aios/ops/gitops-migration/install_gitea_binary_gitops.sh

#!/usr/bin/env bash
set -euo pipefail

ROOT="/data/aios-gitops"
WORKSPACE="$ROOT/workspace"
GITEA_HOME="$ROOT/runtime/gitea-bin"
GITEA_BIN="$ROOT/runtime/bin/gitea"
GITEA_VERSION="1.22.6"
GITEA_URL="https://dl.gitea.com/gitea/${GITEA_VERSION}/gitea-${GITEA_VERSION}-linux-amd64"
SECRETS="$ROOT/runtime/secrets"
LOG="$ROOT/logs/gitea-binary-install.log"

mkdir -p "$ROOT/logs" "$SECRETS" "$ROOT/runtime/bin" "$GITEA_HOME/custom/conf" "$GITEA_HOME/data" "$GITEA_HOME/log" "$WORKSPACE/deploy/gitea-binary"
exec > >(tee -a "$LOG") 2>&1

cd "$WORKSPACE"

echo "== write tracked deployment manifests =="
cat > deploy/gitea-binary/app.ini.template <<'EOF'
APP_NAME = AIOS GitOps
RUN_USER = aiman
WORK_PATH = /data/aios-gitops/runtime/gitea-bin

[server]
PROTOCOL = http
HTTP_ADDR = 127.0.0.1
HTTP_PORT = 3000
DOMAIN = cnnetmkt.top
ROOT_URL = https://cnnetmkt.top/git/
SERVE_FROM_SUB_PATH = true
DISABLE_SSH = true
OFFLINE_MODE = false

[database]
DB_TYPE = sqlite3
PATH = /data/aios-gitops/runtime/gitea-bin/data/gitea.db

[repository]
ROOT = /data/aios-gitops/runtime/gitea-bin/data/repositories
DEFAULT_BRANCH = main

[security]
INSTALL_LOCK = true
SECRET_KEY = __SECRET_KEY__
INTERNAL_TOKEN = __INTERNAL_TOKEN__

[service]
DISABLE_REGISTRATION = true
REQUIRE_SIGNIN_VIEW = false

[webhook]
ALLOWED_HOST_LIST = *

[log]
MODE = console
LEVEL = Info
ROOT_PATH = /data/aios-gitops/runtime/gitea-bin/log
EOF

cat > deploy/gitea-binary/aios-gitea.service <<EOF
[Unit]
Description=AIOS GitOps Gitea
After=network.target

[Service]
Type=simple
User=aiman
Group=aiman
WorkingDirectory=$GITEA_HOME
ExecStart=$GITEA_BIN web --config $GITEA_HOME/custom/conf/app.ini
Restart=always
RestartSec=3
Environment=USER=aiman
Environment=HOME=/home/aiman

[Install]
WantedBy=multi-user.target
EOF

git add deploy/gitea-binary/app.ini.template deploy/gitea-binary/aios-gitea.service
git commit -m "chore(gitops): add binary Gitea deployment manifests" || true

echo "== download gitea binary =="
if [ ! -x "$GITEA_BIN" ]; then
  tmp="$GITEA_BIN.tmp"
  curl -fL --retry 3 --connect-timeout 20 -o "$tmp" "$GITEA_URL"
  chmod 755 "$tmp"
  mv "$tmp" "$GITEA_BIN"
fi
"$GITEA_BIN" --version

echo "== render runtime app.ini =="
secret_key_file="$SECRETS/gitea-secret-key"
internal_token_file="$SECRETS/gitea-internal-token"
admin_pass_file="$SECRETS/gitea-admin-password"
api_token_file="$SECRETS/gitea-api-token"
for f in "$secret_key_file" "$internal_token_file" "$admin_pass_file"; do
  if [ ! -s "$f" ]; then
    openssl rand -hex 32 > "$f"
    chmod 600 "$f"
  fi
done
sed \
  -e "s#__SECRET_KEY__#$(cat "$secret_key_file")#g" \
  -e "s#__INTERNAL_TOKEN__#$(cat "$internal_token_file")#g" \
  deploy/gitea-binary/app.ini.template > "$GITEA_HOME/custom/conf/app.ini"
chmod 600 "$GITEA_HOME/custom/conf/app.ini"
sudo chown -R aiman:aiman "$ROOT/runtime" "$WORKSPACE/deploy/gitea-binary"

echo "== install systemd service =="
sudo cp deploy/gitea-binary/aios-gitea.service /etc/systemd/system/aios-gitea.service
sudo systemctl daemon-reload
sudo systemctl enable --now aios-gitea.service

echo "== wait gitea =="
for i in $(seq 1 90); do
  if curl -fsS http://127.0.0.1:3000/git/api/healthz >/dev/null 2>&1 || curl -fsS http://127.0.0.1:3000/git/ >/dev/null 2>&1; then
    break
  fi
  sleep 2
done
systemctl is-active aios-gitea.service
curl -fsS http://127.0.0.1:3000/git/api/healthz || true
echo

echo "== create admin user and repo =="
admin_user="aios"
admin_email="gitops-bot@cnnetmkt.top"
admin_pass="$(cat "$admin_pass_file")"
"$GITEA_BIN" admin user create \
  --config "$GITEA_HOME/custom/conf/app.ini" \
  --username "$admin_user" \
  --password "$admin_pass" \
  --email "$admin_email" \
  --admin \
  --must-change-password=false 2>/dev/null || true

if [ ! -s "$api_token_file" ]; then
  "$GITEA_BIN" admin user generate-access-token \
    --config "$GITEA_HOME/custom/conf/app.ini" \
    --username "$admin_user" \
    --token-name aios-gitops-push \
    --scopes write:repository,read:repository,write:user,read:user \
    | awk '/Access token was successfully created/ {print $NF}' > "$api_token_file.tmp" || true
  if [ -s "$api_token_file.tmp" ]; then
    mv "$api_token_file.tmp" "$api_token_file"
    chmod 600 "$api_token_file"
  else
    rm -f "$api_token_file.tmp"
  fi
fi

repo_api="http://127.0.0.1:3000/git/api/v1/user/repos"
if ! curl -fsS -u "$admin_user:$admin_pass" "http://127.0.0.1:3000/git/api/v1/repos/$admin_user/aios-v23" >/dev/null 2>&1; then
  curl -fsS -u "$admin_user:$admin_pass" \
    -H "Content-Type: application/json" \
    -d '{"name":"aios-v23","description":"AIOS V1R1C0 online GitOps baseline","private":false,"auto_init":false,"default_branch":"main"}' \
    "$repo_api" >/dev/null
fi

echo "== push repository =="
push_url="http://${admin_user}:${admin_pass}@127.0.0.1:3000/git/${admin_user}/aios-v23.git"
git push "$push_url" main
git push "$push_url" --tags
git remote remove origin 2>/dev/null || true
git remote add origin "https://cnnetmkt.top/git/${admin_user}/aios-v23.git"

echo "== verify gitea repo =="
curl -fsS "http://127.0.0.1:3000/git/${admin_user}/aios-v23" | grep -E "aios-v23|AIOS" | head -20 || true
git status --short
git log --oneline -8
git remote -v

echo "GITEA_BINARY_INSTALL_OK version=$GITEA_VERSION url=https://cnnetmkt.top/git/${admin_user}/aios-v23"