jens/docs-alpha.jayfield.org
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Migrate Gitea from vlda-01 to alpha as a Docker container

Browse Source 
First item off SYNC-PLAN.md's build order. Full migration, not sync:
stopped vlda-01's Gitea container, copied its entire data volume
(SQLite DB, repos, LFS, SSH host keys - ~4GB) directly via a piped ssh
tar stream, brought it up on alpha as a permanent container on the
same web/cloud/portainer pattern (127.0.0.1-only, Apache reverse
proxy, certbot). Remapped file ownership from the source's uid 1000
(which collides with vmail on alpha) to a dedicated 1010:1010. Fixed
Gitea generating http:// clone URLs by adding X-Forwarded-Proto,
same fix cloud.jayfield.org already needed. Verified end-to-end: all
repos present via the API, a real git clone reproduces identical
history, and this repo's own origin now points at git.jayfield.org
with working push access. vlda-01's copy left stopped as a cold
backup, not decommissioned.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
jens
2026-07-26 15:29:20 +02:00
co-authored by Claude Sonnet 5
parent 628f75303e
commit d1902bb277
2 changed files with 63 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+60 -2
View File
@@ -165,12 +165,13 @@ one-off `450 4.7.25 Client host rejected` shows up in `mail.log`.
| `web.jayfield.org` | → redirect to :443 | Reverse-proxies to the **Docker `web` (nginx) container** on `127.0.0.1:8081` | New — see below |
| `cloud.jayfield.org` | → redirect to :443 | Reverse-proxies to the **Docker `nextcloud` container** on `127.0.0.1:8082`, sets `X-Forwarded-Proto: https` | Nextcloud — see below |
| `portainer.jayfield.org` | → redirect to :443 | Reverse-proxies to the **Docker `portainer` container** on `127.0.0.1:9443` over HTTPS (`SSLProxyEngine`/`SSLProxyVerify none` for the loopback hop to Portainer's self-signed cert) | Added 2026-07-20 — see "Portainer" below |
| `git.jayfield.org` | → redirect to :443 | Reverse-proxies to the **Docker `gitea` container** on `127.0.0.1:8083`, sets `X-Forwarded-Proto: https` | Added 2026-07-26 — migrated from `vlda-01`, see "Gitea" below |
| default (`_default_:443`, `000-default` on :80) | Apache's stock placeholder page | — | |
All Let's Encrypt certs (8 total, one per hostname/group) auto-renew via
All Let's Encrypt certs (9 total, one per hostname/group) auto-renew via
`certbot.timer`; verified with `certbot renew --dry-run`.
All 7 domain `:443` blocks send `Strict-Transport-Security: max-age=63072000;
All 8 domain `:443` blocks send `Strict-Transport-Security: max-age=63072000;
includeSubDomains` (`mod_headers`). Deliberately skipped on the
`default-ssl.conf` catch-all — it's the self-signed fallback for unmatched
SNI/Host headers, not a real trusted hostname a browser could pin.
@@ -184,6 +185,7 @@ SNI/Host headers, not a real trusted hostname a browser could pin.
| `nextcloud` | `nextcloud:apache` | `127.0.0.1:8082` (localhost-only) | Nextcloud app (PHP+Apache bundled in the image); backing service for `cloud.jayfield.org` |
| `nextcloud-db` | `mariadb:lts` | internal only (`nextcloud_net`) | Dedicated DB for Nextcloud — kept separate from the host's own MySQL (which only holds `vmail`) |
| `nextcloud-redis` | `redis:alpine` | internal only (`nextcloud_net`) | File locking + distributed cache + PHP session storage for Nextcloud. Dedicated container rather than reusing the host's native `redis-server`, since that instance is bound to `127.0.0.1`/`::1` only with no auth — reusing it would have meant loosening a shared service's network exposure just to save one small container |
| `gitea` | `gitea/gitea:1.27.0` | `127.0.0.1:8083` (localhost-only) | Git hosting, migrated from `vlda-01` 2026-07-26 — see "Gitea" below |
Data persists in the `portainer_data` named volume, independent of the
container itself — updating Portainer means recreating the container
@@ -272,6 +274,62 @@ Internet → Apache :80/:443 (cloud.jayfield.org vhost)
(512M `memory_limit`/`upload_max_filesize`/`post_max_size`, unlimited
`max_execution_time`) — no tuning needed for this pass.
### Gitea (`git.jayfield.org`)
Migrated 2026-07-26 from `vlda-01` (home intranet server) per
`SYNC-PLAN.md`'s build order — first item on that plan, "no open
questions." Full migration, not a sync: `vlda-01`'s Gitea container was
stopped, its entire `/data` volume (SQLite DB, all repos, LFS objects,
host SSH keys) copied straight across via a piped `ssh ... tar | ssh ...
tar` (no intermediate disk, ~4GB), and brought up on alpha as a permanent
container — same `web`/`cloud`/`portainer` pattern (publish to
`127.0.0.1:<port>`, Apache vhost, `certbot --apache`).
```
Internet → Apache :80/:443 (git.jayfield.org vhost)
→ Let's Encrypt TLS termination, X-Forwarded-Proto: https
→ ProxyPass http://127.0.0.1:8083/
→ container "gitea" (gitea/gitea:1.27.0)
→ SQLite DB + repos, bind-mounted at /srv/gitea/data
```
- **Version pinned, not `:latest`**: `gitea/gitea:1.27.0`, matching what
was actually running on `vlda-01` — a version-compatible move first,
upgrading is a separate later decision.
- **Data**: bind-mounted at `/srv/gitea/data` on the host (matching the
`/srv/nextcloud/data` convention — directly inspectable/backupable),
not an opaque named volume.
- **Ownership**: the source data was owned by uid/gid `1000` on
`vlda-01`, but `1000` is already `vmail` on alpha (Dovecot's mailbox
user) — remapped everything to a dedicated `1010:1010` (`chown -R`,
container run with `-e USER_UID=1010 -e USER_GID=1010`) to avoid any
collision with or confusion around the real `vmail` account.
- **SQLite, not the host's MariaDB**: `vlda-01`'s Gitea was already
self-contained SQLite (`DB_TYPE = sqlite3`), so no DB export/import or
extra container was needed — the DB file just came along inside `/data`.
- **`app.ini` updated for the new home**: `DOMAIN`/`SSH_DOMAIN`/`ROOT_URL`
repointed from the old LAN IP (`192.168.22.90`) to `git.jayfield.org`;
`DISABLE_SSH` set to `true` — the existing repo remotes already used
HTTP(S), not `git@.../ssh://`, so git-over-SSH was dropped rather than
opening yet another public port to preserve a mode nothing was actually
using. HTTPS clone/push covers the same ground through the same Apache
TLS termination every other service uses.
- **Reverse-proxy scheme awareness**: without `X-Forwarded-Proto: https`
(added to the vhost, same as `cloud.jayfield.org`), Gitea's API
correctly used `ROOT_URL` for some fields but generated `http://` (not
`https://`) `clone_url`/`html_url` for repos — since the Apache→container
hop itself is plain HTTP and Gitea otherwise has no way to know the
original request arrived over TLS. Fixed and verified via the API.
- **Verified end-to-end**: all previously-existing repos present via the
API (including this `docs-alpha.jayfield.org` repo), admin user
(`jayfield`) intact; a real `git clone` over HTTPS reproduced identical
commit history to the working copy; this repo's own `origin` remote
repointed to `https://git.jayfield.org/...` and a real `git push`
succeeded against it.
- **`vlda-01`'s copy**: left stopped (container not removed, data not
deleted) as a cold backup — reversible if ever needed; not decommissioned
outright.
### Password vault sync (KeePass, via Nextcloud)
Each user's KeePass database now syncs through Nextcloud's own WebDAV
SYNC-PLAN.md
+3 -12
View File
@@ -47,16 +47,8 @@ outright, so alpha's availability stops depending on vlda-01's.
### 2. Gitea → full migration, not sync
Just repos + a small DB — no reason to keep this tied to vlda-01's uptime.
- Stop the Gitea container on vlda-01, copy its data volume (repos + DB +
config) to alpha.
- Bring it up on alpha as a permanent container, following the exact
pattern already used for `web`/`cloud.jayfield.org`: publish to
`127.0.0.1:<port>` → Apache vhost (`git.jayfield.org`) → `certbot --apache`.
- Decommission or keep vlda-01's copy as a cold backup, admin's choice.
**Status: not started. No open questions — ready to build when wanted.**
**Status: done, 2026-07-26 — see `README.md`'s "Gitea" section for the live
setup.** vlda-01's copy left stopped as a cold backup, not decommissioned.
### 3. Jellyfin → scoping question, not yet planned
@@ -102,8 +94,7 @@ financial/security stakes.
## Suggested build order
1. Gitea (no open questions, most self-contained, validates the general
"migrate a dockerized service to alpha + Apache vhost" pattern).
1. ~~Gitea~~ — done, see above.
2. Files via Syncthing (validates the intermittent-sync approach before
trusting it with anything else).
3. Dogecoin node — **only after explicit sign-off on the wallet-split