FreeBSD - Run Your Gitea Server In Jails

Our Model Of Self-hosting

ghostware.jpg

Some people prefer the comfort of SaaS.
They like the initial simplicity of the cloud.

But some of us value to own our data.

To run a self-hosted Gitea is a solution.
It's lightweight, and it's easy to deploy.

Your data is your responsibility - on your own hardware.

This whisper's high-level-plan is simple: every service gets its own FreeBSD jail:

  1. PostgreSQL database for storage. Jail #1.
  2. Nginx webserver for TLS and performance. Jail #2.
  3. Gitea server. Jail #3.

Three jails. Three IP addresses. Compartmentalized model.

 Browser
   |
  TLS (self signed or Let's Encrypt)
   |
  Nginx
   |
  Gitea
   |
PostgreSQL

PostgreSQL

You must have a PostgreSQL server. In a FreeBSD jail.
It must be configured to accept remote connections.
If it's missing - install it first.

https://docs.gitea.com/installation/database-prep/#postgresql

Create the Gitea user:

CREATE ROLE gitea WITH LOGIN PASSWORD '<secure_password>';

Choose a strong password for your database user.

Create database with UTF-8 charset and owned by the database user created earlier.

CREATE DATABASE giteadb WITH OWNER gitea TEMPLATE template0 ENCODING UTF8 LC_COLLATE 'en_US.UTF-8' LC_CTYPE 'en_US.UTF-8';

Choose the locales for your system.

Configure PostgreSQL to listen on the required LAN address and permit the Gitea jail's IP address in pg_hba.conf.

Nginx

You must have a well-configured Nginx server in another FreeBSD jail.
Self-signed certificates - Gitea must generate them in the Gitea jail.

Configure nginx.conf to read and include files from conf.d.

In the nginx.conf add:

include conf.d/*.conf;

Set up the /usr/local/etc/nginx/conf.d/gitea.conf for HTTPS connection:

server {
  listen 443 ssl;
  http2 on;
  server_name git.yourdomain.tld;

  ssl_certificate     /usr/local/etc/nginx/conf.d/gitea_cert.pem;
  ssl_certificate_key /usr/local/etc/nginx/conf.d/gitea_key.pem;

  client_max_body_size 512M;

  access_log /var/log/nginx/gitea_access.log;
  error_log  /var/log/nginx/gitea_error.log warn;

  location / {
    proxy_read_timeout 300;
    proxy_send_timeout 300;

    proxy_pass http://10.10.1.12:3000;              # Gitea server jail IP address
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }
}

Gitea

Install Gitea with pkg in your Gitea jail:

pkg install gitea

Generate the necessary secret keys:

gitea generate secret INTERNAL_TOKEN
gitea generate secret JWT_SECRET
gitea generate secret SECRET_KEY

Add them to /usr/local/etc/gitea/conf/app.ini.

Set up the [database] part to handle PostgreSQL:

[database]
DB_TYPE  = postgres
HOST     = 10.10.1.11:5432
NAME     = giteadb
USER     = gitea
PASSWD   = <secure_password>
SSL_MODE = require

You can configure Gitea for your requirements now.

If you opt for a self-signed certificate, generate it with Gitea:

su - git
gitea cert --host git.yourdomain.tld

Use your domain name in the --host option.

Move the generated certificate files to the Nginx jail:

/usr/local/etc/nginx/conf.d/gitea_cert.pem;
/usr/local/etc/nginx/conf.d/gitea_key.pem;

Enable the service and start it:

sysrc gitea_enable="YES"
service gitea start

Final Whisper

Gitea is the excellent tool to handle your source and text data.
It runs silently, compartmentalized and preferable secured in your FreeBSD jails.

The system is silent. The data is yours.

DeadSwitch | The Silent Architect
[ Fear the Silence. Fear the Switch. ]