81809f8b53
IngressRoute allows GET/HEAD/OPTIONS on /v2 and /api/packages; removes those paths from catch-all Ingress; sets zero package upload limits in Gitea app.ini. Complements archived git repos (RAIL-HO-WP-0005).
109 lines
No EOL
3.1 KiB
Bash
Executable file
109 lines
No EOL
3.1 KiB
Bash
Executable file
#!/usr/bin/env bash
|
|
# Disable package pushes on coulombcore Gitea while keeping pull/index (read-only mirror).
|
|
# 1) Traefik IngressRoute: only GET/HEAD/OPTIONS on /v2 and /api/packages
|
|
# 2) Remove those paths from the catch-all gitea Ingress (so POST does not fall through)
|
|
# 3) Gitea app.ini: zero upload limits as defense-in-depth
|
|
set -euo pipefail
|
|
|
|
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
|
|
KUBECONFIG="${KUBECONFIG:-$HOME/.kube/config}"
|
|
NS="${GITEA_NAMESPACE:-default}"
|
|
DRY_RUN="${DRY_RUN:-0}"
|
|
|
|
run() {
|
|
if [[ "$DRY_RUN" == "1" ]]; then
|
|
echo "DRY $*"
|
|
else
|
|
"$@"
|
|
fi
|
|
}
|
|
|
|
echo "=== Gitea package push disable (namespace=${NS}) ==="
|
|
|
|
echo "==> Apply read-only IngressRoute for /v2 and /api/packages"
|
|
if [[ "$DRY_RUN" == "1" ]]; then
|
|
echo "DRY kubectl apply -f ${ROOT}/tools/gitea-package-readonly-ingressroute.yaml"
|
|
else
|
|
kubectl apply -f "${ROOT}/tools/gitea-package-readonly-ingressroute.yaml"
|
|
fi
|
|
|
|
echo "==> Patch gitea Ingress: drop /v2 and /api/packages (handled by IngressRoute)"
|
|
PATCH='[
|
|
{"op":"replace","path":"/spec/rules/0/http/paths","value":[
|
|
{"path":"/","pathType":"Prefix","backend":{"service":{"name":"gitea-http","port":{"number":3000}}}}
|
|
]}
|
|
]'
|
|
if [[ "$DRY_RUN" == "1" ]]; then
|
|
echo "DRY kubectl patch ingress gitea -n ${NS} --type=json -p '${PATCH}'"
|
|
else
|
|
kubectl patch ingress gitea -n "$NS" --type=json -p "$PATCH"
|
|
fi
|
|
|
|
echo "==> Set Gitea package upload limits to 0 (defense-in-depth)"
|
|
APP_INI_BLOCK='
|
|
[packages]
|
|
ENABLED = true
|
|
LIMIT_TOTAL_OWNER_SIZE = 0
|
|
LIMIT_SIZE_CONTAINER = 0
|
|
LIMIT_SIZE_PYPI = 0
|
|
LIMIT_SIZE_NPM = 0
|
|
LIMIT_SIZE_GENERIC = 0
|
|
LIMIT_SIZE_HELM = 0
|
|
LIMIT_SIZE_MAVEN = 0
|
|
LIMIT_SIZE_NUGET = 0
|
|
LIMIT_SIZE_RPM = 0
|
|
LIMIT_SIZE_DEB = 0
|
|
LIMIT_SIZE_CONAN = 0
|
|
LIMIT_SIZE_COMPOSER = 0
|
|
LIMIT_SIZE_CRAN = 0
|
|
LIMIT_SIZE_ALPINE = 0
|
|
LIMIT_SIZE_CARGO = 0
|
|
LIMIT_SIZE_CHEF = 0
|
|
'
|
|
if [[ "$DRY_RUN" == "1" ]]; then
|
|
echo "DRY append [packages] zero limits to app.ini + restart gitea"
|
|
else
|
|
kubectl -n "$NS" exec deploy/gitea -- sh -c '
|
|
ini=/data/gitea/conf/app.ini
|
|
if grep -q "^\[packages\]" "$ini"; then
|
|
echo "packages section already present — leaving app.ini unchanged"
|
|
else
|
|
cat >>"$ini" <<'"'"'EOF'"'"'
|
|
[packages]
|
|
ENABLED = true
|
|
LIMIT_TOTAL_OWNER_SIZE = 0
|
|
LIMIT_SIZE_CONTAINER = 0
|
|
LIMIT_SIZE_PYPI = 0
|
|
LIMIT_SIZE_NPM = 0
|
|
LIMIT_SIZE_GENERIC = 0
|
|
LIMIT_SIZE_HELM = 0
|
|
LIMIT_SIZE_MAVEN = 0
|
|
LIMIT_SIZE_NUGET = 0
|
|
LIMIT_SIZE_RPM = 0
|
|
LIMIT_SIZE_DEB = 0
|
|
LIMIT_SIZE_CONAN = 0
|
|
LIMIT_SIZE_COMPOSER = 0
|
|
LIMIT_SIZE_CRAN = 0
|
|
LIMIT_SIZE_ALPINE = 0
|
|
LIMIT_SIZE_CARGO = 0
|
|
LIMIT_SIZE_CHEF = 0
|
|
EOF
|
|
echo "appended [packages] zero-limit block"
|
|
fi
|
|
'
|
|
kubectl -n "$NS" rollout restart deploy/gitea
|
|
kubectl -n "$NS" rollout status deploy/gitea --timeout=180s
|
|
fi
|
|
|
|
echo "==> Verify edge behavior"
|
|
if [[ "$DRY_RUN" == "1" ]]; then
|
|
echo "DRY curl -X POST https://gitea.coulomb.social/v2/ (expect 404)"
|
|
else
|
|
sleep 3
|
|
post_code=$(curl -sS --max-time 15 -o /dev/null -w '%{http_code}' -X POST "https://gitea.coulomb.social/v2/" || true)
|
|
get_code=$(curl -sS --max-time 15 -o /dev/null -w '%{http_code}' "https://gitea.coulomb.social/v2/" || true)
|
|
echo "POST /v2/ -> ${post_code} (want 404/405)"
|
|
echo "GET /v2/ -> ${get_code} (want 401/200)"
|
|
fi
|
|
|
|
echo "=== Done ===" |