ansible

ansible/roles/forgejo/handlers/main.yaml

@@ -3,3 +3,8 @@
   community.docker.docker_compose_v2:
     project_src: /opt/forgejo
     state: restarted
+
+- name: Reload SSH daemon
+  systemd:
+    name: sshd
+    state: reloaded

ansible/roles/forgejo/tasks/main.yaml

@@ -1,4 +1,7 @@
 ---
+- name: Configure SSH passthrough
+  import_tasks: ssh-passthrough.yaml
+
 - name: Create Forgejo directories
   file:
     path: "{{ item }}"

ansible/roles/forgejo/tasks/ssh-passthrough.yaml

@@ -0,0 +1,45 @@
+---
+- name: Create git user on host
+  user:
+    name: git
+    comment: "Forgejo Git User"
+    home: /var/lib/git
+    shell: /usr/local/bin/forgejo-shell
+    system: yes
+    create_home: yes
+
+- name: Deploy forgejo-shell wrapper script
+  template:
+    src: forgejo-shell.j2
+    dest: /usr/local/bin/forgejo-shell
+    owner: root
+    group: root
+    mode: '0755'
+
+- name: Create .ssh directory for git user
+  file:
+    path: /var/lib/git/.ssh
+    state: directory
+    owner: git
+    group: git
+    mode: '0700'
+
+- name: Deploy SSH daemon configuration for Forgejo passthrough
+  template:
+    src: sshd-forgejo.conf.j2
+    dest: /etc/ssh/sshd_config.d/forgejo.conf
+    owner: root
+    group: root
+    mode: '0644'
+  notify: Reload SSH daemon
+
+- name: Ensure docker group exists
+  group:
+    name: docker
+    state: present
+
+- name: Add git user to docker group
+  user:
+    name: git
+    groups: docker
+    append: yes

ansible/roles/forgejo/templates/app.ini.j2

@@ -8,15 +8,15 @@ ROOT_URL = https://{{ forgejo_domain }}/
 HTTP_PORT = 3000
 DISABLE_SSH = false
 SSH_DOMAIN = {{ forgejo_domain }}
-SSH_PORT = {{ forgejo_ssh_port }}
+SSH_PORT = 22
 SSH_LISTEN_PORT = 22
-START_SSH_SERVER = true
+START_SSH_SERVER = false
 LFS_START_SERVER = true
 OFFLINE_MODE = false
 
 [database]
 DB_TYPE = sqlite3
-PATH = /data/gitea/gitea.db
+PATH = /data/gitea.db
 LOG_SQL = false
 
 [repository]

ansible/roles/forgejo/templates/docker-compose.yml.j2

@@ -15,7 +15,6 @@ services:
       - /etc/localtime:/etc/localtime:ro
     ports:
       - "{{ forgejo_http_port }}:3000"
-      - "{{ forgejo_ssh_port }}:22"
     networks:
       - {{ traefik_network }}
     labels:

ansible/roles/forgejo/templates/forgejo-shell.j2

@@ -0,0 +1,4 @@
+#!/bin/sh
+# Forgejo SSH passthrough wrapper
+# Relays SSH commands to Forgejo container
+docker exec -i -u git --env SSH_ORIGINAL_COMMAND="$SSH_ORIGINAL_COMMAND" forgejo sh "$@"

ansible/roles/forgejo/templates/sshd-forgejo.conf.j2

@@ -0,0 +1,6 @@
+# Forgejo SSH passthrough configuration
+# Delegates SSH key authentication for git user to Forgejo container
+
+Match User git
+    AuthorizedKeysCommand /usr/bin/docker exec -i -u git forgejo /usr/local/bin/forgejo keys -c /data/gitea/conf/app.ini -e git -u %u -t %t -k %k
+    AuthorizedKeysCommandUser git