131 lines
4.1 KiB
Markdown
131 lines
4.1 KiB
Markdown
|
|
|||
|
|
|
|||
|
|
To integrate Forgejo running in a Docker container with the host's SSH server, follow these steps:
|
|||
|
|
|
|||
|
|
### Step 1: Disable Forgejo's Internal SSH Server
|
|||
|
|
In your `docker-compose.yml` file, add the environment variable to disable Forgejo's internal SSH server:
|
|||
|
|
|
|||
|
|
```yaml
|
|||
|
|
environment:
|
|||
|
|
- FORGEJO__server__START_SSH_SERVER=false
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### Step 2: Configure the Host SSH Server
|
|||
|
|
Add a dedicated user for Forgejo (e.g., `git`) on your host:
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
sudo adduser --disabled-password --gecos 'Forgejo' git
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Update the SSH configuration in `/etc/ssh/sshd_config`:
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
Match User git
|
|||
|
|
AllowTcpForwarding yes
|
|||
|
|
X11Forwarding no
|
|||
|
|
PermitTunnel no
|
|||
|
|
AllowAgentForwarding no
|
|||
|
|
ForceCommand docker exec -i forgejo /app/gitea/gitea serv key-$SSH_ORIGINAL_COMMAND
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
Restart the SSH server:
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
sudo systemctl restart sshd
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### Step 3: Update Forgejo Configuration
|
|||
|
|
Ensure that Forgejo's SSH domain and port in the configuration match your host's SSH settings. You can do this in the Forgejo web interface or by modifying the `app.ini` file within the container.
|
|||
|
|
|
|||
|
|
This setup allows Forgejo to use the host's SSH server for Git operations while running in a Docker container.
|
|||
|
|
|
|||
|
|
|
|||
|
|
|
|||
|
|
create user
|
|||
|
|
```bash
|
|||
|
|
docker exec forgejo forgejo admin user create --username fengzhiqiang --password admingzzn --email fengzhq@it2000.com.cn --admin
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
email
|
|||
|
|
```
|
|||
|
|
HOST = smtp.exmail.qq.com:465
|
|||
|
|
FROM = server@it2000.com.cn
|
|||
|
|
USER = server@it2000.com.cn
|
|||
|
|
PASSWD = Gzzn1234
|
|||
|
|
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
|
|||
|
|
freeipa:
|
|||
|
|
add user forgejo/forgejopass for bind
|
|||
|
|
|
|||
|
|
|
|||
|
|
To add FreeIPA LDAP as an authentication source in Forgejo, follow these steps:
|
|||
|
|
|
|||
|
|
## Prerequisites
|
|||
|
|
|
|||
|
|
1. **FreeIPA Server**: Ensure you have a FreeIPA server set up and running.
|
|||
|
|
2. **Forgejo Installation**: Have Forgejo installed and accessible.
|
|||
|
|
|
|||
|
|
## Configuration Steps
|
|||
|
|
|
|||
|
|
### 1. Create a Bind Account in FreeIPA
|
|||
|
|
|
|||
|
|
- **Create a gitea.ldif file** on the FreeIPA server, replacing `dc=example,dc=com` with your DN, and provide an appropriately secure password:
|
|||
|
|
|
|||
|
|
```ldif
|
|||
|
|
dn: uid=gitea,cn=sysaccounts,cn=etc,dc=example,dc=com
|
|||
|
|
changetype: add
|
|||
|
|
objectclass: account
|
|||
|
|
objectclass: simplesecurityobject
|
|||
|
|
uid: gitea
|
|||
|
|
userPassword: secure password
|
|||
|
|
passwordExpirationTime: 20380119031407Z
|
|||
|
|
nsIdleTimeout: 0
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
- **Import the LDIF** (change localhost to an IPA server if needed). Provide the Directory Manager password when prompted:
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
ldapmodify -h localhost -p 389 -x -D "cn=Directory Manager" -W -f gitea.ldif
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
- **Add an IPA group for gitea_users**:
|
|||
|
|
|
|||
|
|
```bash
|
|||
|
|
ipa group-add --desc="Gitea Users" gitea_users
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
### 2. Configure Forgejo
|
|||
|
|
|
|||
|
|
- **Log in to Forgejo as an Administrator** and navigate to Admin Panel > Authentication.
|
|||
|
|
- **Click on "Add New Source"** and select "LDAP (via BindDN)".
|
|||
|
|
- **Fill in the following fields**, changing all where appropriate:
|
|||
|
|
|
|||
|
|
- **Authorization Name**: FreeIPA
|
|||
|
|
- **Host**: `ldap://<your-freeipa-server>`
|
|||
|
|
- **Port**: 389
|
|||
|
|
- **Bind DN**: `uid=gitea,cn=sysaccounts,cn=etc,dc=example,dc=com`
|
|||
|
|
- **Bind Password**: secure password
|
|||
|
|
- **User Search Base**: `ou=Users,dc=example,dc=com`
|
|||
|
|
- **User Filter**: `(&(objectClass=posixAccount)(uid=%s))`
|
|||
|
|
- **Admin Filter**: `(memberOf=cn=gitea_users,cn=groups,cn=accounts,dc=example,dc=com)`
|
|||
|
|
- **Username Attribute**: uid
|
|||
|
|
- **First Name Attribute**: givenName
|
|||
|
|
- **Surname Attribute**: sn
|
|||
|
|
- **Email Attribute**: mail
|
|||
|
|
|
|||
|
|
- **Save the changes** and test the authentication by logging out and trying to log in with a FreeIPA user account.
|
|||
|
|
|
|||
|
|
By following these steps, you can successfully integrate FreeIPA LDAP as an authentication source in Forgejo, allowing users to log in with their FreeIPA credentials.
|
|||
|
|
|
|||
|
|
Citations:
|
|||
|
|
[1] https://www.reddit.com/r/FreeIPA/comments/1ax8te1/can_i_use_an_existing_ldap_server_as_a_source_of/
|
|||
|
|
[2] https://github.com/freeipa/freeipa
|
|||
|
|
[3] https://freeipa.readthedocs.io/en/latest/designs/external-idp/external-idp.html
|
|||
|
|
[4] https://fossies.org/linux/forgejo/docs/content/usage/authentication.en-us.md
|
|||
|
|
[5] https://forgejo.org/docs/latest/admin/config-cheat-sheet/
|
|||
|
|
[6] https://huijzer.xyz/posts/forgejo-setup/
|
|||
|
|
[7] https://forum.yunohost.org/t/how-to-authenticate-to-foregjo-over-https/25444
|
|||
|
|
[8] https://forgejo.org/docs/latest/admin/email-setup/
|