1
2
3
4
5
6
7
8
9

系统：CentOS 7.9 x64

数据库：Mysql 5.7.39

Web服务：Nginx 1.20.2

Git服务：Git 2.38.1

Linux管理面板：宝塔7.9.6

1

adduser gitea

1

passwd gitea

1

vi /etc/sudoers

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243

## Sudoers allows particular users to run various commands as

## the root user, without needing the root password.

##

## Examples are provided at the bottom of the file for collections

## of related commands, which can then be delegated out to particular

## users or groups.

## 

## This file must be edited with the 'visudo' command.



## Host Aliases

## Groups of machines. You may prefer to use hostnames (perhaps using 

## wildcards for entire domains) or IP addresses instead.

# Host_Alias     FILESERVERS = fs1, fs2

# Host_Alias     MAILSERVERS = smtp, smtp2



## User Aliases

## These aren't often necessary, as you can use regular groups

## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 

## rather than USERALIAS

# User_Alias ADMINS = jsmith, mikem





## Command Aliases

## These are groups of related commands...



## Networking

# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool



## Installation and management of software

# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum



## Services

# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig, /usr/bin/systemctl start, /usr/bin/systemctl stop, /usr/bin/systemctl reload, /usr/bin/systemctl restart, /usr/bin/systemctl status, /usr/bin/systemctl enable, /usr/bin/systemctl disable



## Updating the locate database

# Cmnd_Alias LOCATE = /usr/bin/updatedb



## Storage

# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount



## Delegating permissions

# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 



## Processes

# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall



## Drivers

# Cmnd_Alias DRIVERS = /sbin/modprobe



# Defaults specification



#

# Refuse to run if unable to disable echo on the tty.

#

Defaults   !visiblepw



#

# Preserving HOME has security implications since many programs

# use it when searching for configuration files. Note that HOME

# is already set when the the env_reset option is enabled, so

# this option is only effective for configurations where either

# env_reset is disabled or HOME is present in the env_keep list.

#

Defaults    always_set_home

Defaults    match_group_by_gid



# Prior to version 1.8.15, groups listed in sudoers that were not

# found in the system group database were passed to the group

# plugin, if any. Starting with 1.8.15, only groups of the form

# %:group are resolved via the group plugin by default.

# We enable always_query_group_plugin to restore old behavior.

# Disable this option for new behavior.

Defaults    always_query_group_plugin



Defaults    env_reset

Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE KDEDIR LS_COLORS"

Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"

Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"

Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"

Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"



#

# Adding HOME to env_keep may enable a user to run unrestricted

# commands via sudo.

#

# Defaults   env_keep += "HOME"



Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin



## Next comes the main part: which users can run what software on 

## which machines (the sudoers file can be shared between multiple

## systems).

## Syntax:

##

## 	user	MACHINE=COMMANDS

##

## The COMMANDS section may have other options added to it.

##

## Allow root to run any commands anywhere 

root	ALL=(ALL)	ALL

gitea	ALL=(ALL)	ALL



## Allows members of the 'sys' group to run networking, software, 

## service management apps and more.

# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS



## Allows people in group wheel to run all commands

%wheel	ALL=(ALL)	ALL



## Same thing without a password

# %wheel	ALL=(ALL)	NOPASSWD: ALL



## Allows members of the users group to mount and unmount the 

## cdrom as root

# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom



## Allows members of the users group to shutdown this system

# %users  localhost=/sbin/shutdown -h now



## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)

#includedir /etc/sudoers.d

lighthouse ALL=(ALL) NOPASSWD: ALL

1

wget -O gitea https://dl.gitea.io/gitea/1.17.3/gitea-1.17.3-linux-amd64

1

chmod +x gitea

1

./gitea web

1

sudo vim /etc/systemd/system/gitea.service

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171

[Unit]

Description=Gitea (Git with a cup of tea)

After=syslog.target

After=network.target

###

# Don't forget to add the database service dependencies

###

#

#Wants=mysql.service

#After=mysql.service

#

#Wants=mariadb.service

#After=mariadb.service

#

#Wants=postgresql.service

#After=postgresql.service

#

#Wants=memcached.service

#After=memcached.service

#

#Wants=redis.service

#After=redis.service

#

###

# If using socket activation for main http/s

###

#

#After=gitea.main.socket

#Requires=gitea.main.socket

#

###

# (You can also provide gitea an http fallback and/or ssh socket too)

#

# An example of /etc/systemd/system/gitea.main.socket

###

##

## [Unit]

## Description=Gitea Web Socket

## PartOf=gitea.service

##

## [Socket]

## Service=gitea.service

## ListenStream=<some_port>

## NoDelay=true

##

## [Install]

## WantedBy=sockets.target

##

###



[Service]

# Uncomment the next line if you have repos with lots of files and get a HTTP 500 error because of that

# LimitNOFILE=524288:524288

RestartSec=2s

Type=simple

User=git

Group=git

WorkingDirectory=/var/lib/gitea/

# If using Unix socket: tells systemd to create the /run/gitea folder, which will contain the gitea.sock file

# (manually creating /run/gitea doesn't work, because it would not persist across reboots)

#RuntimeDirectory=gitea

ExecStart=/usr/local/bin/gitea web --config /etc/gitea/app.ini

Restart=always

Environment=USER=git HOME=/home/git GITEA_WORK_DIR=/var/lib/gitea

# If you install Git to directory prefix other than default PATH (which happens

# for example if you install other versions of Git side-to-side with

# distribution version), uncomment below line and add that prefix to PATH

# Don't forget to place git-lfs binary on the PATH below if you want to enable

# Git LFS support

#Environment=PATH=/path/to/git/bin:/bin:/sbin:/usr/bin:/usr/sbin

# If you want to bind Gitea to a port below 1024, uncomment

# the two values below, or use socket activation to pass Gitea its ports as above

###

#CapabilityBoundingSet=CAP_NET_BIND_SERVICE

#AmbientCapabilities=CAP_NET_BIND_SERVICE

###

# In some cases, when using CapabilityBoundingSet and AmbientCapabilities option, you may want to

# set the following value to false to allow capabilities to be applied on gitea process. The following

# value if set to true sandboxes gitea service and prevent any processes from running with privileges

# in the host user namespace.

###

#PrivateUsers=false

###



[Install]

WantedBy=multi-user.target

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171

[Unit]

Description=Codes (GitHub of rumosky)

After=syslog.target

After=network.target

###

# Don't forget to add the database service dependencies

###

#

#Wants=mysql.service

#After=mysql.service

#

#Wants=mariadb.service

#After=mariadb.service

#

#Wants=postgresql.service

#After=postgresql.service

#

#Wants=memcached.service

#After=memcached.service

#

#Wants=redis.service

#After=redis.service

#

###

# If using socket activation for main http/s

###

#

#After=gitea.main.socket

#Requires=gitea.main.socket

#

###

# (You can also provide gitea an http fallback and/or ssh socket too)

#

# An example of /etc/systemd/system/gitea.main.socket

###

##

## [Unit]

## Description=Gitea Web Socket

## PartOf=gitea.service

##

## [Socket]

## Service=gitea.service

## ListenStream=<some_port>

## NoDelay=true

##

## [Install]

## WantedBy=sockets.target

##

###



[Service]

# Uncomment the next line if you have repos with lots of files and get a HTTP 500 error because of that

# LimitNOFILE=524288:524288

RestartSec=2s

Type=simple

User=gitea

Group=gitea

WorkingDirectory=/home/gitea/

# If using Unix socket: tells systemd to create the /run/gitea folder, which will contain the gitea.sock file

# (manually creating /run/gitea doesn't work, because it would not persist across reboots)

#RuntimeDirectory=gitea

ExecStart=/home/gitea/gitea web --config /home/gitea/custom/conf/app.ini

Restart=always

Environment=USER=gitea HOME=/home/gitea/ GITEA_WORK_DIR=/home/gitea/

# If you install Git to directory prefix other than default PATH (which happens

# for example if you install other versions of Git side-to-side with

# distribution version), uncomment below line and add that prefix to PATH

# Don't forget to place git-lfs binary on the PATH below if you want to enable

# Git LFS support

#Environment=PATH=/path/to/git/bin:/bin:/sbin:/usr/bin:/usr/sbin

# If you want to bind Gitea to a port below 1024, uncomment

# the two values below, or use socket activation to pass Gitea its ports as above

###

#CapabilityBoundingSet=CAP_NET_BIND_SERVICE

#AmbientCapabilities=CAP_NET_BIND_SERVICE

###

# In some cases, when using CapabilityBoundingSet and AmbientCapabilities option, you may want to

# set the following value to false to allow capabilities to be applied on gitea process. The following

# value if set to true sandboxes gitea service and prevent any processes from running with privileges

# in the host user namespace.

###

#PrivateUsers=false

###



[Install]

WantedBy=multi-user.target

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157

APP_NAME = Codes: GitHub of rumosky

RUN_USER = gitea

RUN_MODE = prod



[database]

DB_TYPE  = mysql

HOST     = 127.0.0.1:3306

NAME     = xxx

USER     = xxx

PASSWD   = xxx

SCHEMA   = 

SSL_MODE = disable

CHARSET  = utf8mb4

PATH     = /home/gitea/data/gitea.db

LOG_SQL  = false



[repository]

ROOT = /home/gitea/data/gitea-repositories



[server]

SSH_DOMAIN       = xxx.com

DOMAIN           = xxx.com

HTTP_PORT        = 3000

ROOT_URL         = https://xxx.com/

DISABLE_SSH      = false

SSH_PORT         = 22

LFS_START_SERVER = true

LFS_JWT_SECRET   = ******

OFFLINE_MODE     = false



[lfs]

PATH = /home/gitea/data/lfs



[mailer]

ENABLED = true

HOST    = ***.com:port

FROM    = ***@example.com

USER    = ***@example.com

PASSWD  = xxx



[service]

REGISTER_EMAIL_CONFIRM            = true

ENABLE_NOTIFY_MAIL                = true

DISABLE_REGISTRATION              = true

ALLOW_ONLY_EXTERNAL_REGISTRATION  = false

ENABLE_CAPTCHA                    = false

REQUIRE_SIGNIN_VIEW               = false

DEFAULT_KEEP_EMAIL_PRIVATE        = false

DEFAULT_ALLOW_CREATE_ORGANIZATION = false

DEFAULT_ENABLE_TIMETRACKING       = true

NO_REPLY_ADDRESS                  = noreply.example.com



[picture]

DISABLE_GRAVATAR        = true

ENABLE_FEDERATED_AVATAR = false



[openid]

ENABLE_OPENID_SIGNIN = false

ENABLE_OPENID_SIGNUP = false



[session]

PROVIDER = file



[log]

MODE      = console

LEVEL     = info

ROOT_PATH = /home/gitea/log

ROUTER    = console



[repository.pull-request]

DEFAULT_MERGE_STYLE = merge



[repository.signing]

DEFAULT_TRUST_MODEL = committer



[security]

INSTALL_LOCK       = true

INTERNAL_TOKEN     = *****

PASSWORD_HASH_ALGO = pbkdf2

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

location / {

        proxy_pass http://127.0.0.1:3000;

        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;

    }

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165

server

{

    listen 80;

    listen 443 ssl http2;

    listen [::]:443 ssl http2;

    listen [::]:80;

    server_name example.com;

    index index.php index.html index.htm default.php default.htm default.html;

    root /www/wwwroot/example.com;

    

    location / {

        proxy_pass http://127.0.0.1:3000;

        proxy_set_header Host $host;

        proxy_set_header X-Real-IP $remote_addr;

        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_set_header X-Forwarded-Proto $scheme;

    }



    #SSL-START SSL相关配置，请勿删除或修改下一行带注释的404规则

    #error_page 404/404.html;

    #HTTP_TO_HTTPS_START

    if ($server_port !~ 443){

        rewrite ^(/.*)$ https://$host$1 permanent;

    }

    #HTTP_TO_HTTPS_END

    ssl_certificate    /www/server/panel/vhost/cert/example.com/fullchain.pem;

    ssl_certificate_key    /www/server/panel/vhost/cert/example.com/privkey.pem;

    ssl_protocols TLSv1.1 TLSv1.2 TLSv1.3;

    ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;

    ssl_prefer_server_ciphers on;

    ssl_session_cache shared:SSL:10m;

    ssl_session_timeout 10m;

    add_header Strict-Transport-Security "max-age=31536000";

    error_page 497  https://$host$request_uri;

    #SSL-END



    #ERROR-PAGE-START  错误页配置，可以注释、删除或修改

    #error_page 404 /404.html;

    #error_page 502 /502.html;

    #ERROR-PAGE-END



    #PHP-INFO-START  PHP引用配置，可以注释或修改

    include enable-php-00.conf;

    #PHP-INFO-END



    #REWRITE-START URL重写规则引用,修改后将导致面板设置的伪静态规则失效

    include /www/server/panel/vhost/rewrite/git.rumosky.com.conf;

    #REWRITE-END



    #禁止访问的文件或目录

    location ~ ^/(\.user.ini|\.htaccess|\.git|\.env|\.svn|\.project|LICENSE|README.md)

    {

        return 404;

    }



    #一键申请SSL证书验证目录相关设置

    location ~ \.well-known{

        allow all;

    }



    #禁止在证书验证目录放入敏感文件

    if ( $uri ~ "^/\.well-known/.*\.(php|jsp|py|js|css|lua|ts|go|zip|tar\.gz|rar|7z|sql|bak)$" ) {

        return 403;

    }



    location ~ .*\.(gif|jpg|jpeg|png|bmp|swf)$

    {

        proxy_pass http://127.0.0.1:3000;

        expires      30d;

        error_log /dev/null;

        access_log /dev/null;

    }



    location ~ .*\.(js|css)?$

    {

        proxy_pass http://127.0.0.1:3000;

        expires      12h;

        error_log /dev/null;

        access_log /dev/null;

    }

    access_log  /www/wwwlogs/example.com.log;

    error_log  /www/wwwlogs/example.com.error.log;

}

1

sudo systemctl enable gitea

1

sudo systemctl start gitea

1

sudo systemctl stop gitea.service

1

sudo systemctl daemon-reload

1

sudo systemctl status gitea.service

1
2
3
4
5
6
7
8
9

● gitea.service - Codes (GitHub of rumosky)

   Loaded: loaded (/etc/systemd/system/gitea.service; enabled; vendor preset: disabled)

   Active: activating (auto-restart) (Result: exit-code) since Tue 2022-11-29 09:28:36 CST; 149ms ago

  Process: 21386 ExecStart=/home/gitea/gitea web (code=exited, status=1/FAILURE)

 Main PID: 21386 (code=exited, status=1/FAILURE)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

● gitea.service - Codes (GitHub of rumosky)

   Loaded: loaded (/etc/systemd/system/gitea.service; enabled; vendor preset: disabled)

   Active: active (running) since Tue 2022-11-29 10:16:56 CST; 2s ago

 Main PID: 10117 (gitea)

    Tasks: 8

   Memory: 126.9M

   CGroup: /system.slice/gitea.service

           └─10117 /home/gitea/gitea web --config /home/gitea/custom/conf/app.ini

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

[program:gitea]

directory=/home/gitea/

command=/home/gitea/gitea web

autostart=true

autorestart=true

startsecs=10

stdout_logfile=/home/gitea/log/supervisor/gitea.out.log

stdout_logfile_maxbytes=1MB

stdout_logfile_backups=10

stdout_capture_maxbytes=1MB

stderr_logfile=/home/gitea/log/supervisor/gitea.err.log

stderr_logfile_maxbytes=1MB

stderr_logfile_backups=10

stderr_capture_maxbytes=1MB

user = gitea

environment = HOME="/home/gitea", USER="gitea"

1

sudo systemctl enable supervisor

1

sudo systemctl start supervisor

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

[log]

LEVEL=debug

MODE=console,file

ROUTER=console,file

XORM=console,file

ENABLE_XORM_LOG=true

FILE_NAME=gitea.log

[log.file.router]

FILE_NAME=router.log

[log.file.xorm]

FILE_NAME=xorm.log