Patrick Bucher's questions

I'm running Gitea on a virtual machine that is publicly accessible under gitea.myorg.foo. Here's the server part relevant to my SSH configuration of my configuration file:

[server]                                                                                                                       
SSH_DOMAIN       = gitea.myorg.foo                                                                                            
DOMAIN           = gitea.myorg.foo                                                                                            
ROOT_URL         = https://gitea.myorg.foo/                                                                                   
DISABLE_SSH      = false                                                                                                       
SSH_PORT         = 22                                                                                                                                                                                                                                                                                                     
OFFLINE_MODE     = false

This means that I'm running the server's sshd, not Gitea's internal sshd.

The server runs under a user called git. In /home/git/.ssh/authorized_keys, the authorized keys (per user and deployment keys) are listed.

Unfortunately, the deployment key is not offered when I try to clone a repository with that deployment key enabled.

Let's say I'd like to clone [email protected]/org/repo.git, I get offered a key with a totally different signature than what is displayed under "Deploy Keys" in the web UI. When I run ssh-keyscan gitea.myorg.foo, I only get signatures not to be found in /home/git/.ssh/authorized_keys.

How can I figure out and configure what keys SSH is offering to the client?

Edit: I noticed that the key offered is the one marked as HostKey defined in /etc/ssh/sshd_config. Do I need to use Gitea's internal SSH server, or could I configure my native SSH server accordingly?

I run a web server on Debian 10 (Buster) and Apache 2.4.38. I created a special user acme that runs scripts for renewing TLS certificates.

$ cat /etc/passwd | grep ^acme
acme:x:1002:1002::/var/acme:/usr/bin/nologin
$ cat /etc/group | grep ^acme
acme:x:1002:

This acme user should be allowed to reload the Apache 2 configuration after the certificates were renewed. So I added this line to my /etc/sudoers using visudo(8):

%acme   ALL=(root) NOPASSWD: /etc/init.d/apache2 reload

Unfortunately, this doesn't work:

$ sudo -u acme /etc/init.d/apache2 reload
[....] Reloading apache2 configuration (via systemctl): apache2.serviceFailed to reload apache2.service: Access denied                                                                                                                  
See system logs and 'systemctl status apache2.service' for details.                                                                                                                                                                     
 failed!

Have I missed something?

I need to set up a Gitea server for an organization. The setup itself is easy, and I managed to bring up Gitea within an hour when installing it manually.

However, my organisation uses a configuration management tool, which handles secrets and configuration settings. So the idea is that I create /etc/gitea/app.ini using a configuration file template.

But when I run the Gitea setup, additional values are created, such as JWT tokens (JWT_SECRET in the [oauth2] section of the config file), which I clearly cannot make up before Gitea is up and running.

So on one side, I need to pre-define the app.ini, on the other hand, I need Gitea to control app.ini. But when my provisioning script runs, it will overwrite those settings.

Is it possible to split up those two sets of settings over multiple configuration file: one to pre-define statically, and one to be managed by Gitea?