From 461f419877e59899b82e13329ef268542eef7396 Mon Sep 17 00:00:00 2001 From: Cantibra Date: Sat, 18 Jul 2026 15:17:10 +0200 Subject: [PATCH] 3 --- .env | 2 +- .gitea/workflows/release.yml | 2 +- gitea/etc/gitea/app.ini | 65 ++++++++++++++++++++++++++++-------- 3 files changed, 53 insertions(+), 16 deletions(-) diff --git a/.env b/.env index 9b63a5e..2b17346 100644 --- a/.env +++ b/.env @@ -1 +1 @@ -VERSION='1.26.4' +VERSION='1.27.0' diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml index 7afd4ad..a2fc4bf 100644 --- a/.gitea/workflows/release.yml +++ b/.gitea/workflows/release.yml @@ -46,7 +46,7 @@ jobs: if: steps.cache-gitea.outputs.cache-hit != 'true' run: | /usr/bin/install --directory --verbose './sources' - /usr/bin/wget --verbose --output-document='./sources/gitea' 'https://dl.gitea.com/gitea/${{ steps.environment.outputs.version }}/gitea-${{ steps.environment.outputs.version }}-linux-${{ matrix.architecture }}' + /usr/bin/curl --verbose --location --output './sources/gitea' 'https://dl.gitea.com/gitea/${{ steps.environment.outputs.version }}/gitea-${{ steps.environment.outputs.version }}-linux-${{ matrix.architecture }}' - name: Gitea [Action Cache Save] if: steps.cache-gitea.outputs.cache-hit != 'true' uses: actions/cache/save@v5 diff --git a/gitea/etc/gitea/app.ini b/gitea/etc/gitea/app.ini index d784294..0216e91 100644 --- a/gitea/etc/gitea/app.ini +++ b/gitea/etc/gitea/app.ini @@ -159,6 +159,16 @@ WORK_PATH = /var/lib/gitea ;; Domain name to be exposed in clone URL, defaults to DOMAIN or the domain part of ROOT_URL ;SSH_DOMAIN = ;; +;; Port number to be exposed in clone URL. +;; If you need a different "SSH clone port" from the real "SSH listen port", set the SSH_LISTEN_PORT separately. +;SSH_PORT = 22 +;; +;; The network interface that the builtin SSH server should listen on +;SSH_LISTEN_HOST = +;; +;; The port number that the builtin SSH server should listen on, defaults to SSH_PORT +;SSH_LISTEN_PORT = +;; ;; SSH username displayed in clone URLs. It defaults to BUILTIN_SSH_SERVER_USER or RUN_USER. ;; If it is set to "(DOER_USERNAME)", it will use current signed-in user's username. ;; This option is only for some advanced users who have configured their SSH reverse-proxy @@ -166,15 +176,6 @@ WORK_PATH = /var/lib/gitea ;; Most users should just leave it blank. ;SSH_USER = ;; -;; The network interface the builtin SSH server should listen on -;SSH_LISTEN_HOST = -;; -;; Port number to be exposed in clone URL -;SSH_PORT = 22 -;; -;; The port number the builtin SSH server should listen on, defaults to SSH_PORT -;SSH_LISTEN_PORT = -;; ;; Root path of SSH user directory for the system's standalone SSH server if Gitea is not using its builtin SSH server. ;; Default is the '.ssh' directory in the run user's home directory. ;SSH_ROOT_PATH = @@ -530,6 +531,17 @@ INTERNAL_TOKEN = ;; ;; The value of the X-Content-Type-Options HTTP header for all responses. Use "unset" to remove the header. ;X_CONTENT_TYPE_OPTIONS = nosniff +;; +;; The value of the general Content-Security-Policy for most web pages. +;; Leave it empty to apply the default policy, or set it to "unset" to disable Content-Security-Policy. +;CONTENT_SECURITY_POLICY_GENERAL = + +;; Webhook and oauth2 clients can only call allowed hosts for security reasons. Comma separated list, eg: external, 192.168.1.0/24, *.mydomain.com +;; Built-in: loopback (for localhost), private (for LAN/intranet), external (for public hosts on internet), * (for all hosts) +;; CIDR list: 1.2.3.0/8, 2001:db8::/32 +;; Wildcard hosts: *.mydomain.com, 192.168.100.* +;; This list is enforced on direct connections only. When an HTTP proxy is configured, restricting the proxied target is the proxy server's responsibility. +;ALLOWED_HOST_LIST = external ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; @@ -757,7 +769,12 @@ ENABLE_SSH_LOG = true ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;; Git config options -;; This section only does "set" config, a removed config key from this section won't be removed from git config automatically. The format is `some.configKey = value`. +;; The format is `some.configKey = value`. +;; These options will be written into the gitconfig file under "[git] HOME_PATH" when Gitea web starts. +;; ATTENTION: +;; * It only does "set" config, a removed config key from this section won't be removed from git config automatically. +;; * Some config options might affect the behavior of git and fail Gitea's git operation, +;; make sure you know what you are doing before making changes. ;[git.config] ;diff.algorithm = histogram ;core.logAllRefUpdates = true @@ -1023,9 +1040,18 @@ ENABLE_SSH_LOG = true ;; Default private when using push-to-create ;DEFAULT_PUSH_CREATE_PRIVATE = true ;; -;; Global limit of repositories per user, applied at creation time. -1 means no limit +;; Global limit of repositories per user or org, applied at creation time. -1 means no limit +;; To configure independent limits for users and orgs, use USER_MAX_CREATION_LIMIT and ORG_MAX_CREATION_LIMIT ;MAX_CREATION_LIMIT = -1 ;; +;; Global limit of repositories per user, applied at creation time. -1 means no limit +;; Takes precedence over MAX_CREATION_LIMIT when set +;USER_MAX_CREATION_LIMIT = -1 +;; +;; Global limit of repositories per organization, applied at creation time. -1 means no limit +;; Takes precedence over MAX_CREATION_LIMIT when set +;ORG_MAX_CREATION_LIMIT = -1 +;; ;; Preferred Licenses to place at the top of the List ;; The name here must match the filename in options/license or custom/options/license ;PREFERRED_LICENSES = Apache License 2.0,MIT License @@ -1172,6 +1198,7 @@ ENABLE_SSH_LOG = true ;; Default source for the pull request title when opening a new PR. ;; "first-commit" uses the oldest commit's summary. ;; "auto" uses commit's summary if the PR only has one commit, normalizes the branch name if multiple commits. +;; "branch-name" always uses the PR's branch name. ;DEFAULT_TITLE_SOURCE = auto ;; ;; Delay mergeable check until page view or API access, for pull requests that have not been updated in the specified days when their base branches get updated. @@ -2658,19 +2685,21 @@ ENABLE_SSH_LOG = true ;FILE_EXTENSIONS = .adoc,.asciidoc ;; External command to render all matching extensions ;RENDER_COMMAND = "asciidoc --out-file=- -" -;; Don't pass the file on STDIN, pass the filename as argument instead. +;; Whether Gitea should write the content into a local temp file for the render command's input. +;; * false: the content will be passed via STDIN to the command. +;; * true: write the content into a local temp file, and pass the temp filename as argument to the command. ;IS_INPUT_FILE = false ;; How the content will be rendered. ;; * sanitized: Sanitize the content and render it inside current page, default to only allow a few HTML tags and attributes. Customized sanitizer rules can be defined in [markup.sanitizer.*] . ;; * no-sanitizer: Disable the sanitizer and render the content inside current page. It's **insecure** and may lead to XSS attack if the content contains malicious code. ;; * iframe: Render the content in a separate standalone page and embed it into current page by iframe. The iframe is in sandbox mode with same-origin disabled, and the JS code are safely isolated from parent page. ;RENDER_CONTENT_MODE = sanitized -;; The sandbox applied to the iframe and Content-Security-Policy header when RENDER_CONTENT_MODE is `iframe`. +;; The sandbox applied to the Content-Security-Policy for the rendered content when RENDER_CONTENT_MODE is `iframe`. ;; It defaults to a safe set of "allow-*" restrictions (space separated). ;; You can also set it by your requirements or use "disabled" to disable the sandbox completely. ;; When set it, make sure there is no security risk: ;; * PDF-only content: generally safe to use "disabled", and it needs to be "disabled" because PDF only renders with no sandbox. -;; * HTML content with JS: if the "RENDER_COMMAND" can guarantee there is no XSS, then it is safe, otherwise, you need to fine tune the "allow-*" restrictions. +;; * HTML content with JS: do not set "allow-same-origin" unless the "RENDER_COMMAND" can guarantee there is no XSS. ;RENDER_CONTENT_SANDBOX = ;; Whether post-process the rendered HTML content, including: ;; resolve relative links and image sources, recognizing issue/commit references, escaping invisible characters, @@ -2981,8 +3010,16 @@ ENABLE_SSH_LOG = true ;; Comma-separated list of workflow directories, the first one to exist ;; in a repo is used to find Actions workflow files ;WORKFLOW_DIRS = .gitea/workflows,.github/workflows +;; Comma-separated list of scoped workflow directories in a source repository, the first one to exist is used. +;; Files here are picked up only when the repo is registered as a scoped-workflow source; in any other repo they neither run repo-level nor scope-level. +;; Must not overlap with WORKFLOW_DIRS. Leave empty so no directory is scanned; no scoped workflows are found or run. +;SCOPED_WORKFLOW_DIRS = .gitea/scoped_workflows ;; Maximum number of attempts a single workflow run can have. Default value is 50. ;MAX_RERUN_ATTEMPTS = 50 +;; Maximum number of runners that may run the task-assignment query concurrently, per Gitea instance. +;; Caps this instance's DB load when many runners poll at once; excess runners retry on their next poll. +;; In a multi-instance deployment the cluster-wide limit is this value times the number of instances. Default value is 16. +;MAX_CONCURRENT_TASK_PICKS = 16 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;; ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;