cluster0: lab seeds, Gitea mirrors, compose mail, verify tooling

Freeze lab-seeds backend for COMPOSE_SKIP_MONOLITH; fix Gitea mirror scripts for 1.25 API; add secrets.lab.env template, verify-mail-lab, LAB_PUBLIC_ORIGIN, and credentials pointers for mirror token recovery. Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-29 02:57:38 +03:00 · 2026-06-23 17:07:46 +02:00
parent 98f30786b7
commit c554dc761d
209 changed files with 31249 additions and 6 deletions
--- a/sim/cluster0/gitea/README.md
+++ b/sim/cluster0/gitea/README.md
@@ -0,0 +1,65 @@
+# Gitea on cluster0 (cast01 primary)
+
+Browse UI (after FE `ac-fe.conf` + DNS):  
+`https://acl0.f0xx.org/app/androidcast_project/git/`
+
+Direct on cast01 (debug): `http://127.0.0.1:3000/` (nginx public path strips `/app/.../git/`).
+
+## This step (basic config only)
+
+- Prod `app.ini` layout copied and adapted in `app.ini.template`
+- Paths under `/var/lib/gitea` (repos, LFS, logs)
+- SQLite DB at `/var/lib/gitea/gitea.db` (`GITEA_DB_TYPE=sqlite3` in `cluster.env`; optional `mysql` for prod-like)
+- Nginx on cast01 proxies `/app/androidcast_project/git/` → `127.0.0.1:3000`
+- **No** repo mirrors / org migration yet — run later via scripts under  
+  `lab-seeds/backend/scripts/gitea/` (same as prod BE)
+
+## Deploy
+
+```bash
+# On cast01 after populate app phase (or standalone):
+sudo sh /shared/cluster/scripts/deploy-gitea.sh
+sudo sh /shared/cluster/scripts/configure-nginx.sh
+sudo rc-service gitea status
+curl -sS -o /dev/null -w 'gitea_direct=%{http_code}\n' http://127.0.0.1:3000/
+curl -sS -o /dev/null -w 'gitea_nginx=%{http_code}\n' \
+  http://127.0.0.1/app/androidcast_project/git/
+```
+
+Enable in `cluster.env`: `GITEA_ENABLE=1` (set by default in tree).
+
+## Lab admin login
+
+| Field | Value |
+|-------|--------|
+| User | `admin` (override `GITEA_ADMIN_USER`) |
+| Password | `[gitea_admin]` in `credentials.txt` (falls back to mariadb_app password) |
+
+Create org **AndroidCast** in UI before mirror scripts, or run `gitea_migrate_org_setup.sh` later.
+
+## Later: mirror `ac/*` repos
+
+When ready (not part of this step):
+
+```bash
+sudo sh /shared/cluster/scripts/mirror-gitea-ac-org.sh
+```
+
+Uses `gitea/ac-repos.list` and `lab-seeds/backend/scripts/gitea/*` (API pull mirrors, org **ac**).
+
+**Lab status (cluster0):** all mirrors in `gitea/ac-repos.list` — run `sudo sh /shared/cluster/scripts/verify-gitea-mirrors.sh` on cast01.
+
+See `lab-seeds/backend/scripts/gitea/README.md` for full mirror/protect flows.
+
+## Integration map
+
+| Layer | Config |
+|-------|--------|
+| cast01 BE nginx | `nginx/apps-port80.conf` → `:3000` |
+| Gentoo FE lab vhost | `ac-platform-edge/fe/ac-fe.conf` → `cast01:80` (git via BE nginx) |
+| Git server (canonical) | `git://f0xx.org/ac/*` — unchanged; Gitea is browse mirror only |
+
+Secrets generated once in `/var/lib/gitea/.lab-secrets.env` on cast01 (not in git).  
+Mirror API token: `/var/lib/gitea/.mirror-admin-token` — recovery in `ac-docs/docs/SECRETS_AND_RECOVERY.md`.
+
+**Note:** first start after fresh DB can take **30–90s** (SQLite schema migration). `deploy-gitea.sh` waits up to 6 minutes.
--- a/sim/cluster0/gitea/ac-repos.list
+++ b/sim/cluster0/gitea/ac-repos.list
@@ -0,0 +1,36 @@
+# Gitea pull mirrors — org ac (git://f0xx.org/ac/*). One repo name per line.
+# Legacy monolith (read-only reference):
+android_cast|git://f0xx.org/android_cast
+ac-be-access
+ac-be-auth
+ac-be-builder
+ac-be-graphs
+ac-be-hub
+ac-be-issues
+ac-be-remote-access
+ac-be-tickets
+ac-deploy
+ac-docs
+ac-mobile-android
+ac-mobile-ios
+ac-ms-build
+ac-ms-devices
+ac-ms-graphs
+ac-ms-identity
+ac-ms-issues
+ac-ms-media-transcode
+ac-ms-notifications
+ac-ms-ota
+ac-ms-rbac
+ac-ms-remote-access
+ac-ms-sfu-signaling
+ac-ms-template
+ac-ms-tickets
+ac-ms-url-shortener
+ac-platform-db
+ac-platform-edge
+ac-platform-php
+ac-platform-web
+ac-scripts
+ac-session-studio
+ac-workspace
--- a/sim/cluster0/gitea/app.ini.template
+++ b/sim/cluster0/gitea/app.ini.template
@@ -0,0 +1,84 @@
+# Lab Gitea — rendered by deploy-gitea.sh → /etc/gitea/app.ini
+# Based on prod artc0 layout; paths and URLs adjusted for cluster0 (acl0.f0xx.org).
+# Repo migration (mirrors) is a separate step — see gitea/README.md.
+
+RUN_USER = gitea
+RUN_MODE = prod
+APP_NAME = AndroidCast lab (cluster0)
+WORK_PATH = @GITEA_APP_DATA@
+
+[repository]
+ROOT = @GITEA_APP_DATA@/data/gitea-repositories
+DEFAULT_MIRROR_INTERVAL = 10m
+MIRROR_UPDATE_INTERVAL = 10m
+
+[server]
+LFS_START_SERVER = true
+PROTOCOL = http
+DOMAIN = @GITEA_DOMAIN@
+ROOT_URL = @GITEA_ROOT_URL@
+HTTP_ADDR = 127.0.0.1
+HTTP_PORT = @GITEA_HTTP_PORT@
+APP_DATA_PATH = @GITEA_APP_DATA@
+STATIC_ROOT_PATH = /usr/share/webapps/gitea
+DISABLE_SSH = true
+OFFLINE_MODE = true
+LFS_JWT_SECRET = @GITEA_LFS_JWT@
+
+[database]
+DB_TYPE = sqlite3
+PATH = @GITEA_APP_DATA@/gitea.db
+LOG_SQL = false
+
+[session]
+PROVIDER = file
+
+[log]
+ROOT_PATH = /var/log/gitea
+MODE = file
+LEVEL = info
+
+[lfs]
+PATH = @GITEA_APP_DATA@/lfs
+
+[mailer]
+ENABLED = false
+
+[service]
+REGISTER_EMAIL_CONFIRM = false
+ENABLE_NOTIFY_MAIL = false
+DISABLE_REGISTRATION = true
+ALLOW_ONLY_EXTERNAL_REGISTRATION = false
+ENABLE_CAPTCHA = false
+REQUIRE_SIGNIN_VIEW = false
+DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+
+[security]
+INSTALL_LOCK = true
+INTERNAL_TOKEN = @GITEA_INTERNAL_TOKEN@
+PASSWORD_HASH_ALGO = pbkdf2
+
+[oauth2]
+JWT_SECRET = @GITEA_OAUTH_JWT@
+
+[migrations]
+ALLOW_LOCALNETWORKS = true
+ALLOWED_DOMAINS = *,github.com,*.github.com,chromium.googlesource.com,git.zx2c4.com,f0xx.org,*.f0xx.org
+BLOCKED_DOMAINS =
+
+[mirror]
+MIN_INTERVAL = 1m
+
+[cron.update_mirrors]
+ENABLED = true
+SCHEDULE = @every 10m
+RUN_AT_START = true
+
+[actions]
+ENABLED = false
+
+[cron.update_checker]
+ENABLED = false
+
+[indexer]
+ISSUE_INDEXER_TYPE = db