgit URL generation by setting virtual-rootPaul Buetow
Added virtual-root=/ to cgitrc to prevent duplicate path segments in generated URLs. This fixes the "Invalid request" error when clicking links in the cgit web interface. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix cgit scan-path to match repository structurePaul Buetow
Repository is at /repos/repos/conf.git, so scan-path should be /repos/repos to generate correct URLs in the web interface. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Migrate all applications from Codeberg to self-hosted gitPaul Buetow
Updated 17 application manifests to use internal git-server: - Monitoring: grafana-ingress, prometheus, pushgateway - Services: anki-sync-server, audiobookshelf, filebrowser, immich, keybr, kobo-sync-server, miniflux, opodsync, radicale, syncthing, tracing-demo, wallabag, webdav - Infra: registry All applications now fetch from: ssh://git@git-server.cicd.svc.cluster.local/repos/repos/conf.git Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Migrate example-apache-volume-claim to self-hosted gitPaul Buetow
Test migration of first application from Codeberg to internal git-server. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Test: verify SSH push worksPaul Buetow
2026-01-09Migrate all applications from Codeberg to self-hosted gitPaul Buetow
Updated 17 application manifests to use internal git-server: - Monitoring: grafana-ingress, prometheus, pushgateway - Services: anki-sync-server, audiobookshelf, filebrowser, immich, keybr, kobo-sync-server, miniflux, opodsync, radicale, syncthing, tracing-demo, wallabag, webdav - Infra: registry All applications now fetch from: ssh://git@git-server.cicd.svc.cluster.local/repos/repos/conf.git Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Migrate example-apache-volume-claim to self-hosted gitPaul Buetow
Test migration of first application from Codeberg to internal git-server. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Reduce SSH logging from DEBUG3 to INFOPaul Buetow
Debug logging was useful for troubleshooting but not needed in production. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Unlock git user account for SSH authenticationPaul Buetow
SSH requires user accounts to be unlocked (not have ! in shadow). Use 'passwd -u' to unlock the git user account. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Make .ssh directory world-readable for SELinux compatibilityPaul Buetow
SELinux prevents root from accessing 700 directories in some contexts. Use 755 for directory and 644 for authorized_keys to allow access. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Remove readOnly flag from git-ssh-writable mountPaul Buetow
The emptyDir needs to be writable for SSH to access authorized_keys. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add git-shell to /etc/shells for SSH validityPaul Buetow
SSH requires user shells to be listed in /etc/shells. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix nested .ssh directory issuePaul Buetow
Remove extra .ssh directory creation in initContainer. The emptyDir mount point itself is /home/git/.ssh. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix authorized_keys permissions via initContainerPaul Buetow
Copy authorized_keys from secret to emptyDir with git user ownership. This allows SSH to read the keys for authentication. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add SETGID and SETUID capabilities to git-serverPaul Buetow
SSH privilege separation requires setgroups() and setuid() syscalls. Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Add SSH connectivity for git-server and configure ArgoCDPaul Buetow
- Enable SYS_CHROOT capability for git-server SSH to work in containers - Configure ArgoCD repo-server to use SSH key for git-server access - Set DEBUG3 logging in sshd for troubleshooting (temp) Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2026-01-09Fix fcgiwrap socket permissions for nginx workersPaul Buetow
Nginx workers (running as user nginx) couldn't connect to fcgiwrap.sock created by root. Add chmod 666 to make the socket world-accessible.
2026-01-09Fix cgit port mapping - nginx listens on port 80Paul Buetow
The cgit nginx default.conf listens on port 80, not 8080. Update: - Container port from 8080 to 80 - Service targetPort from 8080 to 80
2026-01-09Add SETGID and SETUID capabilities to cgit containerPaul Buetow
Nginx workers need these capabilities to drop privileges. Add SETGID and SETUID to allow nginx workers to start properly.
2026-01-09Remove fsGroup to fix nginx worker setgid errorsPaul Buetow
The fsGroup: 1000 was causing nginx workers to fail with setgid errors even after removing 'user nginx;' directive. Since both containers run as root, fsGroup is not needed for repo access.
2026-01-09Remove 'user nginx;' directive to fix nginx worker errorsPaul Buetow
When running as root with fsGroup, nginx workers fail trying to setgid. Remove the 'user nginx;' directive from nginx.conf at startup using sed. This allows nginx to run workers as root without permission errors.
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-17 16:51:59 +0000