mirror of
https://github.com/davegallant/davegallant.github.io.git
synced 2025-08-06 08:43:40 +00:00
91 lines
40 KiB
HTML
91 lines
40 KiB
HTML
<!doctype html><html lang=en data-theme=dark><head><meta charset=utf-8><meta name=viewport content="width=device-width,initial-scale=1"><link rel=preload as=font type=font/woff2 href=/fonts/roboto-slab-latin-400.woff2 crossorigin=anonymous><link rel=preload as=font type=font/woff2 href=/fonts/roboto-slab-latin-700.woff2 crossorigin=anonymous><link rel=preload as=font type=font/woff2 href=/fonts/fira-code-latin-300.woff2 crossorigin=anonymous><link rel=preload as=font type=font/woff2 href=/fonts/fira-code-latin-400.woff2 crossorigin=anonymous><link rel=preload as=font type=font/woff2 href=/fonts/fira-code-latin-700.woff2 crossorigin=anonymous><meta name=robots content="index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1"><title>Setting up Gitea Actions with Tailscale</title>
|
|
<meta name=description content="In this post I&rsquo;ll go through the process of setting up Gitea Actions and Tailscale, unlocking a simple and secure way to automate workflows.
|
|
"><link rel=canonical href=/blog/setting-up-gitea-actions-with-tailscale/><meta name=twitter:card content="summary"><meta name=twitter:title content="Setting up Gitea Actions with Tailscale"><meta name=twitter:description content="In this post I’ll go through the process of setting up Gitea Actions and Tailscale, unlocking a simple and secure way to automate workflows."><meta property="og:title" content="Setting up Gitea Actions with Tailscale"><meta property="og:description" content="In this post I’ll go through the process of setting up Gitea Actions and Tailscale, unlocking a simple and secure way to automate workflows."><meta property="og:type" content="article"><meta property="og:url" content="/blog/setting-up-gitea-actions-with-tailscale/"><meta property="article:section" content="blog"><meta property="article:published_time" content="2023-12-10T17:22:11-05:00"><meta property="article:modified_time" content="2024-04-06T23:12:01-04:00"><meta itemprop=name content="Setting up Gitea Actions with Tailscale"><meta itemprop=description content="In this post I’ll go through the process of setting up Gitea Actions and Tailscale, unlocking a simple and secure way to automate workflows."><meta itemprop=datePublished content="2023-12-10T17:22:11-05:00"><meta itemprop=dateModified content="2024-04-06T23:12:01-04:00"><meta itemprop=wordCount content="1091"><meta itemprop=keywords content="gitea,gitea actions,github actions,tailscale,self-hosted,"><style>@font-face{font-display:swap;font-family:Roboto Slab;font-style:normal;font-weight:100;src:local("Roboto Slab Thin "),local("Roboto Slab-Thin"),url(/fonts/roboto-slab-latin-100.woff2) format("woff2"),url(/fonts/roboto-slab-latin-100.woff) format("woff")}@font-face{font-display:swap;font-family:Roboto Slab;font-style:normal;font-weight:200;src:local("Roboto Slab Extra Light "),local("Roboto Slab-Extra Light"),url(/fonts/roboto-slab-latin-200.woff2) format("woff2"),url(/fonts/roboto-slab-latin-200.woff) format("woff")}@font-face{font-display:swap;font-family:Roboto Slab;font-style:normal;font-weight:300;src:local("Roboto Slab Light "),local("Roboto Slab-Light"),url(/fonts/roboto-slab-latin-300.woff2) format("woff2"),url(/fonts/roboto-slab-latin-300.woff) format("woff")}@font-face{font-display:swap;font-family:Roboto Slab;font-style:normal;font-weight:400;src:local("Roboto Slab Regular "),local("Roboto Slab-Regular"),url(/fonts/roboto-slab-latin-400.woff2) format("woff2"),url(/fonts/roboto-slab-latin-400.woff) format("woff")}@font-face{font-display:swap;font-family:Roboto Slab;font-style:normal;font-weight:500;src:local("Roboto Slab Medium "),local("Roboto Slab-Medium"),url(/fonts/roboto-slab-latin-500.woff2) format("woff2"),url(/fonts/roboto-slab-latin-500.woff) format("woff")}@font-face{font-display:swap;font-family:Roboto Slab;font-style:normal;font-weight:600;src:local("Roboto Slab SemiBold "),local("Roboto Slab-SemiBold"),url(/fonts/roboto-slab-latin-600.woff2) format("woff2"),url(/fonts/roboto-slab-latin-600.woff) format("woff")}@font-face{font-display:swap;font-family:Roboto Slab;font-style:normal;font-weight:700;src:local("Roboto Slab Bold "),local("Roboto Slab-Bold"),url(/fonts/roboto-slab-latin-700.woff2) format("woff2"),url(/fonts/roboto-slab-latin-700.woff) format("woff")}@font-face{font-display:swap;font-family:Roboto Slab;font-style:normal;font-weight:800;src:local("Roboto Slab ExtraBold "),local("Roboto Slab-ExtraBold"),url(/fonts/roboto-slab-latin-800.woff2) format("woff2"),url(/fonts/roboto-slab-latin-800.woff) format("woff")}@font-face{font-display:swap;font-family:Roboto Slab;font-style:normal;font-weight:900;src:local("Roboto Slab Black "),local("Roboto Slab-Black"),url(/fonts/roboto-slab-latin-900.woff2) format("woff2"),url(/fonts/roboto-slab-latin-900.woff) format("woff")}@font-face{font-display:swap;font-family:Fira Code;font-style:normal;font-weight:300;src:local("Fira Code Light "),local("Fira Code-Light"),url(/fonts/fira-code-latin-300.woff2) format("woff2"),url(/fonts/fira-code-latin-300.woff) format("woff")}@font-face{font-display:swap;font-family:Fira Code;font-style:normal;font-weight:400;src:local("Fira Code Regular "),local("Fira Code-Regular"),url(/fonts/fira-code-latin-400.woff2) format("woff2"),url(/fonts/fira-code-latin-400.woff) format("woff")}@font-face{font-display:swap;font-family:Fira Code;font-style:normal;font-weight:500;src:local("Fira Code Medium "),local("Fira Code-Medium"),url(/fonts/fira-code-latin-500.woff2) format("woff2"),url(/fonts/fira-code-latin-500.woff) format("woff")}@font-face{font-display:swap;font-family:Fira Code;font-style:normal;font-weight:600;src:local("Fira Code SemiBold "),local("Fira Code-SemiBold"),url(/fonts/fira-code-latin-600.woff2) format("woff2"),url(/fonts/fira-code-latin-600.woff) format("woff")}@font-face{font-display:swap;font-family:Fira Code;font-style:normal;font-weight:700;src:local("Fira Code Bold "),local("Fira Code-Bold"),url(/fonts/fira-code-latin-700.woff2) format("woff2"),url(/fonts/fira-code-latin-700.woff) format("woff")}
|
|
|
|
/*! normalize.css v8.0.1 | MIT License | github.com/necolas/normalize.css */html{line-height:1.15;-webkit-text-size-adjust:100%}body{margin:0}main{display:block}h1{font-size:2em;margin:.67em 0}hr{box-sizing:content-box;height:0;overflow:visible}pre{font-family:monospace,monospace;font-size:1em}a{background-color:transparent}abbr[title]{border-bottom:none;-webkit-text-decoration:underline;text-decoration:underline;-webkit-text-decoration:underline dotted;text-decoration:underline dotted}b,strong{font-weight:bolder}code,kbd,samp{font-family:monospace,monospace;font-size:1em}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sub{bottom:-.25em}sup{top:-.5em}img{border-style:none}button,input,optgroup,select,textarea{font-family:inherit;font-size:100%;line-height:1.15;margin:0}button,input{overflow:visible}button,select{text-transform:none}[type=button],[type=reset],[type=submit],button{-webkit-appearance:button}[type=button]::-moz-focus-inner,[type=reset]::-moz-focus-inner,[type=submit]::-moz-focus-inner,button::-moz-focus-inner{border-style:none;padding:0}[type=button]:-moz-focusring,[type=reset]:-moz-focusring,[type=submit]:-moz-focusring,button:-moz-focusring{outline:1px dotted ButtonText}fieldset{padding:.35em .75em .625em}legend{box-sizing:border-box;color:inherit;display:table;max-width:100%;padding:0;white-space:normal}progress{vertical-align:baseline}textarea{overflow:auto}[type=checkbox],[type=radio]{box-sizing:border-box;padding:0}[type=number]::-webkit-inner-spin-button,[type=number]::-webkit-outer-spin-button{height:auto}[type=search]{-webkit-appearance:textfield;outline-offset:-2px}[type=search]::-webkit-search-decoration{-webkit-appearance:none}::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}details{display:block}summary{display:list-item}[hidden],template{display:none}
|
|
|
|
/*! CC BY-SA 3.0 License | https://stackoverflow.com/a/36118384/1154965 */@keyframes blink{50%{opacity:0}to{opacity:1}}
|
|
|
|
/*! MIT License | github.com/schnerring/hugo-theme-gruvbox */:root[data-theme=dark]{--bg:var(--bg0);--bg0:#1a1b26;--bg0_h:#1d2021;--bg0_s:#32302f;--bg1:#181922;--bg2:#32344a;--bg3:#665c54;--bg4:#32344a;--fg:var(--fg1);--fg0:#ad8ee6;--fg1:#dddfeb;--fg2:#7da6ff;--fg3:#9ece6a;--fg4:#32344a;--gray1:var(--fg4);--gray2:#444b6a;--red1:#f7768e;--red2:#ff7a93;--green1:#9ece6a;--green2:#b9f27c;--yellow1:#e0af68;--yellow2:#ff9e64;--blue1:#7da6ff;--blue2:#7aa2f7;--purple1:#ad8ee6;--purple2:#bb9af7;--aqua1:#449dab;--aqua2:#0db9d7;--orange1:#d65d0e;--orange2:#fe8019}:root{--primary:var(--blue1);--primary-alt:var(--blue2);--font-monospace:"Fira Code","Lucida Console",Monaco,monospace;--font-sans-serif:Verdana,Helvetica,sans-serif;--font-serif:"Roboto Slab",Georgia,serif}html{font-family:Roboto Slab,Georgia,serif;font-family:var(--font-serif);font-size:1rem;scroll-behavior:smooth}body{background:var(--bg);color:var(--fg);line-height:1.675;word-wrap:break-word}strong{letter-spacing:.35px}a{color:inherit;-webkit-text-decoration:none;text-decoration:none}a.link--external:after{content:"\2009↗"}img{border:2px solid var(--bg1);height:auto;max-width:100%}::-moz-selection{background:var(--bg4);color:var(--fg0)}::selection{background:var(--bg4);color:var(--fg0)}h1,h2,h3{color:var(--fg0);font-family:Fira Code,Lucida Console,Monaco,monospace;font-family:var(--font-monospace);font-weight:300;line-height:1.4}h1 code,h2 code,h3 code{font-size:1em}h2,h3{border-bottom:1px solid var(--bg1)}h1,h2{font-weight:400}h1{font-size:1.875rem}h2{font-size:1.75rem}h3{font-size:1.625rem}@media (min-width:768px){h1{font-size:2.375rem}h2{font-size:2rem}h3{font-size:1.75rem}}blockquote,code,pre{border-radius:.2rem;padding:0 .2em}pre code{padding:0}blockquote,code,pre{background:var(--bg1)}code,pre{font-family:Fira Code,Lucida Console,Monaco,monospace;font-family:var(--font-monospace)}code code{background:var(--bg2)}blockquote,pre{padding:1rem}pre{background:var(--bg1)!important;overflow:auto}pre code{background:none}blockquote,blockquote.twitter-tweet{border-left:5px solid var(--primary-alt);margin:.5rem 0}blockquote.twitter-tweet code,blockquote:not(.does-not-exist) code{background:var(--bg2)}blockquote.twitter-tweet p:first-of-type,blockquote:not(.does-not-exist) p:first-of-type{margin-top:0}blockquote.twitter-tweet p:last-of-type,blockquote:not(.does-not-exist) p:last-of-type{margin-bottom:0}blockquote.twitter-tweet{border-color:var(--blue2);color:inherit;font:inherit;font-size:inherit;line-height:inherit}blockquote.twitter-tweet a{color:var(--blue2)}blockquote.twitter-tweet a:hover{color:var(--blue1);-webkit-text-decoration:none!important;text-decoration:none!important}pre::-webkit-scrollbar{height:.5rem;scrollbar-width:auto}pre::-webkit-scrollbar-track{background:var(--bg2);border-radius:.2rem}pre::-webkit-scrollbar-thumb{background:var(--bg4);border-radius:.2rem}.layout{display:grid;grid-template-areas:"header" "main" "footer";grid-template-rows:auto 1fr auto;height:100vh}main{align-items:start;display:grid;grid-area:main;grid-template-areas:"empty content sidebar";grid-template-columns:2fr minmax(0,860px) 2fr}header{background:var(--bg1);grid-area:header}footer{grid-area:footer}footer,main{margin:.5em 1.1em}.content{grid-area:content}.sidebar{display:none;flex-direction:column;grid-area:sidebar;margin-top:3rem;position:sticky;top:2rem}@media (min-width:992px){.sidebar{display:flex}}header{display:grid;font-family:Fira Code,Lucida Console,Monaco,monospace;font-family:var(--font-monospace);font-size:1.125rem;grid-template-areas:"heading search nav theme-toggle";grid-template-columns:auto auto 1fr auto;padding:.75rem}.logo{color:var(--fg0);display:flex;font-weight:700;grid-area:heading}.logo:hover .logo__cursor{animation:blink 1s infinite;opacity:1}.logo__chevron,.logo__cursor{margin-left:.5rem}.logo__cursor{opacity:0}.logo__text{display:none}@media (min-width:768px){.logo__text{display:block}}.search{display:flex;grid-area:search;margin:0 1rem}#search__text{background:var(--bg2);border:1px solid var(--bg2);border-radius:.2rem;caret-color:var(--fg);color:var(--fg);outline:none;padding:0 .5rem;width:100%}#search__text:hover{border-color:var(--bg3)}#search__text:focus{border-color:var(--bg4)}#search__text::-moz-placeholder{color:var(--fg3)}#search__text::placeholder{color:var(--fg3)}#search__text[type=search]::-webkit-search-cancel-button{-webkit-appearance:none;appearance:none}#search__suggestions{background:var(--bg);border-radius:.2rem;box-shadow:0 .5rem 1rem var(--bg1);font-family:Roboto Slab,Georgia,serif;font-family:var(--font-serif);left:0;margin-top:2rem;position:absolute;width:95vw;z-index:1000}@media (min-width:768px){.search{position:relative}#search__suggestions{width:60vw}}.search__suggestions--hidden{display:none}.search__suggestion-item{border-bottom:1px dashed var(--bg2);display:grid;grid-template-columns:1fr 2fr}.search__suggestion-item:focus,.search__suggestion-item:focus-visible,.search__suggestion-item:hover{background:var(--bg1);cursor:pointer;outline:none}.search__suggestion-item:last-child{border:none}.search__suggestion-description,.search__suggestion-title{margin:1rem 0;padding:0 1rem}.search__suggestion-title{font-weight:700}.search__suggestion-description{border-left:1px solid var(--bg2)}.search__no-results{padding:.75rem}nav#menu{align-items:center;display:flex;grid-area:nav;justify-content:flex-end}nav#menu .menu__item{color:var(--fg)}nav#menu .menu__item:hover{color:var(--fg3);cursor:pointer}nav#menu ul{list-style:none;margin:0;padding:0}nav#menu ul.menu--horizontal{align-items:center;display:none}nav#menu ul.menu--horizontal li{display:inline-block;margin:0 .75rem}@media (min-width:768px){nav#menu ul.menu--horizontal{display:flex}}nav#menu ul.menu--vertical{background:var(--bg1);bottom:0;margin:0;padding:3rem;position:fixed;right:0;top:0;transform:translate(100%);transition:transform .5s cubic-bezier(.9,0,.1,1);width:50%;z-index:10}nav#menu ul.menu--vertical .menu__item{color:var(--fg1)}nav#menu ul.menu--vertical .menu__item:hover{color:var(--fg3)}nav#menu .menu__burger{display:flex;height:24px;width:24px}nav#menu .menu__burger>*{position:absolute}nav#menu .menu__burger svg{height:inherit;width:inherit;z-index:20}nav#menu .menu__burger input{height:inherit;opacity:0;width:inherit;z-index:30}nav#menu .menu__burger input:checked~ul.menu--vertical{transform:none}nav#menu .menu__burger input:checked~svg{stroke:var(--fg1)}@media (min-width:768px){nav#menu .menu__burger{display:none}}.sidebar{font-family:Fira Code,Lucida Console,Monaco,monospace;font-family:var(--font-monospace);margin-left:auto;margin-right:auto;max-width:350px;padding-left:2.5rem}.sidebar svg{fill:var(--fg)}.content-section,.post{border-bottom:2px dotted var(--bg1);padding:2rem 0}.post img:not(figure img){box-sizing:border-box;margin:.5rem 0}.post-header{font-family:Fira Code,Lucida Console,Monaco,monospace;font-family:var(--font-monospace)}.post-content{margin:1.3rem 0}.content-section a,.post-content a,.post-header a{color:var(--blue2);color:var(--primary-alt)}.content-section a:hover,.post-content a:hover,.post-header a:hover{color:var(--blue1);color:var(--primary)}.post-heading__anchor{display:none}h1:hover .post-heading__anchor,h2:hover .post-heading__anchor,h3:hover .post-heading__anchor{display:inline-block}</style><link rel=preload href="/css/non-critical.713869c4c9bcaee5df59301fd32a5d831bdcc701104d142e54e1da442b7b0ed98ab0037e053dce4e3c73ef9b86b2e4d1cecf4444414cce6dc9e979de548736e0.css" as=style onload='this.onload=null,this.rel="stylesheet"'><link id=prism-dark rel=preload href=/prism-themes/prism-synthwave84.min.82cddaf6fa642c0fbdef84797ce89bc3e0e8a00e266faa8f8a2029a5cf3de3ca1e8ed3864d3a3b3b8e377df1185ae021f1d7b5f51524bcdc7c5ecdac053b7ac4.css as=style onload='this.onload=null,this.rel="stylesheet"'><link id=prism-light rel=preload href=/prism-themes/prism-synthwave84.min.82cddaf6fa642c0fbdef84797ce89bc3e0e8a00e266faa8f8a2029a5cf3de3ca1e8ed3864d3a3b3b8e377df1185ae021f1d7b5f51524bcdc7c5ecdac053b7ac4.css as=style onload='this.onload=null,this.rel="stylesheet"' disabled><noscript><link rel=stylesheet href=/prism-themes/prism-synthwave84.min.82cddaf6fa642c0fbdef84797ce89bc3e0e8a00e266faa8f8a2029a5cf3de3ca1e8ed3864d3a3b3b8e377df1185ae021f1d7b5f51524bcdc7c5ecdac053b7ac4.css><link rel=stylesheet href="/css/non-critical.713869c4c9bcaee5df59301fd32a5d831bdcc701104d142e54e1da442b7b0ed98ab0037e053dce4e3c73ef9b86b2e4d1cecf4444414cce6dc9e979de548736e0.css"></noscript><script>(()=>{function e(e){let t=document.getElementById("prism-dark"),n=document.getElementById("prism-light");t.toggleAttribute("disabled",e==="light"),n.toggleAttribute("disabled",e==="dark")}function t(e){if(document.querySelector(".utterances-frame")){let n=document.querySelector(".utterances-frame");var t={type:"set-theme",theme:e=="dark"?"gruvbox-dark":"github-light"};n.contentWindow.postMessage(t,"https://utteranc.es")}}function n(n){document.documentElement.setAttribute("data-theme",n),e(n),t(n)}n("dark"),document.addEventListener("DOMContentLoaded",function(){document.querySelectorAll(".theme__toggle").forEach(e=>{e.addEventListener("click",toggleTheme)})})})()</script><link rel=apple-touch-icon sizes=180x180 href=/apple-touch-icon.png><link rel=icon type=image/png sizes=32x32 href=/favicon-32x32.png><link rel=icon type=image/png sizes=16x16 href=/favicon-16x16.png><link rel=manifest href=/site.webmanifest><link rel=mask-icon href=/safari-pinned-tab.svg color=#282828><meta name=msapplication-TileColor content="#282828"><meta name=theme-color content="#282828"></head><body><div class=layout><header><a class=logo href=/><div class=logo__text>davegallant.ca</div><div class=logo__chevron>></div><div class=logo__cursor>█</div></a><div class=search><input id=search__text type=search placeholder=Search... aria-label=Search autocomplete=off><div id=search__suggestions class=search__suggestions--hidden></div></div><nav id=menu><ul class=menu--horizontal><li class=menu__item><a href=/>Home</a></li><li class=menu__item><a href=/blog>Blog</a></li></ul><div class=menu__burger><input class=menu__item type=checkbox aria-label="Open main menu"><svg xmlns="http://www.w3.org/2000/svg" class="icon icon-tabler icon-tabler-menu-2" width="24" height="24" viewBox="0 0 24 24" stroke-width="2" stroke="currentcolor" fill="none" stroke-linecap="round" stroke-linejoin="round"><path stroke="none" d="M0 0h24v24H0z" fill="none"/><path d="M4 6h16"/><path d="M4 12h16"/><path d="M4 18h16"/></svg><ul class=menu--vertical><li><a class=menu__item href=/>Home</a></li><li><a class=menu__item href=/blog>Blog</a></li></ul></div></nav></header><main><div class=content><article class=post><div class=post-header><h1>Setting up Gitea Actions with Tailscale</h1><div class=post-meta><span>2023-12-10</span></div></div><div class=post-content><p>In this post I’ll go through the process of setting up Gitea Actions and <a href=https://tailscale.com/ class=link--external target=_blank rel=noreferrer>Tailscale</a>, unlocking a simple and secure way to automate workflows.</p><h2 id=what-is-gitea>What is Gitea?<a href=#what-is-gitea class=post-heading__anchor aria-hidden=true>#</a></h2><p><a href=https://about.gitea.com/ class=link--external target=_blank rel=noreferrer>Gitea</a> is a lightweight and fast git server that has much of the same look and feel as github. I have been using it in my homelab to mirror repositories hosted on other platforms such as github and gitlab. These mirrors take advantage of the decentralized nature of git by serving as “backups”. One of the main reasons I hadn’t been using it more often was due to the lack of integrated CI/CD. This is no longer the case.</p><h2 id=gitea-actions>Gitea Actions<a href=#gitea-actions class=post-heading__anchor aria-hidden=true>#</a></h2><p><a href=https://docs.gitea.com/usage/actions/overview class=link--external target=_blank rel=noreferrer>Gitea Actions</a> have made it into the <a href=https://blog.gitea.com/release-of-1.19.0/ class=link--external target=_blank rel=noreferrer>1.19.0 release</a>. This feature had been in an experimental state up until <a href=https://blog.gitea.com/release-of-1.21.0/ class=link--external target=_blank rel=noreferrer>1.21.0</a> and is now enabled by default 🎉.</p><p>So what are they? If you’ve ever used GitHub Actions (and if you’re reading this, I imagine you have), these will look familiar. Gitea Actions essentially enable the ability to run github workflows on gitea. Workflows between gitea and github are not completely interopable, but a lot of the same workflow syntax is already compatible on gitea. You can find a documented list of <a href=https://docs.gitea.com/usage/actions/comparison#unsupported-workflows-syntax class=link--external target=_blank rel=noreferrer>unsupported workflows syntax</a>.</p><p>Actions work by using a <a href=https://gitea.com/gitea/act class=link--external target=_blank rel=noreferrer>custom fork</a> of <a href=https://github.com/nektos/act class=link--external target=_blank rel=noreferrer>nekos/act</a>. Workflows run in a new container for every job. If you specify an action such as <code>actions/checkout@v4</code>, it defaults to downloading the scripts from github.com. To avoid internet egress, you could always clone the required actions to your local gitea instance.</p><p>Actions (gitea’s implementation) has me excited because it makes spinning up a network-isolated environment for workflow automation incredibly simple.</p><h2 id=integration-with-tailscale>Integration with Tailscale<a href=#integration-with-tailscale class=post-heading__anchor aria-hidden=true>#</a></h2><blockquote><p><strong>2024-02-10</strong>: I had originally written this post to include <a href=https://traefik.io/blog/exploring-the-tailscale-traefik-proxy-integration/ class=link--external target=_blank rel=noreferrer>Tailscale-Traefik Proxy Integration</a>, but have since removed it in favour of Tailscale Serve after learning from this <a href=https://github.com/tailscale-dev/docker-guide-code-examples class=link--external target=_blank rel=noreferrer>example</a>. This simplifies the setup and reduces the number of moving parts.</p></blockquote><p>So how does Tailscale help here? Well, more recently I’ve been exposing my self-hosted services using Tailscale <a href=https://tailscale.com/kb/1312/serve class=link--external target=_blank rel=noreferrer>Serve</a>. This allows for a nice looking dns name (i.e. gitea.my-tailnet-name.ts.net), automatic tls certificate management, and optionally allowing the address to be publically accessible (by using <a href=https://tailscale.com/kb/1223/funnel class=link--external target=_blank rel=noreferrer>Funnel</a>).</p><h2 id=deploying-gitea-traefik-and-tailscale>Deploying Gitea, Traefik, and Tailscale<a href=#deploying-gitea-traefik-and-tailscale class=post-heading__anchor aria-hidden=true>#</a></h2><p>In my case, the following is already set up:</p><ul><li><a href=https://docs.docker.com/compose/install/linux/ class=link--external target=_blank rel=noreferrer>docker-compose is installed</a></li><li><a href=https://tailscale.com/kb/1081/magicdns/ class=link--external target=_blank rel=noreferrer>tailscale magic dns is enabled</a></li></ul><p>My preferred approach to deploying code in a homelab environment is with docker compose. I have deployed this in a LXC on Proxmox. You could run this on a virtual machine or a physical host as well.</p><p>The <code>docker-compose.yaml</code> file looks like:</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-yaml data-lang=yaml><span style=display:flex><span><span style=color:#f92672>version</span>: <span style=color:#e6db74>"3.7"</span>
|
|
</span></span><span style=display:flex><span><span style=color:#f92672>services</span>:
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>gitea</span>:
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>image</span>: <span style=color:#ae81ff>gitea/gitea:1.21.1</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>container_name</span>: <span style=color:#ae81ff>gitea</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>network_mode</span>: <span style=color:#ae81ff>service:ts-gitea</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>environment</span>:
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>USER_UID=1000</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>USER_GID=1000</span>
|
|
</span></span><span style=display:flex><span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>GITEA__server__DOMAIN=gitea.my-tailnet-name.ts.net</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>GITEA__server__ROOT_URL=https://gitea.my-tailnet-name.ts.net</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>GITEA__server__HTTP_ADDR=0.0.0.0</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>GITEA__server__LFS_JWT_SECRET=my-secret-jwt</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>restart</span>: <span style=color:#ae81ff>always</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>volumes</span>:
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>./data:/data</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>/etc/timezone:/etc/timezone:ro</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>/etc/localtime:/etc/localtime:ro</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>ts-gitea</span>:
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>image</span>: <span style=color:#ae81ff>tailscale/tailscale:v1.58</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>container_name</span>: <span style=color:#ae81ff>ts-gitea</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>hostname</span>: <span style=color:#ae81ff>gitea</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>environment</span>:
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>TS_AUTHKEY=<FILL THIS IN></span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>TS_SERVE_CONFIG=/config/gitea.json</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>TS_STATE_DIR=/var/lib/tailscale</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>volumes</span>:
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>${PWD}/state:/var/lib/tailscale</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>${PWD}/config:/config</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>/dev/net/tun:/dev/net/tun</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>cap_add</span>:
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>net_admin</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#ae81ff>sys_module</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>restart</span>: <span style=color:#ae81ff>unless-stopped</span>
|
|
</span></span></code></pre></div><p>Note that you must specify a <code>TS_AUTHKEY</code> in the <code>ts-gitea</code> service. You can generate an auth key <a href=https://login.tailscale.com/admin/settings/keys class=link--external target=_blank rel=noreferrer>here</a>.</p><p><code>config/gitea.json</code>:</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-yaml data-lang=yaml><span style=display:flex><span>{
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>"TCP": { "443": { "HTTPS": </span><span style=color:#66d9ef>true</span> } },
|
|
</span></span><span style=display:flex><span> <span style=color:#e6db74>"Web"</span>:
|
|
</span></span><span style=display:flex><span> {
|
|
</span></span><span style=display:flex><span> <span style=color:#e6db74>"${TS_CERT_DOMAIN}:443"</span>:
|
|
</span></span><span style=display:flex><span> { <span style=color:#f92672>"Handlers": { "/": { "Proxy": </span><span style=color:#e6db74>"http://127.0.0.1:3000"</span> } } },
|
|
</span></span><span style=display:flex><span> },
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>"AllowFunnel": { "${TS_CERT_DOMAIN}:443": </span><span style=color:#66d9ef>false</span> }
|
|
</span></span><span style=display:flex><span>}
|
|
</span></span></code></pre></div><p>After adding the above configuration, running <code>docker compose up -d</code> should be enough to get an instance up and running. It will be accessible at <a href=https://gitea.my-tailnet-name.ts.net class=link--external target=_blank rel=noreferrer>https://gitea.my-tailnet-name.ts.net</a> from within the tailnet.</p><p>Something to consider is whether or not you want to use ssh with git. One method to get this to work with containers is to use <a href=https://docs.gitea.com/installation/install-with-docker#ssh-container-passthrough class=link--external target=_blank rel=noreferrer>ssh container passthrough</a>. I decided to keep it simple and not use ssh, since communicating over https is perfectly fine for my use case.</p><h2 id=theming>Theming<a href=#theming class=post-heading__anchor aria-hidden=true>#</a></h2><p>I discovered some themes for gitea <a href=https://git.sainnhe.dev/sainnhe/gitea-themes class=link--external target=_blank rel=noreferrer>here</a> and decided to try out gruvbox.</p><p>I added the theme by cloning <a href=https://git.sainnhe.dev/sainnhe/gitea-themes/raw/branch/master/dist/theme-gruvbox-auto.css class=link--external target=_blank rel=noreferrer>theme-gruvbox-auto.css</a> into <code>./data/gitea/public/assets/css</code>. I then added the following to <code>environment</code> in <code>docker-compose.yml</code>:</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-yaml data-lang=yaml><span style=display:flex><span>- <span style=color:#ae81ff>GITEA__ui__DEFAULT_THEME=palenight</span>
|
|
</span></span><span style=display:flex><span>- <span style=color:#ae81ff>GITEA__ui__THEMES=palenight</span>
|
|
</span></span></code></pre></div><p>After restarting the gitea instance, the default theme was applied.</p><h2 id=connecting-runners>Connecting runners<a href=#connecting-runners class=post-heading__anchor aria-hidden=true>#</a></h2><p>I installed the runner by <a href=https://docs.gitea.com/usage/actions/quickstart#set-up-runner class=link--external target=_blank rel=noreferrer>following the docs</a>. I opted for installing it on a separate host as recommended in the docs. I used the systemd unit file to ensure that the runner comes back online after system reboots. I installed tailscale on the gitea runner as well, so that it can be part of the same tailnet as the main instance.</p><p>After registering this runner and starting the daemon, the runner appeared in <code>/admin/actions/runners</code>. I added two other runners to help with parallelization.</p><h2 id=running-a-workflow>Running a workflow<a href=#running-a-workflow class=post-heading__anchor aria-hidden=true>#</a></h2><p>Now it’s time start running some automation. I used the <a href=https://docs.gitea.com/usage/actions/quickstart#use-actions class=link--external target=_blank rel=noreferrer>demo workflow</a> as a starting point to verify that the runner is executing workflows.</p><p>After this, I wanted to make sure that some of my existing workflows could be migrated over.</p><p>The following workflow uses a matrix to run a job for several of my hosts using ansible playbooks that will do various tasks such as patching os updates and updating container images.</p><div class=highlight><pre tabindex=0 style=color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-yaml data-lang=yaml><span style=display:flex><span><span style=color:#f92672>name</span>: <span style=color:#ae81ff>Run ansible</span>
|
|
</span></span><span style=display:flex><span><span style=color:#f92672>on</span>:
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>push</span>:
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>schedule</span>:
|
|
</span></span><span style=display:flex><span> - <span style=color:#f92672>cron</span>: <span style=color:#e6db74>"0 */12 * * *"</span>
|
|
</span></span><span style=display:flex><span>
|
|
</span></span><span style=display:flex><span><span style=color:#f92672>jobs</span>:
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>run-ansible-playbook</span>:
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>runs-on</span>: <span style=color:#ae81ff>ubuntu-latest</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>steps</span>:
|
|
</span></span><span style=display:flex><span> - <span style=color:#f92672>name</span>: <span style=color:#ae81ff>Check out repository code</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>uses</span>: <span style=color:#ae81ff>actions/checkout@v4</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#f92672>name</span>: <span style=color:#ae81ff>Install ansible</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>run</span>: |<span style=color:#e6db74>
|
|
</span></span></span><span style=display:flex><span><span style=color:#e6db74> apt update && apt install ansible -y</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#f92672>name</span>: <span style=color:#ae81ff>Run playbook</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>uses</span>: <span style=color:#ae81ff>dawidd6/action-ansible-playbook@v2</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>with</span>:
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>playbook</span>: <span style=color:#ae81ff>playbooks/main.yml</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>requirements</span>: <span style=color:#ae81ff>requirements.yml</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>options</span>: |<span style=color:#e6db74>
|
|
</span></span></span><span style=display:flex><span><span style=color:#e6db74> --inventory inventory</span>
|
|
</span></span><span style=display:flex><span> - <span style=color:#f92672>name</span>: <span style=color:#ae81ff>Send failure notification</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>uses</span>: <span style=color:#ae81ff>dawidd6/action-send-mail@v3</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>if</span>: <span style=color:#ae81ff>always() && failure()</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>with</span>:
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>server_address</span>: <span style=color:#ae81ff>smtp.gmail.com</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>server_port</span>: <span style=color:#ae81ff>465</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>secure</span>: <span style=color:#66d9ef>true</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>username</span>: <span style=color:#ae81ff>myuser</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>password</span>: <span style=color:#ae81ff>${{ secrets.MAIL_PASSWORD }}</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>subject</span>: <span style=color:#ae81ff>ansible runbook failed</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>to</span>: <span style=color:#ae81ff>me@davegallant.ca</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>from</span>: <span style=color:#ae81ff>RFD Notify</span>
|
|
</span></span><span style=display:flex><span> <span style=color:#f92672>body</span>: |<span style=color:#e6db74>
|
|
</span></span></span><span style=display:flex><span><span style=color:#e6db74> ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_number }}</span>
|
|
</span></span></code></pre></div><p>And voilà:</p><p><img src=gitea-workflow.png alt=image></p><p>You may be wondering how the gitea runner is allowed to connect to the other hosts using ansible? Well, the nodes are in the same tailnet and have <a href=https://tailscale.com/tailscale-ssh class=link--external target=_blank rel=noreferrer>tailscale ssh</a> enabled.</p><h2 id=areas-for-improvement>Areas for improvement<a href=#areas-for-improvement class=post-heading__anchor aria-hidden=true>#</a></h2><p>One enhancement that I would like to see is the ability to send notifications on workflow failures. Currently, this <a href=https://github.com/go-gitea/gitea/issues/23725 class=link--external target=_blank rel=noreferrer>doesn’t seem possible</a> without adding logic to each workflow.</p><h2 id=conclusion>Conclusion<a href=#conclusion class=post-heading__anchor aria-hidden=true>#</a></h2><p>Gitea Actions are fast and the resource footprint is minimal. My gitea instance is currently using around 250mb of memory and a small fraction of a single cpu core (and the runner is using a similar amount of resources). This is impressive since many alternatives tend to require substantially more resources. It likely helps that the codebase is largely written in go.</p><p>By combining gitea with the networking marvel that is tailscale, running workflows becomes simple and fun. Whether you are working on a team or working alone, this setup ensures that your workflows are securely accessible from anywhere with an internet connection.</p><p>Check out my gitea instance exposed via Funnel <a href=https://gitea.snake-cloud.ts.net class=link--external target=_blank rel=noreferrer>here</a>.</p></div><script type=text/javascript src=https://storage.ko-fi.com/cdn/widget/Widget_2.js></script><script type=text/javascript>kofiwidget2.init("Buy me a coffee","#32344a","F1F2S4LWI"),kofiwidget2.draw()</script><br><br><section id=comments class=comments><div class='container sep-before'><div class=comments><script>let theme="dark-blue",script=document.createElement("script");script.src="https://utteranc.es/client.js",script.setAttribute("repo","davegallant/site"),script.setAttribute("issue-term","pathname"),script.setAttribute("theme",theme),script.setAttribute("crossorigin","anonymous"),script.setAttribute("async",""),document.querySelector("div.comments").innerHTML="",document.querySelector("div.comments").appendChild(script)</script></div></div></section></article></div><div class=sidebar></div></main><footer><div class=copyright>Dave Gallant</div></footer><script src=/js/main.c26c1b7b76f4923d8125720886ede9ca08bfe20b924683914ba4c1c35d53667c6c2d764f5482d3860d36b9e58a50255bc22a03ff145555979852c5ec74f15e51.js></script><script src=/js/flexsearch.14d6ec971ca1482f729fabd3c5ebd8964fbdb7a063dd0de72d95551a1d8724aab0d0b94794be534bed8655a95929e44116e09ccda5ccd97d3a883b8e350e9344.js></script><script defer src=https://static.cloudflareinsights.com/beacon.min.js data-cf-beacon='{"token": "b96799f53f9940dca6f660e6052ba009"}'></script><script async src="https://www.googletagmanager.com/gtag/js?id=G-V8WJDERTX9"></script><script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-V8WJDERTX9",{anonymize_ip:!1})}</script></div></body></html> |