docs(us2): gitea-health runbook + 收口 Gitea 文档漂移 (Plane VPS-94)
- runbooks/gitea-health.md 新建: 只读健康检查(容器/版本pin/web/SSH/备份/内存闸门)+ AGENTS 与索引登记 - AGENTS.md: Gitea upstream 段(digest 升级流程/app.ini 600 含密钥)、SSH 示例改 git@、runbook 表加行 - inventory/hosts.md + hosts/us2: repo.windy.me SSH 用户改 git@; us2 角色行 Gitea 化 - hosts/us2: 仓库数修正 16→17(windy/13 含 vps、go-caatsm + cdia/4); Verified 补 2026-09-19 独立审核结果 - 本仓库 remote 已改写为 ssh://git@repo.windy.me:2222/windy/vps.git(VPS-94 Phase 3 漏项)
This commit is contained in:
windyboy
@@ -15,6 +15,7 @@ runbooks start from [`_template.md`](_template.md).
|
||||
| Vaultwarden SQLite→PG migrate | [vaultwarden-sqlite-to-postgres.md](vaultwarden-sqlite-to-postgres.md) | change (destructive) |
|
||||
| PowerDNS health check | [pdns-health.md](pdns-health.md) | read-only |
|
||||
| RustDesk health check | [rustdesk-health.md](rustdesk-health.md) | read-only |
|
||||
| Gitea health check | [gitea-health.md](gitea-health.md) | read-only |
|
||||
| Matrix health check | [matrix-health.md](matrix-health.md) | read-only |
|
||||
| Plane health check | [plane-health.md](plane-health.md) | read-only |
|
||||
| pgdb health check | [pgdb-health.md](pgdb-health.md) | read-only |
|
||||
|
||||
@@ -0,0 +1,123 @@
|
||||
# Gitea health (us2)
|
||||
|
||||
## Purpose
|
||||
|
||||
Read-only health check of the `/opt/gitea` stack: web UI, git SSH, backup
|
||||
sidecar, and resource headroom.
|
||||
|
||||
## Scope
|
||||
|
||||
- Applicable: [us2.wsvc.info](../hosts/us2.wsvc.info.md), `/opt/gitea`.
|
||||
- Read-only: does not change Gitea configuration or service state.
|
||||
- Not applicable: Traefik-wide issues (see hosts/us2 notes); Soft Serve
|
||||
rollback (see the rollback section of hosts/us2.wsvc.info.md).
|
||||
|
||||
## Ownership
|
||||
|
||||
- Owner: personal ops (Windy)
|
||||
- Last reviewed: 2026-09-19
|
||||
- Related systems: us2.wsvc.info, Traefik (`vw-net`), repo.windy.me DNS
|
||||
|
||||
Facts: [hosts/us2.wsvc.info.md](../hosts/us2.wsvc.info.md). Reference
|
||||
compose mirror: [compose/gitea/](../compose/gitea/) (server files win).
|
||||
|
||||
## Focused SSH diagnostics
|
||||
|
||||
From the agent shell use `ssh -F /dev/null -4 windy@us2.wsvc.info`.
|
||||
|
||||
### Containers
|
||||
|
||||
```bash
|
||||
ssh -F /dev/null -4 windy@us2.wsvc.info 'cd /opt/gitea && docker compose ps -a'
|
||||
```
|
||||
|
||||
Expect `gitea` and `gitea-backup` both `Up`. `soft-serve*` containers are
|
||||
intentionally `Exited` (rollback retention, keep as-is).
|
||||
|
||||
### Version / image pin
|
||||
|
||||
```bash
|
||||
ssh -F /dev/null -4 windy@us2.wsvc.info \
|
||||
'docker exec gitea /usr/local/bin/gitea --version; grep "^ *image:" /opt/gitea/compose.yml'
|
||||
```
|
||||
|
||||
Expect `gitea version 1.27.3` and the digest pin
|
||||
`gitea/gitea@sha256:1c17ecaead42…` (full digest in compose.yml). If upstream
|
||||
has a newer 1.27.x patch with security fixes, plan an upgrade — do not
|
||||
auto-pull `latest`.
|
||||
|
||||
### Web UI (from laptop / WSL)
|
||||
|
||||
```bash
|
||||
curl -4sI https://repo.windy.me/ | head -3 # expect HTTP/2 200
|
||||
echo | openssl s_client -connect repo.windy.me:443 -servername repo.windy.me 2>/dev/null \
|
||||
| openssl x509 -noout -dates # expect LE cert not expired
|
||||
```
|
||||
|
||||
### Git SSH (the critical check)
|
||||
|
||||
```bash
|
||||
ssh -F /dev/null -o BatchMode=yes -p 2222 git@repo.windy.me 2>&1 | head -2
|
||||
```
|
||||
|
||||
Expect `Hi there, windy! You've successfully authenticated …` and no shell.
|
||||
Login user **must be `git@`** (`windy@` fails: publickey denied). Clone URLs
|
||||
need the owner segment: `ssh://git@repo.windy.me:2222/windy/<repo>.git`.
|
||||
The host key is the reused Soft Serve ed25519 key (fingerprint prefix
|
||||
`SHA256:PdxZRe74…`) — a changed fingerprint means someone rotated it.
|
||||
|
||||
### Registration / hardening (server-side, definitive)
|
||||
|
||||
```bash
|
||||
ssh -F /dev/null -4 windy@us2.wsvc.info \
|
||||
'grep -E "DISABLE_REGISTRATION|INSTALL_LOCK" /opt/gitea/config/app.ini; stat -c "%a %U" /opt/gitea/config/app.ini'
|
||||
```
|
||||
|
||||
Expect `DISABLE_REGISTRATION = true`, `INSTALL_LOCK = true`, file mode `600`.
|
||||
|
||||
### Backup freshness
|
||||
|
||||
```bash
|
||||
ssh -F /dev/null -4 windy@us2.wsvc.info 'tail -4 /opt/gitea/backups/backup.log; ls -lt /opt/gitea/backups/ | head -4'
|
||||
```
|
||||
|
||||
Expect a `Backup OK` line from today's 02:00 run (products include
|
||||
`app.ini.tar.gz`, `gitea.db`, `repos.tar.gz`) and ≤ 14 retained sets. A
|
||||
backup set older than ~25h with no log error means cron silently died —
|
||||
investigate before proceeding.
|
||||
|
||||
### Logs and memory gate
|
||||
|
||||
```bash
|
||||
ssh -F /dev/null -4 windy@us2.wsvc.info \
|
||||
'docker logs gitea --since 24h 2>&1 | grep -iE "error|panic" | tail -5; free -m | head -2'
|
||||
```
|
||||
|
||||
Expect no recurring errors (single SSH auth-failure warnings from the
|
||||
Traefik proxy IP are background noise) and `available` ≥ 150 MB
|
||||
(VPS-94 memory gate; gitea idles ~400 MB RSS).
|
||||
|
||||
## Safety
|
||||
|
||||
- Read-only: never mutate configuration or service state during this check.
|
||||
- If live state conflicts with an expected value (wrong digest, HTTPS
|
||||
non-200, stale backup, registration enabled, `available` < 150 MB),
|
||||
`STOP` and report per repo rules.
|
||||
|
||||
## After config changes
|
||||
|
||||
`/opt/gitea` has no Ansible coverage yet. Reviewed changes
|
||||
(compose edit, digest bump) are applied manually and verified:
|
||||
|
||||
```bash
|
||||
ssh -F /dev/null -4 windy@us2.wsvc.info 'cd /opt/gitea && docker compose up -d && docker compose ps'
|
||||
```
|
||||
|
||||
Then re-run the diagnostics above. Keep [compose/gitea/](../compose/gitea/)
|
||||
in sync (reference copy, server files win).
|
||||
|
||||
## References
|
||||
|
||||
- [hosts/us2.wsvc.info.md](../hosts/us2.wsvc.info.md) — deployment facts, rollback path
|
||||
- Plane `vps` project VPS-94 — migration plan, acceptance checks, audit record
|
||||
- Upstream: https://docs.gitea.com/ (self-hosted admin/config docs)
|
||||
Reference in New Issue
Block a user