9.0.2 (#61)

- Updated to version 9.0.2
-  Improved and simplified download url
-  Applied style guide

Co-authored-by: meaz <meaz@disroot.org>
Reviewed-on: #61
Reviewed-by: meaz <meaz@no-reply@disroot.org>
Co-authored-by: muppeth <muppeth@disroot.org>
Co-committed-by: muppeth <muppeth@disroot.org>

.ansible-lint

@@ -0,0 +1,6 @@
+skip_list:
+  - fqcn-builtins
+  - fqcn[action]
+  - fqcn[action-core]
+  - fqcn[canonical]
+  - name[casing]

Playbooks/forgejo.yml

@@ -1,6 +1,54 @@
 ---
 
-- hosts: forgejo
+- name: 'Create backup directories'
+  hosts: forgejo
+  tasks:
+    - name: '[BACKUP] - Create backup dir'
+      file:
+        path: '{{ forgejo_dump_path }}'
+        state: directory
+        mode: '0775'
+    - name: '[BACKUP] - Create db backup dir'
+      file:
+        path: '{{ forgejo_dump_path }}/db'
+        state: directory
+        mode: '0755'
+    - name: '[BACKUP] - Create code backup dir'
+      file:
+        path: '{{ forgejo_dump_path }}/code'
+        state: directory
+        owner: '{{ forgejo_user }}'
+        mode: '0755'
+
+- name: 'Create db backup for forgejo'
+  hosts: forgejo
+  tasks:
+    - name: '[BACKUP] - Run db backup for forgejo'
+      shell:
+        cmd: 'sudo -u postgres pg_dump {{ forgejo_db_name }} | gzip -c > {{ forgejo_dump_path }}/db/{{ forgejo_db_name }}-{{ ansible_date_time.iso8601_basic_short }}.sql.gz'
+    - name: '[BACKUP] - Remove all but two latest backup files'
+      shell:
+        cmd: 'ls -t |tail -n +3 | xargs --no-run-if-empty rm'
+        chdir: '{{ forgejo_dump_path }}/db'
+  vars_files:
+    - ../defaults/main.yml
+
+- name: 'Make backup of forgejo'
+  hosts: 'forgejo'
+  tasks:
+    - name: '[BACKUP] - Remove all but two latest backup files'
+      shell:
+        cmd: 'ls -t |tail -n +2 | xargs --no-run-if-empty rm'
+        chdir: '{{ forgejo_dump_path }}/code'
+    - name: '[BACKUP] - Make backup of forgejo'
+      shell:
+        cmd: 'sudo -u {{ forgejo_user }} {{ forgejo_bindir }}/forgejo dump -c {{ forgejo_confdir }}'
+        chdir: '{{ forgejo_dump_path}}/code'
+  vars_files:
+    - ../defaults/main.yml
+
+- name: 'Run Forgejo role'
+  hosts: forgejo
   roles:
     - postgresql
     - forgejo
@@ -9,4 +57,4 @@
     - ../defaults/main.yml
 
   vars:
-    - ansible_python_interpreter: "/usr/bin/python3"
+    - ansible_python_interpreter: '/usr/bin/python3'

README.md

@@ -9,6 +9,8 @@ You can deploy test instance using `Vagrantfile` attached to the role.
 
 Then you can then access forgejo from your computer on `http://192.168.33.14:3000`
 
+The first user you create becomes the admin.
+
 # Gitea or Forgejo
 This role allows for deployment of gitea and forgejo. By default the role deploys forgejo and this is the flavor that is supported and maintained. Installing Gitea using the role is possible however starting from version 1.18.2 is no longer maintained by Disroot team.
 To switch to gitea, update following variables in your Playbook/host_vars:
@@ -27,7 +29,7 @@ The playbook includes postgresql role and deploys entire stack needed to run For
 ## Customization
 You can deploy custom themes with this role. To do so, uncomment `forgejo_theme_dir` and `forgejo_custom_themes`  from `defaults/main.yml`. Add the theme repos' address and name there, enable them and then deploy with `ansible-playbook -b Playbooks/forgejo.yml --tags theme`.
 
-You can also add you own images like favicon, icons, etc. See https://docs.gitea.io/en-us/customizing-gitea/ to see how to prepare your images.
+You can also add you own images like favicon, icons, etc. See https://forgejo.org/docs/v1.21/developer/customization/ to see how to prepare your images.
 Then, copy them in the `img` folder of this role and uncomment `forgejo_extra_files_path` and `forgejo_theme_dir` from `defaults/main.yml`. You can then deploy with `ansible-playbook -b Playbooks/forgejo.yml --tags config`.
 
-For more information about customizaton, check https://docs.gitea.io/en-us/customizing-gitea/.
+For more information about customizaton, check https://forgejo.org/docs/v1.21/developer/customization/

Vagrantfile

@@ -8,7 +8,7 @@
 Vagrant.configure("2") do |config|
   #config.ssh.insert_key = false
   config.vm.define "forgejo" do |forgejo|
-    forgejo.vm.box = "generic/debian11"
+    forgejo.vm.box = "generic/debian12"
     forgejo.vm.provider :libvirt do |libvirt|
       libvirt.memory = 256
     end

defaults/main.yml

@@ -5,21 +5,22 @@ forgejo_lib_dir: "/var/lib/forgejo"
 forgejo_user: 'git'
 forgejo_group: 'git'
 forgejo_confdir: '/etc/forgejo/app.ini'
-
+forgejo_dump_path: '/srv/forgejo-dump'
 forgejo_flavor: 'forgejo'
-forgejo_version: '1.20.4-1'
+forgejo_version: '9.0.2'
 forgejo_arch: 'linux-amd64'
-#forgejo_download_url: 'https://github.com/go-gitea/gitea/releases/download/v{{ forgejo_version }}/gitea-{{ forgejo_version }}-{{ forgejo_arch }}'
+forgejo_download_url: 'https://codeberg.org/forgejo/forgejo/releases/download/v{{ forgejo_version }}/forgejo-{{ forgejo_version }}-{{ forgejo_arch }}'
 
 # Uncomment below if you want to add custom themes or images
-#forgejo_extra_files_path: '../img' # the folder name where you have the images you want to deploy
+# forgejo_extra_files_path: '../img' # the folder name where you have the images you want to deploy
 forgejo_theme_dir: '{{ forgejo_lib_dir }}/custom'
-#forgejo_custom_themes:
-#  - name: '' #add name of the theme
-#    repo: '' #add git repository of the theme
-#    enable: 'true' #set it to false to remove it
+# forgejo_custom_themes:
+#  - name: '' # add name of the theme
+#    repo: '' # add git repository of the theme
+#    version: '' # add git branch
+#    enable: 'true' # set it to false to remove it
 
-#[CONFIG]
+# [CONFIG]
 # App.ini file variables
 forgejo_base_config:
   - 'APP_NAME = Forgejo: Beyond coding. We forge.'
@@ -28,16 +29,22 @@ forgejo_base_config:
   - 'WORK_PATH = {{ forgejo_lib_dir }}'
 
 forgejo_oauth2_config:
-  - 'JWT_SECRET = ' #41 random chars
+  - 'JWT_SECRET = ' # 41 random chars
+
+forgejo_oauth2_client_config:
+  - 'ENABLE_AUTO_REGISTRATION = false'
+  - 'REGISTER_EMAIL_CONFIRM = false'
+  - 'ACCOUNT_LINKING = login'
+  - 'UPDATE_AVATAR = false'
 
 forgejo_ui_config:
-  - 'THEMES = auto,arc-green,gitea,forgejo-auto,forgejo-light,forgejo-dark' # add only the default ones, not themes ones
-  - 'DEFAULT_THEME = arc-green'
+  - 'THEMES = gitea-auto,gitea-light,gitea-dark,forgejo-auto,forgejo-light,forgejo-dark' # add only the default ones, not themes ones
+  - 'DEFAULT_THEME = gitea-dark'
 
 forgejo_security_config:
-  - 'INTERNAL_TOKEN = ' #106 random chars
+  - 'INTERNAL_TOKEN = ' # 106 random chars
   - 'INSTALL_LOCK   = true'
-  - 'SECRET_KEY     = ' #64 random chars
+  - 'SECRET_KEY     = ' # 64 random chars
 
 forgejo_database_config:
   - 'DB_TYPE  = postgres'
@@ -48,7 +55,7 @@ forgejo_database_config:
   - 'SSL_MODE = disable'
 
 forgejo_repository_config:
-  - 'ROOT = /home/git/forgejo-repositories'
+  - 'ROOT = {{ forgejo_lib_dir }}/gitea-repositories'
 
 forgejo_server_config:
   - 'SSH_DOMAIN       = git.example.org'
@@ -58,12 +65,12 @@ forgejo_server_config:
   - 'DISABLE_SSH      = false'
   - 'SSH_PORT         = 22'
   - 'LFS_START_SERVER = true'
-  - 'LFS_JWT_SECRET   = ' #40 random chars
+  - 'LFS_JWT_SECRET   = ' # 40 random chars
   - 'OFFLINE_MODE     = false'
   - 'APP_DATA_PATH    = {{ forgejo_lib_dir }}/data/'
 
-forgejo_lfs_config: 
-  - 'PATH = /home/git/data/lfs' 
+forgejo_lfs_config:
+  - 'PATH = /home/git/data/lfs'
 
 forgejo_mailer_config:
   - 'ENABLED        = true'
@@ -71,7 +78,7 @@ forgejo_mailer_config:
   - 'SMTP_PORT      = 587'
   - 'FROM           = noreply@example.org'
   - 'USER           = noreply@example.org'
-  - 'PASSWD         = CHANGEME' #PASSWD
+  - 'PASSWD         = CHANGEME' # PASSWORD
   - 'PROTOCOL       = smtp+starttls'
 
 forgejo_service_config:
@@ -132,34 +139,43 @@ forgejo_email_incoming:
   - 'DELETE_HANDLED_MESSAGE = true'
   - 'MAXIMUM_MESSAGE_SIZE = 0'
 
-#apt
+
+# Systemd
+# forgejo_dbservice: 'postgresql.service' # uncomment to enable this. You can cnange to mysql, mariadb, redis, memcached
+# forgejo_websocket: 'true' # uncomment to enable this
+# forgejo_limitnofile: '524288:524288' # Uncomment if you have repos with lots of files and get a HTTP 500 error because of that
+# forgejo_custom_path: 'Environment=PATH={{ forgejo_custom_path }}:/bin:/sbin:/usr/bin:/usr/sbin' # Uncomment if you install Git to directory prefix other than default PATH and add that prefix to PATH
+# forgejo_cap_net_bind_service: 'CAP_NET_BIND_SERVICE' # Uncomment if you want to bind Forgejo to a port below 1024, or use socket activation to pass Forgejo its ports as above
+# forgejo_privateusers: 'false' #  Uncomment, when using forgejo_cap_net_bind_service option, to allow capabilities to be applied on Forgejo process. If set to true sandboxes Forgejo service and prevent any processes from running with privileges in the host user namespace
+
+# apt
 forgejo_apt_list:
   - git
 
 # POSTGRES
-postgresql_version: 13
+postgresql_version: 15
 postgresql_listen_addresses:
-    - "127.0.0.1"
+  - "127.0.0.1"
 
 postgresql_pg_hba_default:
-    - { type: local, database: all, user: '{{ postgresql_admin_user }}', address: '', method: '{{ postgresql_default_auth_method }}', comment: '' }
-    - { type: local, database: all, user: all, address: '',             method: '{{ postgresql_default_auth_method }}', comment: '"local" is for Unix domain     socket           connections only' }
-    - { type: host,  database: all, user: all, address: '127.0.0.1/32', method: '{{ postgresql_default_auth_method_hosts }}', comment: 'IPv4 local connections:' }
+  - { type: local, database: all, user: '{{ postgresql_admin_user }}', address: '', method: '{{ postgresql_default_auth_method }}', comment: ''}
+  - { type: local, database: all, user: all, address: '', method: '{{ postgresql_default_auth_method }}', comment: '"local" is for Unix domain socket connections only'}
+  - { type: host, database: all, user: all, address: '127.0.0.1/32', method: '{{ postgresql_default_auth_method_hosts }}', comment: 'IPv4 local connections:'}
 
 postgresql_databases:
-    - name: forgejo
-      owner: admin          # optional; specify the owner of the database
-      hstore: no         # flag to install the hstore extension on this database (yes/no)
-      uuid_ossp: no      # flag to install the uuid-ossp extension on this database (yes/no)
-      citext: no         # flag to install the citext extension on this database (yes/no)
+  - name: 'forgejo'
+    owner: 'admin'          # optional; specify the owner of the database
+    hstore: 'no'         # flag to install the hstore extension on this database (yes/no)
+    uuid_ossp: 'no'      # flag to install the uuid-ossp extension on this database (yes/no)
+    citext: 'no'         # flag to install the citext extension on this database (yes/no)
 
 postgresql_users:
-    - name: admin
-      pass: changeme
-      encrypted: yes       # denotes if the password is already encrypted.
+  - name: 'admin'
+    pass: 'changeme'
+    encrypted: 'yes'       # denotes if the password is already encrypted.
 
 postgresql_user_privileges:
-    - name: admin                   # user name
-      db: forgejo              # database
-      priv: "ALL"                 # privilege string format: example: INSERT,UPDATE/table:SELECT/anothertable:ALL
-      role_attr_flags: "" # role attribute flags
+  - name: 'admin'                   # user name
+    db: 'forgejo'              # database
+    priv: 'ALL'                 # privilege string format: example: INSERT,UPDATE/table:SELECT/anothertable:ALL
+    role_attr_flags: '' # role attribute flags

handlers/main.yml

@@ -2,5 +2,10 @@
 
 - name: 'Restart forgejo'
   systemd:
-    name: forgejo
-    state: restarted
+    name: 'forgejo'
+    state: 'restarted'
+
+- name: 'Stop forgejo'
+  systemd:
+    name: 'forgejo'
+    state: 'stopped'

tasks/configure.yml

@@ -3,26 +3,26 @@
 - name: '[DIR] - Create bin dir'
   file:
     path: '{{ forgejo_bindir }}'
-    state: directory
-    owner: "{{ forgejo_user }}"
-    group: "{{ forgejo_group }}"
+    state: 'directory'
+    owner: '{{ forgejo_user }}'
+    group: '{{ forgejo_group }}'
     mode: '0750'
 
 - name: '[DIR] - Create lib dir'
   file:
     path: '{{ forgejo_lib_dir }}'
-    state: directory
+    state: 'directory'
     mode: '0750'
-    owner: "{{ forgejo_user }}"
-    group: "{{ forgejo_group }}"
+    owner: '{{ forgejo_user }}'
+    group: '{{ forgejo_group }}'
 
 - name: '[DIR] - Create lib dirs'
   file:
-    path: "{{ forgejo_lib_dir }}/{{ item }}"
-    state: directory
+    path: '{{ forgejo_lib_dir }}/{{ item }}'
+    state: 'directory'
     mode: '0750'
-    owner: "{{ forgejo_user }}"
-    group: "{{ forgejo_group }}"
+    owner: '{{ forgejo_user }}'
+    group: '{{ forgejo_group }}'
   with_items:
     - 'custom'
     - 'data'
@@ -30,44 +30,62 @@
 
 - name: '[DIR] - Create etc dir'
   file:
-    path: /etc/forgejo
-    state: directory
+    path: '/etc/forgejo'
+    state: 'directory'
     mode: '0770'
-    owner: "{{ forgejo_user }}" 
-    group: "{{ forgejo_group }}"
+    owner: '{{ forgejo_user }}'
+    group: '{{ forgejo_group }}'
 
 - name: '[CONF] - Deploy forgejo config'
   template:
-    src: etc/forgejo/app.ini.j2
-    dest: "{{ forgejo_confdir }}"
-    owner: "{{ forgejo_user }}"
-    group: "{{ forgejo_group }}"
-  notify: Restart forgejo
-  tags: config
+    src: 'etc/forgejo/app.ini.j2'
+    dest: '{{ forgejo_confdir }}'
+    owner: '{{ forgejo_user }}'
+    group: '{{ forgejo_group }}'
+    mode: '0744'
+  notify:
+    - 'Restart forgejo'
+  tags:
+    - 'config'
 
-- name: "[CONF] - Create img folder"
+- name: '[CONF] - Create assets dir'
   file:
-    path: "{{ forgejo_theme_dir }}/public/img/"
+    path: '{{ forgejo_theme_dir }}/public/assets/'
     state: 'directory'
     owner: '{{ forgejo_user }}'
     group: '{{ forgejo_group }}'
+    mode: '0744'
   when: forgejo_extra_files_path is defined
-  tags: config
+  tags:
+    - 'config'
 
-- name: "[CONF] - Deploy img folder"
+- name: '[CONF] - Create img folder'
+  file:
+    path: '{{ forgejo_theme_dir }}/public/assets/img/'
+    state: 'directory'
+    owner: '{{ forgejo_user }}'
+    group: '{{ forgejo_group }}'
+    mode: '0744'
+  when: forgejo_extra_files_path is defined
+  tags:
+    - 'config'
+
+- name: '[CONF] - Deploy img folder'
   copy:
     src: '{{ forgejo_extra_files_path }}/'
-    dest: "{{ forgejo_theme_dir }}/public/img/"
-    owner: "{{ forgejo_user }}"
-    group: "{{ forgejo_group }}"
-    mode: 0755
+    dest: '{{ forgejo_theme_dir }}/public/assets/img/'
+    owner: '{{ forgejo_user }}'
+    group: '{{ forgejo_group }}'
+    mode: '0744'
   when: forgejo_extra_files_path is defined
-  tags: config
+  tags:
+    - 'config'
 
 - name: '[CONF] - Install dependencies for renderers'
   apt:
-    name: "{{ item.apt }}"
-    update_cache: yes
-  loop: "{{ forgejo_markup_config }}"
-  when: item.enable == 'true' and item.apt != ""
-  tags: config
+    name: '{{ item.apt }}'
+    update_cache: true
+  loop: '{{ forgejo_markup_config }}'
+  when: item.enable == 'true' and item.apt != ''
+  tags:
+    - 'config'

tasks/custom_themes.yml

@@ -1,72 +1,91 @@
 ---
 
-- name: '[THEME] - Create public dir'
-  file:
-    path: '{{ forgejo_theme_dir }}/public/'
-    state: directory
-    owner: "{{ forgejo_user }}"
-    group: "{{ forgejo_group }}"
-  tags: theme
-
 - name: '[THEME] - Create css dir'
   file:
-    path: '{{ forgejo_theme_dir }}/public/css'
-    state: directory
-    owner: "{{ forgejo_user }}"
-    group: "{{ forgejo_group }}"
-  tags: theme
+    path: '{{ forgejo_theme_dir }}/public/assets/css'
+    state: 'directory'
+    owner: '{{ forgejo_user }}'
+    group: '{{ forgejo_group }}'
+    mode: '0744'
+  tags:
+    - 'theme'
 
 # First, remove the css files from public folder, then theme repos
-- name: "[THEME] - Remove css files from the css folder"
-  shell:
-    cmd: find "{{ forgejo_theme_dir }}/{{ item.name }}" -type f -name "*.css" -printf "%f\n" | xargs -I{} rm public/css/{}
-    chdir: "{{ forgejo_theme_dir }}"
-  loop: "{{ forgejo_custom_themes }}"
-  when: item.enable == 'false' 
-  tags: theme
+- name: '[THEME] - Remove css files from the css folder'
+  command:
+    cmd: bash -c 'find "{{ forgejo_theme_dir }}/{{ item.name }}" -type f -name "*.css" -printf "%f\n" | xargs -I{} rm public/assets/css/{}'
+    #  find "{{ forgejo_theme_dir }}/{{ item.name }}" -type f -name "*.css" -printf "%f\n" | xargs -I{} rm public/assets/css/{}
+    chdir: '{{ forgejo_theme_dir }}'
+  loop: '{{ forgejo_custom_themes }}'
+  when: item.enable == 'false'
+  tags:
+    - 'theme'
 
-- name: "[THEME] - Remove theme repo"
+- name: '[THEME] - Remove theme repo'
   file:
-    path:  "{{ forgejo_theme_dir }}/{{ item.name }}"
-    state: absent
-    owner: "{{ forgejo_user }}"
-    group: "{{ forgejo_group }}"
-  loop: "{{ forgejo_custom_themes }}"
-  when: item.enable == 'false' 
-  tags: theme
+    path: '{{ forgejo_theme_dir }}/{{ item.name }}'
+    state: 'absent'
+    owner: '{{ forgejo_user }}'
+    group: '{{ forgejo_group }}'
+  loop: '{{ forgejo_custom_themes }}'
+  when: item.enable == 'false'
+  tags:
+    - 'theme'
 
 # Second, get theme repos and deploy css files in public folder
-- name: "[THEME] - Get repo"
+- name: '[THEME] - Get repo'
   git:
-    repo: "{{ item.repo }}"
-    dest: "{{ forgejo_theme_dir }}/{{ item.name }}"
-    force: yes
-  loop: "{{ forgejo_custom_themes }}"
+    repo: '{{ item.repo }}'
+    dest: '{{ forgejo_theme_dir }}/{{ item.name }}'
+    version: '{{ item.version }}'
+    force: true
+  loop: '{{ forgejo_custom_themes }}'
   when: item.enable == 'true'
   become: true
-  become_user: "{{ forgejo_user }}"
-  tags: theme
+  become_user: '{{ forgejo_user }}'
+  tags:
+    - 'theme'
 
-- name: "[THEME] - Find css files from different repos and copy them in the public folder"
-  shell:
-    cmd: find "{{ forgejo_theme_dir }}" -type f -name "*.css" -not -path "{{ forgejo_theme_dir }}/public/*" | xargs cp -t "{{ forgejo_theme_dir }}/public/css"
-    chdir: "{{ forgejo_theme_dir }}"
+- name: '[THEME] - Find css files from different repos'
+  find:
+    paths: '{{ forgejo_theme_dir }}'
+    patterns: ".*(?<!\\.min)\\.css$"
+    recurse: true
+    use_regex: true
+  register: 'css_files'
+  tags:
+    - 'theme'
+
+- name: '[THEME] - Copy css files to the public folder'
+  copy:
+    src: '{{ item.path }}'
+    dest: '{{ forgejo_theme_dir }}/public/assets/css/'
+    remote_src: true
+    force: true
+    mode: '0644'
+  with_items: '{{ css_files.files }}'
+  when: "'/public/' not in item.path"
   become: true
-  become_user: "{{ forgejo_user }}"
-  tags: theme
+  become_user: '{{ forgejo_user }}'
+  tags:
+    - 'theme'
+
 
 # Lastly, update app.ini by adding the theme's name list.
-- name: "[THEME] - Get and prepare a list for app.ini of css files in public folder, register it"
-  shell:
-    cmd: ls "{{ forgejo_theme_dir }}/public/css" | sed -e 's/theme-//g' | sed -e 's/.css//g' | paste -s -d,
+- name: '[THEME] - Get and prepare a list for app.ini of css files in public folder, register it'
+  command:
+    cmd: bash -c "ls '{{ forgejo_theme_dir }}/public/assets/css' | awk '{ if ($0 ~ /^theme-/) { gsub(/^theme-/, \"\", $0) }; gsub(/.css$/, \"\", $0); print }' | paste -s -d," 
     chdir: "{{ forgejo_theme_dir }}"
-  register: theme_name
-  tags: theme
+  register: 'theme_name'
+  tags:
+    - 'theme'
 
-- name: "[THEME] - Add list of themes in app.ini"
+- name: '[THEME] - Add list of themes in app.ini'
   lineinfile:
-    path: "{{ forgejo_confdir }}"
+    path: '{{ forgejo_confdir }}'
     regexp: '^THEMES'
-    line: "{{ forgejo_ui_config[0] }},{{ theme_name.stdout }}"
-  notify: Restart forgejo
-  tags: theme
+    line: '{{ forgejo_ui_config[0] }},{{ theme_name.stdout }}'
+  notify:
+    - 'Restart forgejo'
+  tags:
+    - 'theme'

tasks/install.yml

@@ -1,37 +0,0 @@
----
-
-- name: '[INSTALL] - Install dependencies'
-  apt:
-    name: "{{ forgejo_apt_list }}"
-    update_cache: yes
-
-- name: '[INSTALL] - Get forgejo download url'
-  shell:
-    cmd: wget -O - https://codeberg.org/forgejo/forgejo/releases | grep -B 1 forgejo-{{ forgejo_version }}-{{ forgejo_arch }}\< | sed -n 's/.*href="\(.*\)".*/\1/p'
-  register: forgejo_url
-  when: forgejo_flavor == 'forgejo'
-
-- name: "[INSTALL] - Set forgejo download url"
-  set_fact:
-    forgejo_download_url: '{{ forgejo_url.stdout }}'
-  when: forgejo_flavor == 'forgejo'
-
-- name: '[INSTALL] - Download forgejo binary'
-  get_url:
-    url: '{{ forgejo_download_url }}'
-    dest: '{{ forgejo_bindir }}/forgejo'
-    mode: '0750'
-    owner: '{{ forgejo_user }}'
-    group: '{{ forgejo_group }}'
-    force: 'yes'
-  notify: 'Restart forgejo'
-
-- name: '[INSTALL] - Set /etc/forgejo rights to read-only'
-  file:
-    path: '/etc/forgejo'
-    mode: '0750'
-
-- name: '[INSTALL] - Set app.ini rights to read-only'
-  file:
-    path: '/etc/forgejo/app.ini'
-    mode: '0640'

tasks/install_upgrade.yml

@@ -0,0 +1,103 @@
+---
+
+- name: '[INSTALL] - Install dependencies'
+  apt:
+    name: '{{ forgejo_apt_list }}'
+    update_cache: true
+
+- name: '[INSTALL] - Check if forgejo is already installed'
+  shell:
+    cmd: '{{ forgejo_bindir }}/forgejo --version -c {{ forgejo_confdir }}'
+  register: 'forgejo_is_installed'
+  ignore_errors: true # needed when forgejo is not yet installed
+
+# The following task is needed for the doctor check task, as `gitea-repositories` needs to exist,
+# but is created only when the first user creates a repo # so doctor gives an error on first installation
+# and on other installation if no user has created any repo yet.
+# It also allows to make sure forgejo was installed and used.
+- name: '[INSTALL] - Check gitea-repositories exists'
+  stat:
+    path: '{{ forgejo_lib_dir }}/gitea-repositories'
+  register: 'gitea_repositories'
+
+- name: '[UPGRADE] - Check forgejo health with doctor before updating'
+  shell:
+    cmd: '{{ forgejo_bindir }}/forgejo doctor check --all -c {{ forgejo_confdir }}'
+  become: true
+  become_user: '{{ forgejo_user }}'
+  register: 'forgejo_health'
+  when:
+    - forgejo_is_installed.rc == 0
+    - gitea_repositories.stat.exists
+
+- name: '[UPGRADE] - Restart forgejo'
+  systemd:
+    name: 'forgejo'
+    state: 'restarted'
+  when:
+    - forgejo_is_installed.rc == 0
+    - forgejo_health is defined and forgejo_health.rc is defined and forgejo_health.rc == 0
+
+- name: '[UPGRADE] - Wait for forgejo to be back online'
+  pause:
+    seconds: 10
+  when:
+    - forgejo_is_installed.rc == 0
+    - forgejo_health is defined and forgejo_health.rc is defined and forgejo_health.rc == 0
+
+- name: '[UPGRADE] - Flush all queues'
+  shell:
+    cmd: '{{ forgejo_bindir }}/forgejo manager flush-queues -c {{ forgejo_confdir }}'
+  become: true
+  become_user: '{{ forgejo_user }}'
+  when:
+    - forgejo_is_installed.rc == 0
+    - forgejo_health is defined and forgejo_health.rc is defined and forgejo_health.rc == 0
+
+- name: '[UPGRADE] - Stop forgejo'
+  systemd:
+    name: 'forgejo'
+    state: 'stopped'
+  when:
+    - forgejo_is_installed.rc == 0
+    - forgejo_health is defined and forgejo_health.rc is defined and forgejo_health.rc == 0
+
+- name: '[INSTALL] - Download forgejo binary'
+  get_url:
+    url: '{{ forgejo_download_url }}'
+    dest: '{{ forgejo_bindir }}/forgejo'
+    mode: '0750'
+    owner: '{{ forgejo_user }}'
+    group: '{{ forgejo_group }}'
+    force: true
+  notify:
+    - 'Restart forgejo'
+
+- name: '[INSTALL] - Set /etc/forgejo rights to read-only'
+  file:
+    path: '/etc/forgejo'
+    mode: '0750'
+
+- name: '[INSTALL] - Set app.ini rights to read-only'
+  file:
+    path: '/etc/forgejo/app.ini'
+    mode: '0640'
+
+- name: '[UPGRADE] - Check forgejo health after upgrading'
+  command:
+    cmd: '{{ forgejo_bindir }}/forgejo doctor check --all -c {{ forgejo_confdir }}'
+  become: true
+  become_user: '{{ forgejo_user }}'
+  register: 'forgejo_health'
+  when:
+    - forgejo_is_installed.rc == 0
+    - gitea_repositories.stat.exists
+
+- name: '[UPGRADE] - Display problem message'
+  fail:
+    msg: 'Forgejo doctor detected issues after upgrade task. Please check the instance manually and fix issues before continuing'
+  when:
+    - forgejo_is_installed.rc == 0
+    - forgejo_health is defined and forgejo_health.rc is defined and forgejo_health.rc != 0
+  notify:
+    - 'Stop forgejo'

tasks/main.yml

@@ -1,19 +1,21 @@
 ---
 
-- name: "[FORGEJO]- Create user"
-  include_tasks: user.yml
+- name: '[FORGEJO]- Create user'
+  include_tasks: 'user.yml'
 
-- name: "[FORGEJO] - configure"
-  include_tasks: configure.yml
-  tags: config
+- name: '[FORGEJO] - configure'
+  include_tasks: 'configure.yml'
+  tags:
+    - 'config'
 
-- name: "[FORGEJO] - install"
-  include_tasks: install.yml
+- name: '[FORGEJO] - install or upgrade'
+  include_tasks: 'install_upgrade.yml'
 
-- name: "[FORGEJO] - theme"
-  include_tasks: custom_themes.yml
-  when: forgejo_custom_themes is defined 
-  tags: theme
+- name: '[FORGEJO] - theme'
+  include_tasks: 'custom_themes.yml'
+  when: forgejo_custom_themes is defined
+  tags:
+    - 'theme'
 
-- name: "[FORGEJO] - systemd"
-  include_tasks: systemd.yml
+- name: '[FORGEJO] - systemd'
+  include_tasks: 'systemd.yml'

tasks/systemd.yml

@@ -2,23 +2,24 @@
 
 - name: '[SYSTEMD] - Deploy Systemd config'
   template:
-    src: etc/systemd/system/forgejo.service.j2
-    dest: /etc/systemd/system/forgejo.service
-    owner: root
-    group: root
-    mode: 0644
-  register: forgejo_systemd
+    src: 'etc/systemd/system/forgejo.service.j2'
+    dest: '/etc/systemd/system/forgejo.service'
+    owner: 'root'
+    group: 'root'
+    mode: '0644'
+  register: 'forgejo_systemd'
 
 - name: '[SYSTEMD] - Enable systemd'
   systemd:
-    name: forgejo
-    enabled: yes
-    state: started
-    daemon_reload: yes
-  notify: Restart forgejo
+    name: 'forgejo'
+    enabled: true
+    state: 'started'
+    daemon_reload: true
+  notify:
+    - 'Restart forgejo'
 
-- name: "[SYSTEMD] - Daemon-reload"
+- name: '[SYSTEMD] - Daemon-reload'
   systemd:
-    daemon_reload: yes
-    name: forgejo
+    daemon_reload: true
+    name: 'forgejo'
   when: forgejo_systemd.changed

tasks/user.yml

@@ -1,12 +1,12 @@
 ---
 
-- name: Add group
+- name: '[User] - Add group'
   group:
     name: '{{ forgejo_group }}'
-    state: present
+    state: 'present'
 
-- name: Add user
+- name: '[User] - Add user'
   user:
     name: '{{ forgejo_user }}'
-    shell: /bin/bash
+    shell: '/bin/bash'
     group: '{{ forgejo_group }}'

templates/etc/forgejo/app.ini.j2

@@ -8,6 +8,11 @@
 {{ item }}
 {% endfor %}
 
+[oauth2_client]
+{% for item in forgejo_oauth2_client_config %}
+{{ item }}
+{% endfor %}
+
 [ui]
 {% for item in forgejo_ui_config %}
 {{ item }}
@@ -65,7 +70,6 @@
 {{ item }}
 {% endfor %}
 
-
 [session]
 {% for item in forgejo_session_config %}
 {{ item }}

templates/etc/systemd/system/forgejo.service.j2

@@ -1,34 +1,97 @@
 [Unit]
-Description=Forgejo (Git with a cup of tea)
+Description=Forgejo (Beyond coding. We forge.)
 After=syslog.target
 After=network.target
-#Requires=mysql.service
-#Requires=mariadb.service
-#Requires=postgresql.service
-#Requires=memcached.service
-#Requires=redis.service
+###
+# Don't forget to add the database service dependencies
+###
+{% if forgejo_dbservice is defined %}
+Wants={{ forgejo_dbservice }}
+After={{ forgejo_dbservice }}
+{% endif %}
+
+###
+# If using socket activation for main http/s
+###
+{% if forgejo_websocket is defined %}
+After=forgejo.main.socket
+Requires=forgejo.main.socket
+
+###
+# (You can also provide forgejo an http fallback and/or ssh socket too)
+#
+# An example of /etc/systemd/system/forgejo.main.socket
+###
+
+[Unit]
+Description=Forgejo Web Socket
+PartOf=forgejo.service
+
+[Socket]
+Service=forgejo.service
+ListenStream=<some_port>
+NoDelay=true
+
+[Install]
+WantedBy=sockets.target
+{% endif %}
+
 
 [Service]
-# Modify these two values and uncomment them if you have
-# repos with lots of files and get an HTTP error 500 because
-# of that
-###
-#LimitMEMLOCK=infinity
-#LimitNOFILE=65535
+# Uncomment the next line if you have repos with lots of files and get a HTTP 500 error because of that
+{% if forgejo_limitnofile is defined %}
+LimitNOFILE={{ forgejo_limitnofile }}
+{% else %}
+# LimitNOFILE=524288:524288
+{% endif %}
 RestartSec=2s
 Type=simple
 User={{ forgejo_user }}
 Group={{ forgejo_group }}
 WorkingDirectory={{ forgejo_lib_dir }}
+# If using Unix socket: tells systemd to create the /run/forgejo folder, which will contain the forgejo.sock file
+# (manually creating /run/forgejo doesn't work, because it would not persist across reboots)
+{% if forgejo_websocket is defined %}
+RuntimeDirectory=forgejo
+{% else %}
+#RuntimeDirectory=forgejo
+{% endif %}
 ExecStart={{ forgejo_bindir }}/forgejo web -c {{ forgejo_confdir }}
 Restart=always
 RestartSec=3
 Environment=USER={{ forgejo_user }} HOME=/home/{{ forgejo_user }} FORGEJO_WORK_DIR={{ forgejo_lib_dir }} FORGEJO_CUSTOM={{ forgejo_theme_dir }}
-# If you want to bind Forgejo to a port below 1024 uncomment
-# the two values below
+# If you install Git to directory prefix other than default PATH (which happens
+# for example if you install other versions of Git side-to-side with
+# distribution version), uncomment below line and add that prefix to PATH
+# Don't forget to place git-lfs binary on the PATH below if you want to enable
+# Git LFS support
+{% if forgejo_custom_path is defined %}
+Environment=PATH={{ forgejo_custom_path }}:/bin:/sbin:/usr/bin:/usr/sbin
+{% else %}
+#Environment=PATH=/path/to/git/bin:/bin:/sbin:/usr/bin:/usr/sbin
+{% endif %}
+# If you want to bind Forgejo to a port below 1024, uncomment
+# the two values below, or use socket activation to pass Forgejo its ports as above
 ###
+{% if forgejo_cap_net_bind_service is defined %}
+CapabilityBoundingSet={{ forgejo_cap_net_bind_service }} 
+AmbientCapabilities={{ forgejo_cap_net_bind_service }} 
+{% else %}
 #CapabilityBoundingSet=CAP_NET_BIND_SERVICE
 #AmbientCapabilities=CAP_NET_BIND_SERVICE
+{% endif %}
+###
+# In some cases, when using CapabilityBoundingSet and AmbientCapabilities option, you may want to
+# set the following value to false to allow capabilities to be applied on Forgejo process. The following
+# value if set to true sandboxes Forgejo service and prevent any processes from running with privileges
+# in the host user namespace.
+###
+{% if forgejo_privateusers is defined %}
+PrivateUsers={{ forgejo_privateusers }}
+{% else %}
+#PrivateUsers=false
+{% endif %}
+###
 
 [Install]
 WantedBy=multi-user.target