forgejo_installation_process/README.md

# Note

We use 
```
https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo
```
instead of the vanilla forgejo. The reason is that our data hungry research discipines need git-annex ( https://git-annex.branchable.com/ ). 

forgejo-aneksajo is always a bit behind the main. However, the want to be part of the vanilla forgejo. I hope they will be able to do that. This would be nice for us because then we don't need to compile the source code ourselfs. :-) 


# Firewall

```
ufw allow 80
ufw allow 443
ufw allow 11080
ufw allow 22
ufw enable
```

# Package installation

```
add-apt-repository ppa:git-core/ppa
apt update
apt upgrade

apt -y install mc net-tools nginx micro mariadb-server mariadb-client git git-lfs make curl lynx git-annex
```

# SSH Port

We need to change the ssh port. We need it for git.


```
micro /etc/ssh/sshd_config
```

Replace

```
#Port 22
```
with
```
Port 11080
```

Restart service
```
systemctl restart sshd
```

# Maria DB
```
systemctl enable mariadb
mysql_secure_installation
```

* Switch to unix_socket authentication [Y/n] Y
* Change the root password? [Y/n] n
* Remove anonymous users? [Y/n] Y
* Disallow root login remotely? [Y/n] Y
* Remove test database and access to it? [Y/n] Y
* Reload privilege tables now? [Y/n] Y

```
mysql
```

Under mysql:

```
SET old_passwords=0;
CREATE USER 'forgejo'@'%' IDENTIFIED BY '[REDACTED]';
CREATE DATABASE forgejodb CHARACTER SET 'utf8mb4' COLLATE 'utf8mb4_bin';
GRANT ALL PRIVILEGES ON forgejodb.* TO 'forgejo';
FLUSH PRIVILEGES;
exit
```

# Install go lang >= 1.23 

Add the go complier path to the bash rc

```
echo "export PATH=\$PATH:/usr/local/go/bin" >> /root/.bashrc
export PATH=$PATH:/usr/local/go/bin
```

```
cd /root
wget https://go.dev/dl/go1.23.5.linux-amd64.tar.gz
rm -rf /usr/local/go
tar -C /usr/local -xzf go1.23.5.linux-amd64.tar.gz
```

# Install nodejs 22 

```
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
export NVM_DIR="$HOME/.nvm"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"  # This loads nvm
[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"  # This loads nvm bash_completion
nvm install 22
```

## Some checks
```
node -v # Should print "v22.13.0"
nvm current # Should print "v22.13.0"
npm -v # Should print "10.9.2"
```

# Install forgejo-aneksajo (v9.0.3-git-annex0 on the 16.01.2025)

Prepare the user
```
sudo adduser --system --shell /bin/bash --gecos 'Git Version Control' \
  --group --disabled-password --home /home/git git
```

Make the necessary directories
```
mkdir /var/lib/forgejo
chown git:git /var/lib/forgejo
chmod 750 /var/lib/forgejo

mkdir -p /var/lib/forgejo/custom/public/assets
chown -R git:git /var/lib/forgejo/custom
chmod -R 750 /var/lib/forgejo/custom

mkdir /etc/forgejo
chown root:git /etc/forgejo
chmod 770 /etc/forgejo
```

Place the forgejo.service the systemd script to
```
/etc/systemd/system/forgejo.service
```

Compile the software
```
cd /root
https://codeberg.org/forgejo-aneksajo/forgejo-aneksajo.git
cd forgejo-aneksajo
TAGS="bindata timetzdata" make build

cp gitea /usr/local/bin/forgejo
chmod 755 /usr/local/bin/forgejo
setcap CAP_NET_BIND_SERVICE=+eip /usr/local/bin/forgejo
```

```
systemctl enable forgejo.service
systemctl start forgejo.service
```

Check
```
systemctl status forgejo.service
```

# SSL Certifcate

I placed the SSL certificates into /etc/nginx (ca.pem: certifcate bundle, key.pem: private key)

```
cd /etc/nginx
chmod 0400 key.pem
chmod 0444 ca.pem
```

# nginx

```
cd /etc/nginx
mv nginx.conf nginx.conf_old
wget -O/etc/nginx/nginx.conf https://git.neuro.uni-bremen.de/git_rot/forgejo_installation_process/raw/branch/main/etc/nginx/nginx.conf
```

Test if everything is okay:

```
nginx -t
systemctl stop nginx
systemctl start nginx
systemctl enable nginx
systemctl status nginx
```

# Configure forgejo
```
chmod 777 /etc/forgejo
touch /etc/forgejo/app.ini
chmod 777 /etc/forgejo/app.ini
systemctl enable forgejo.service
systemctl start forgejo.service
```

Check the status of forgejo
```
systemctl status forgejo.service
```


go to https://git.neuro.uni-bremen.de

Working on the forgejo config: 

```
systemctl stop forgejo.service
chmod 755 /etc/forgejo
chmod 644 /etc/forgejo/app.ini
```

```
mkdir -p /var/lib/forgejo/uploads
chmod -R 0777 /var/lib/forgejo/uploads
```

```
systemctl stop forgejo.service
```

## app.ini changes (Round 1):

For reference use /etc/forgejo/app.ini in this repo but with ALLOW_ONLY_EXTERNAL_REGISTRATION = false and the secrets from your installation.

```
systemctl restart forgejo.service
systemctl status forgejo.service
```

Anmelden und Admin-User erzeugen.


Now we go to https://git.neuro.uni-bremen.de/admin/auths

Create a new source of authentication

For the moment I am using the itexchange.neuro.uni-bremen.de/sso. Will be changed.

* Type: OAuth2
* Name: UniBremenSSO
* OAuth2-Provide: OpenID Connect
* Client-ID: git
* Client-Secret: [REDACTED]
* OpenID-Connect-Auto-Discovery-URL: https://itexchange.neuro.uni-bremen.de/sso/realms/master/.well-known/openid-configuration

app.ini changes (Round 2):

```
[service]
[...]
ALLOW_ONLY_EXTERNAL_REGISTRATION = true
```

```
mkdir -p /var/lib/forgejo/custom/public/assets/img
```

Put the logos into /var/lib/forgejo/custom/public/assets/img

```
mkdir -p /var/lib/forgejo/custom/templates/user/auth
chmod -R 777 /var/lib/forgejo/custom
```

Put the files custom template files /var/lib/forgejo/custom/templates/

```
systemctl stop forgejo.service
systemctl start forgejo.service
systemctl status forgejo.service
```