| Age | Commit message (Collapse) | Author |
|---|
|
- authelia/: Full Authelia stack (docker-compose, config, setup guide, nginx snippet)
- Forward-auth for Netdata, Cockpit, Nexus, registry
- OIDC provider for Jenkins (oic-auth plugin, authorization_policy: one_factor)
- HTTP header auth for Gerrit (X-Forwarded-User on /login/ only)
- authelia_network: 172.26.0.0/16
- nginx/nginx.conf:
- auth.swave.lol server block
- /_authelia-auth internal subrequest locations (resolver 127.0.0.11)
- auth_request on Gerrit /login/, Jenkins, Nexus, registry
- OIDC finishLogin bypass for Jenkins
- swave.lol/gerrit and swave.lol/jenkins redirect to subdomains
- proxy_redirect for Gerrit container hostname rewrites
- nginx/docker-compose.yaml: joined authelia_network
- nginx/run_certbot.sh: added auth.swave.lol
- jenkins/docker-compose.yaml: removed --prefix=/jenkins (Jenkins now at /)
- cockpit/nginx-authelia.conf, netdata/nginx-netdata.conf: added auth_request
- git-server/gerrit.config.example: Gerrit config template (real config gitignored)
- .gitignore: added users_database.yml, gerrit.config
- CLAUDE.md: updated Jenkins, Gerrit, Authelia entries; added key files
- doc/setup-guide.md: Authelia section, updated startup order and service table
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
|
|
Define subnet 172.23.0.0/16 for jenkins_network with static IPs:
jenkins (172.23.0.2), git-server (172.23.0.3), gerrit (172.23.0.4).
This allows git-server to communicate directly with Jenkins for
build triggers and webhook integrations.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Gerrit joins git-network (repo access) and jenkins_network (build triggers),
uses the official gerritcodereview/gerrit image with persistent storage under
/var/gerrit, and is reverse-proxied via nginx at gerrit.swave.lol and
swave.lol/gerrit. Updated certbot, setup guide, and project docs accordingly.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Without virtual-root, cgit generates incorrect URLs that duplicate
the repository name in the path.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
|
|
Cgit was generating links to /cgit.css which, when accessed via
swave.lol/cgit, routed to Ghost instead of the cgit container.
Set css/logo paths to /cgit-css/ in cgitrc and add a /cgit-css/
proxy location in the main nginx config.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Adds a lightweight cgit container (Alpine + fcgiwrap + nginx) that
auto-discovers bare repos via scan-path and serves them read-only.
Accessible at both cgit.swave.lol and swave.lol/cgit through the
main nginx reverse proxy.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
adduser --disabled-password sets password field to '!' in /etc/shadow,
which OpenSSH 10.0 treats as a locked account, rejecting all logins
including pubkey auth. Setting password to '*' via usermod marks the
account as "no password login" without locking it, allowing SSH
key authentication to work.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
OpenSSH rejects login for users whose shell is not listed
in /etc/shells. Without this, SSH key auth fails with
"Permission denied" even with a valid key.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
- Remove hardcoded password for git user (chpasswd line)
- Fix comment: ubuntu -> debian
- Fix volume path: /var/git -> /var/git/repos to match host layout
- Remove deprecated compose version field
- start.sh: check for .pub files directly instead of any file in keys/
- start.sh: always set repos ownership/permissions, not only when
directory is non-empty (fixes fresh start with empty repos dir)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
|
Add Docker configurations for Ghost, Git server, and Nginx services
with documentation and architecture diagrams.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
