bstein/titan-iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gitea: enforce SSH directory modes
Some checks failed
Tests / Declarative: Post Actions failed: 3, passed: 265
Details

Browse Source
This commit is contained in:
jenkins 2026-08-13 20:26:43 -03:00
parent eb3e0ac436
commit 8a7616ea04
1 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
services/gitea/deployment.yaml
View File

@ -228,6 +228,15 @@ spec:
args: args:
- | - |
set -euo pipefail set -euo pipefail
# Keep OpenSSH StrictModes satisfied if another PVC consumer
# changes the shared Git directory permissions.
chmod 0755 /data/git
if [ -d /data/git/.ssh ]; then
chmod 0700 /data/git/.ssh
fi
if [ -f /data/git/.ssh/authorized_keys ]; then
chmod 0600 /data/git/.ssh/authorized_keys
fi
export GITEA__security__SECRET_KEY="$(tr -d '\r\n' </vault/secrets/gitea-secret__SECRET_KEY)" export GITEA__security__SECRET_KEY="$(tr -d '\r\n' </vault/secrets/gitea-secret__SECRET_KEY)"
export GITEA__security__INTERNAL_TOKEN="$(tr -d '\r\n' </vault/secrets/gitea-secret__INTERNAL_TOKEN)" export GITEA__security__INTERNAL_TOKEN="$(tr -d '\r\n' </vault/secrets/gitea-secret__INTERNAL_TOKEN)"
export DB_PASS="$(tr -d '\r\n' </vault/secrets/gitea-db-secret__password)" export DB_PASS="$(tr -d '\r\n' </vault/secrets/gitea-db-secret__password)"