diff options
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 36 | +12 −24 |
1 files changed, 12 insertions, 24 deletions
diff --git a/README.md b/README.md index 2db136f..e0cced8 100644 --- a/README.md +++ b/README.md @@ -9,15 +9,12 @@ platforms but aren't ready to host complex services like Forgejo. ## Security boundary -- Git fetch is available anonymously over smart HTTP; authenticated fetch and - push use SSH public-key authentication through `gilti-ssh`. +- Git fetch and push use SSH public-key authentication through `gilti-ssh`. - Every configured key has read/write access to every repository and may create a repository by pushing to its name for the first time. -- Repository browsing, archives, LFS downloads, and smart HTTP fetches are - anonymous and read-only; every repository is publicly visible. -- Password authentication, shells, forwarding, and tunnels are disabled; content - filters are not supported. Optional unauthenticated HTTP writes must be - enabled explicitly. +- cgit is anonymous and read-only; every repository is publicly visible. +- Smart HTTP, password authentication, shells, forwarding, tunnels, and cgit + filters are disabled. - Gilti is a single-replica service backed by one POSIX persistent volume. It is not an HA system. @@ -26,7 +23,7 @@ platforms but aren't ready to host complex services like Forgejo. Every start requires a static `authorized_keys` file: ```console -docker pull ghcr.io/dimidiumlabs/gilti:nightly +docker build -t gilti:dev . ssh-keygen -q -t ed25519 -N '' -f ./admin cp ./admin.pub ./authorized_keys @@ -36,22 +33,15 @@ docker run --rm \ --cap-add SETGID --cap-add SETUID --cap-add SYS_CHROOT \ --tmpfs /run:rw,nosuid,nodev,noexec,size=32m \ --tmpfs /tmp:rw,nosuid,nodev,noexec,size=256m \ + --tmpfs /var/cache/cgit:rw,nosuid,nodev,noexec,size=1g \ -p 8080:8080 -p 2222:2222 \ -v gilti-state:/var/lib/gilti \ -v "$PWD/authorized_keys:/etc/gilti/authorized_keys:ro" \ - ghcr.io/dimidiumlabs/gilti:nightly + gilti:dev ``` -The HTTP configuration is read from the environment at startup: - -- `GILTI_ROOT_TITLE` (default: `Gilti`); -- `GILTI_ROOT_DESCRIPTION` (default: `A tiny Git server`); -- `GILTI_CLONE_PREFIX` (empty by default); -- `GILTI_HTTP_WRITE` (`0` by default; `1` enables unauthenticated HTTP pushes and LFS uploads). - -Gilti snapshots the authorized keys file at process startup; changing it takes -effect after a restart. Repositories and the persistent SSH host key live on -the state volume. +Gilti snapshots this file at process startup; changing it takes effect after a +restart. Repositories and the persistent SSH host key live on the state volume. ## Helm @@ -67,7 +57,7 @@ ssh: helm upgrade --install gilti ./charts/gilti \ --namespace gilti --create-namespace \ --values values.yaml \ - --set web.clonePrefix='ssh://git@git.dimidiumlabs.io/' + --set cgit.clonePrefix='ssh://git@vcs.dimidiumlabs.io/' ``` See [`charts/gilti/README.md`](charts/gilti/README.md) for persistence, routing, @@ -86,10 +76,8 @@ shellcheck scripts/*.sh tests/*.sh mise run chart -- --chart charts/gilti --lint-only ``` -The CI matrix builds architecture-specific Alpine artifacts before assembling -the image; the Dockerfile does not compile source code. Linux packages are -intentionally not produced. Gilti's release artifacts are a multi-platform OCI -image and an OCI Helm chart. +Linux packages are intentionally not produced. Gilti's release artifacts are a +multi-platform OCI image and an OCI Helm chart. ## Contributing |