From f7d86e3bb2a436628d832fbba585640b85c7d81a Mon Sep 17 00:00:00 2001
From: Anton Afanasyeu <a.afanasieff@gmail.com>
Date: Wed, 10 Jun 2026 21:40:19 +0200
Subject: [PATCH] gitea sync

---
 .../backend/scripts/gitea/README.md           | 95 +++++++++++++++++++
 1 file changed, 95 insertions(+)

diff --git a/examples/crash_reporter/backend/scripts/gitea/README.md b/examples/crash_reporter/backend/scripts/gitea/README.md
index 132051f..e6ea2c1 100644
--- a/examples/crash_reporter/backend/scripts/gitea/README.md
+++ b/examples/crash_reporter/backend/scripts/gitea/README.md
@@ -106,6 +106,101 @@ GITEA_OWNER='foxx' GITEA_REPO='android_cast' \
 
 Ongoing sync: Gitea pull mirror or cron `gitea admin repo-sync-mirrors`.
 
+## Allow local git mirror (`git://10.7.0.10/...`)
+
+Gitea blocks private/local hosts by default (SSRF protection). For a LAN git daemon:
+
+Edit the **live** config (often `/var/lib/gitea/custom/conf/app.ini`, not only `/etc/gitea/app.ini`):
+
+```ini
+[migrations]
+ALLOW_LOCALNETWORKS = true
+ALLOWED_DOMAINS = *,github.com,*.github.com,chromium.googlesource.com,git.zx2c4.com
+BLOCKED_DOMAINS =
+```
+
+Notes:
+
+- Section name is **`[migrations]`** (plural) — `[migration]` is ignored.
+- `10.7.0.10` is a private IP → **`ALLOW_LOCALNETWORKS = true`** is required.
+- On some Gitea versions an empty `ALLOWED_DOMAINS` still blocks UI mirrors; use **`*`** if needed.
+- Tighter allowlist (optional): `ALLOWED_DOMAINS = 10.7.0.10` plus `ALLOW_LOCALNETWORKS = true`.
+
+Restart Gitea, then re-sync the mirror:
+
+```bash
+sudo rc-service gitea restart
+```
+
+In UI: repo → **Settings → Mirror settings** → set interval (e.g. `10m`) → **Sync now**.
+
+CLI (as `gitea` user):
+
+```bash
+sudo -u gitea gitea -c /var/lib/gitea/custom/conf/app.ini admin repo-sync-mirrors
+```
+
+Ensure BE can reach the git daemon:
+
+```bash
+git ls-remote git://10.7.0.10/android_cast HEAD
+```
+
+Optional faster default interval for all mirrors:
+
+```ini
+[repository]
+DEFAULT_MIRROR_INTERVAL = 10m
+MIRROR_UPDATE_INTERVAL = 10m
+```
+
+## Submodule mirrors (libvpx, opus, speex, …)
+
+Gitea does not “nest” submodules inside one repo — each submodule is its **own mirrored repo**, and `.gitmodules` in `android_cast` points at those Gitea URLs.
+
+**1. Allow upstream hosts** in `app.ini` (see `[migrations]` block above — includes GitHub, googlesource, zx2c4).
+
+**2. Run on BE (as root):**
+
+```bash
+cd /path/to/android_cast
+chmod +x examples/crash_reporter/backend/scripts/gitea/*.sh
+
+# From bundled list (libvpx, opus, speex, wireguard-android):
+sudo ./examples/crash_reporter/backend/scripts/gitea/gitea_mirror_submodules.sh
+
+# Or parse live .gitmodules from a checkout:
+sudo ./examples/crash_reporter/backend/scripts/gitea/gitea_mirror_submodules.sh \
+  /var/www/.../android_cast/.gitmodules
+```
+
+Creates pull mirrors under `admin/libvpx`, `admin/opus`, etc., and prints a **`.gitmodules` snippet** with Gitea URLs.
+
+**3. Commit snippet on canonical git** (`git://10.7.0.10/android_cast`), not on Gitea directly if `android_cast` is a read-only pull mirror:
+
+```ini
+[submodule "third-party/opus"]
+	path = third-party/opus
+	url = https://apps.f0xx.org/app/androidcast_project/git/admin/opus.git
+```
+
+**4. Add local submodules** — edit `submodules.defaults.conf` or pass a custom list:
+
+```text
+# repo|upstream_url|submodule_path
+mylib|git://10.7.0.10/mylib|third-party/mylib
+```
+
+```bash
+GITEA_SUBMODULES_CONF=/root/my-submodules.list sudo ./gitea_mirror_submodules.sh
+```
+
+**5. Sync all mirrors periodically:**
+
+```bash
+sudo -u gitea gitea -c /var/lib/gitea/custom/conf/app.ini admin repo-sync-mirrors
+```
+
 ## Verify
 
 ```bash