internal/config/config.go
518 lines · 18535 bytes
1// Package config loads and validates the gitbayd server configuration.
2package config
3
4import (
5 "crypto/ecdsa"
6 "crypto/x509"
7 "encoding/pem"
8 "errors"
9 "fmt"
10 "net"
11 "os"
12 "strconv"
13 "strings"
14 "time"
15
16 "github.com/BurntSushi/toml"
17)
18
19// DefaultWriteRate is the per-account write budget when the config leaves
20// write_rate at zero: generous for a person at a terminal, and a bound on
21// what one account can enqueue — every write also queues notification mail
22// and webhook deliveries.
23const DefaultWriteRate = 60
24
25type Config struct {
26 Server Server `toml:"server"`
27 SSH SSH `toml:"ssh"`
28 HTTP HTTP `toml:"http"`
29 GitDaemon GitDaemon `toml:"git_daemon"`
30 Web Web `toml:"web"`
31 Registration Registration `toml:"registration"`
32 API API `toml:"api"`
33 Webhooks Webhooks `toml:"webhooks"`
34 Pages Pages `toml:"pages"`
35 LFS LFS `toml:"lfs"`
36 Limits Limits `toml:"limits"`
37 Mail Mail `toml:"mail"`
38 Mirrors Mirrors `toml:"mirrors"`
39 Deps Deps `toml:"deps"`
40 Retention Retention `toml:"retention"`
41 Push Push `toml:"push"`
42 // GoImport maps vanity Go module paths to repositories, e.g.
43 // "gitbay.org/gitbay" = "krz/gitbay". Requests carrying ?go-get=1
44 // under a mapped path get a go-import meta tag.
45 GoImport map[string]string `toml:"go_import"`
46}
47
48type Server struct {
49 Root string `toml:"root"`
50 SiteURL string `toml:"site_url"`
51
52 // SourceRepo names the repository this instance develops itself in, as
53 // "owner/name". When set, startup warns if the running build's commit is
54 // not on that repository's default branch. Empty disables the check, which
55 // is right for any instance that does not host its own source.
56 SourceRepo string `toml:"source_repo"`
57}
58
59type SSH struct {
60 Mode string `toml:"mode"` // embedded | system
61 Port int `toml:"port"`
62 HostKeys []string `toml:"host_keys"`
63}
64
65type HTTP struct {
66 Addr string `toml:"addr"`
67 TLS string `toml:"tls"` // acme | files | off
68 CertFile string `toml:"cert_file"`
69 KeyFile string `toml:"key_file"`
70 // ACME (Let's Encrypt by default). Certificates are cached under
71 // server.root/acme. acme_http_addr serves HTTP-01 challenges and
72 // redirects to HTTPS; "off" disables it (TLS-ALPN-01 on the HTTPS
73 // port still works).
74 ACMEEmail string `toml:"acme_email"`
75 ACMEHTTPAddr string `toml:"acme_http_addr"`
76 // TrustedProxies are the addresses or CIDRs of reverse proxies in front
77 // of this process. A request from one of them is attributed to the
78 // last X-Forwarded-For hop that is not itself a trusted proxy; from
79 // anyone else the peer address is the client and the header is
80 // ignored. Empty means no proxy, which is how gitbayd is deployed by
81 // default: it terminates TLS itself.
82 TrustedProxies []string `toml:"trusted_proxies,omitempty"`
83}
84
85type GitDaemon struct {
86 Enabled bool `toml:"enabled"`
87 Port int `toml:"port"`
88}
89
90type Web struct {
91 Mode string `toml:"mode"` // view_only | accounts
92 PasswordAuth bool `toml:"password_auth"`
93 // Title is the instance's display name in the header and page titles.
94 // Empty falls back to the site host.
95 Title string `toml:"title"`
96 // PrivacyNotice is operator-provided text shown on /privacy under the
97 // fixed project-level statement. Plain text; blank paragraphs split.
98 PrivacyNotice string `toml:"privacy_notice"`
99}
100
101type Registration struct {
102 Mode string `toml:"mode"` // closed | invite | open
103 // PendingExpiry is how long a self-registered account may stay
104 // unverified before it is removed, as a duration ("168h"). Empty
105 // keeps such accounts forever.
106 PendingExpiry string `toml:"pending_expiry"`
107 // NotifyAdmin mails the instance's admins when an account becomes
108 // active: an invite redeemed, or an open-mode signup that verified
109 // its address. The unverified row an open signup creates is not
110 // reported — anyone can post the form, so mailing on that would
111 // aim a flood at the admins (#234).
112 NotifyAdmin bool `toml:"notify_admin"`
113}
114
115// PendingExpiryDuration parses PendingExpiry; zero means never.
116func (r Registration) PendingExpiryDuration() time.Duration {
117 d, _ := time.ParseDuration(r.PendingExpiry)
118 return d
119}
120
121// Retention is how long the append-only tables keep a row. Each is a
122// duration string ("2160h"); empty or zero keeps forever, which is what
123// an instance that has never configured this gets. Expired sessions and
124// tokens are swept regardless: they are dead weight the moment they
125// expire and no setting makes them worth keeping.
126type Retention struct {
127 Audit string `toml:"audit"`
128 Events string `toml:"events"`
129 WebhookDeliveries string `toml:"webhook_deliveries"`
130 // Mail is the outbound queue: rows already sent or given up on.
131 Mail string `toml:"mail"`
132 // Push is the outbound device queue: rows already sent or given up on.
133 Push string `toml:"push"`
134}
135
136// Durations parses the five, mapping each to zero when unset or bad.
137func (r Retention) Durations() (audit, events, deliveries, mail, push time.Duration) {
138 parse := func(s string) time.Duration {
139 d, err := time.ParseDuration(s)
140 if err != nil || d < 0 {
141 return 0
142 }
143 return d
144 }
145 return parse(r.Audit), parse(r.Events), parse(r.WebhookDeliveries), parse(r.Mail), parse(r.Push)
146}
147
148// LFS stores large-file objects content-addressed under Root (default
149// <server.root>/lfs). MaxObjectBytes caps a single object; 0 means the
150// 512MB default.
151type LFS struct {
152 Root string `toml:"root"`
153 MaxObjectBytes int64 `toml:"max_object_bytes"`
154}
155
156// Pages serves each public repo's `pages` branch as a static site on
157// <owner>.<domain> — a separate origin, so page-authored scripts never run
158// on the forge's own host. Empty domain disables the feature.
159type Pages struct {
160 Domain string `toml:"domain"`
161}
162
163// API controls the HTTPS/JSON control-plane API (bearer tokens minted over
164// SSH). Off by default: an instance that never enables it has no
165// credential-bearing HTTP surface at all.
166type API struct {
167 Enabled bool `toml:"enabled"`
168}
169
170// Webhooks controls outbound delivery. AllowLocal permits endpoints on
171// loopback/private addresses (off by default: SSRF).
172type Webhooks struct {
173 AllowLocal bool `toml:"allow_local"`
174}
175
176type Mirrors struct {
177 PullIntervalMinutes int `toml:"pull_interval_minutes"`
178}
179
180// Deps configures the dependency-update sweep. It runs only for repos that
181// have opted in with `repo deps enable`, because checking a private repo
182// tells a public registry what it depends on.
183type Deps struct {
184 CheckIntervalHours int `toml:"check_interval_hours"`
185}
186
187type Limits struct {
188 MaxPackBytes int64 `toml:"max_pack_bytes"`
189 MaxBlobBytes int64 `toml:"max_blob_bytes"`
190 MaxAssetBytes int64 `toml:"max_asset_bytes"` // per release asset
191 MaxSnippetBytes int64 `toml:"max_snippet_bytes"` // per snippet file
192 // MaxSnippetsPerUser caps snippets an account may own. 0 means
193 // unlimited, like MaxReposPerUser.
194 MaxSnippetsPerUser int `toml:"max_snippets_per_user"`
195 CloneTimeoutSec int `toml:"clone_timeout"`
196 SSHAuthRate int `toml:"ssh_auth_rate"`
197 // APIRate is sustained JSON-API requests per minute per caller; writes
198 // draw on a tenth of it. 0 uses the default.
199 APIRate int `toml:"api_rate"`
200 // WriteRate is sustained mutating commands per minute per account,
201 // counted in the dispatcher so every surface shares one budget. 0 uses
202 // the default; a negative value turns the limit off.
203 WriteRate int `toml:"write_rate"`
204 // Per-account quotas on what a user owns directly (organizations are
205 // not capped). 0 means unlimited; admin user limits overrides per
206 // account.
207 MaxReposPerUser int `toml:"max_repos_per_user"`
208 MaxBytesPerUser int64 `toml:"max_bytes_per_user"`
209}
210
211type Mail struct {
212 SMTPHost string `toml:"smtp_host"` // host:port (port defaults to 587, 465 with tls = "implicit")
213 From string `toml:"from"`
214 SMTPUser string `toml:"smtp_user,omitempty"`
215 SMTPPass string `toml:"smtp_pass,omitempty"`
216 // RequireTLS fails delivery when the relay does not offer STARTTLS,
217 // instead of sending in clear. Unset, it is on for any relay but
218 // localhost or a loopback address (TLSRequired).
219 RequireTLS *bool `toml:"require_tls,omitempty"`
220 // TLS is "starttls" (the default, also when empty) or "implicit":
221 // TLS from the first byte, as relays on port 465 expect.
222 TLS string `toml:"tls,omitempty"`
223}
224
225// TLSRequired reports whether mail must not go to the relay in clear.
226func (m Mail) TLSRequired() bool {
227 if m.RequireTLS != nil {
228 return *m.RequireTLS
229 }
230 host := m.SMTPHost
231 if h, _, err := net.SplitHostPort(host); err == nil {
232 host = h
233 }
234 host = strings.Trim(host, "[]")
235 if host == "localhost" {
236 return false
237 }
238 ip := net.ParseIP(host)
239 return ip == nil || !ip.IsLoopback()
240}
241
242// Push is APNs delivery to registered Apple devices. A key belongs to a
243// bundle ID, so an instance pushes to the app built under the topic named
244// here and no other; a self-hoster points this at their own key and their
245// own build.
246type Push struct {
247 Enabled bool `toml:"enabled"`
248 KeyFile string `toml:"key_file"`
249 KeyID string `toml:"key_id"`
250 TeamID string `toml:"team_id"`
251 Topic string `toml:"topic"` // the app's bundle identifier
252 // Environment is a name rather than a URL so a typo cannot aim the
253 // key at a host that is not Apple's.
254 Environment string `toml:"environment"` // production | sandbox
255}
256
257// Host is the APNs endpoint for the configured environment.
258// GITBAY_APNS_HOST overrides it for tests, as GITBAY_SWEEP_TICK does for
259// the retention sweep.
260func (p Push) Host() string {
261 if h := os.Getenv("GITBAY_APNS_HOST"); h != "" {
262 return h
263 }
264 if p.Environment == "sandbox" {
265 return "api.sandbox.push.apple.com"
266 }
267 return "api.push.apple.com"
268}
269
270// LoadAPNSKey reads Apple's .p8 provider key: a PEM-wrapped PKCS#8
271// P-256 private key. Read at startup and validated there, so a
272// misconfigured [push] refuses to start rather than filling a queue
273// nobody is watching.
274func LoadAPNSKey(path string) (*ecdsa.PrivateKey, error) {
275 data, err := os.ReadFile(path)
276 if err != nil {
277 return nil, err
278 }
279 block, _ := pem.Decode(data)
280 if block == nil {
281 return nil, errors.New("not PEM")
282 }
283 any, err := x509.ParsePKCS8PrivateKey(block.Bytes)
284 if err != nil {
285 return nil, err
286 }
287 key, ok := any.(*ecdsa.PrivateKey)
288 if !ok {
289 return nil, errors.New("not an EC private key")
290 }
291 return key, nil
292}
293
294// Default returns the configuration used when a key is absent from the file.
295func Default() Config {
296 return Config{
297 Server: Server{Root: "/var/lib/gitbay"},
298 SSH: SSH{Mode: "embedded", Port: 22},
299 HTTP: HTTP{Addr: ":443", TLS: "acme", ACMEHTTPAddr: ":80"},
300 Web: Web{Mode: "view_only"},
301 Registration: Registration{
302 Mode: "closed",
303 },
304 GitDaemon: GitDaemon{Port: 9418},
305 Mirrors: Mirrors{PullIntervalMinutes: 15},
306 Deps: Deps{CheckIntervalHours: 24},
307 Limits: Limits{
308 MaxPackBytes: 2 << 30, // 2 GiB
309 MaxBlobBytes: 100 << 20,
310 MaxAssetBytes: 512 << 20,
311 MaxSnippetBytes: 1 << 20,
312 CloneTimeoutSec: 3600,
313 SSHAuthRate: 10,
314 APIRate: 120,
315 },
316 }
317}
318
319// Load reads path, applies defaults, and validates. It does not probe the
320// host (see CheckHost) so it is safe in tests and on non-target machines.
321func Load(path string) (Config, error) {
322 cfg := Default()
323 md, err := toml.DecodeFile(path, &cfg)
324 if err != nil {
325 return cfg, err
326 }
327 if u := md.Undecoded(); len(u) > 0 {
328 return cfg, fmt.Errorf("unknown config key %q", u[0].String())
329 }
330 return cfg, cfg.Validate()
331}
332
333func oneOf(field, val string, allowed ...string) error {
334 for _, a := range allowed {
335 if val == a {
336 return nil
337 }
338 }
339 return fmt.Errorf("%s must be one of %v, got %q", field, allowed, val)
340}
341
342// Validate applies the static contradiction checks from the plan.
343func (c Config) Validate() error {
344 var errs []error
345
346 if c.Server.Root == "" {
347 errs = append(errs, errors.New("server.root is required"))
348 }
349 if d := c.Pages.Domain; d != "" {
350 if d == c.SiteHost() {
351 errs = append(errs, errors.New("pages.domain must differ from the site host: pages serve repo-authored scripts, which must not run on the forge's origin"))
352 }
353 if strings.HasSuffix(c.SiteHost(), "."+d) {
354 errs = append(errs, errors.New("pages.domain must not be a parent of the site host"))
355 }
356 }
357 if c.Server.SiteURL == "" {
358 errs = append(errs, errors.New("server.site_url is required"))
359 }
360 if err := oneOf("ssh.mode", c.SSH.Mode, "embedded", "system"); err != nil {
361 errs = append(errs, err)
362 }
363 if c.Registration.PendingExpiry != "" {
364 if d, err := time.ParseDuration(c.Registration.PendingExpiry); err != nil || d <= 0 {
365 errs = append(errs, fmt.Errorf("registration.pending_expiry %q must be a positive duration such as 168h", c.Registration.PendingExpiry))
366 }
367 }
368 if c.Limits.MaxReposPerUser < 0 || c.Limits.MaxBytesPerUser < 0 || c.Limits.MaxSnippetsPerUser < 0 {
369 errs = append(errs, errors.New("limits.max_repos_per_user, max_bytes_per_user and max_snippets_per_user must not be negative"))
370 }
371 if c.Push.Enabled {
372 for _, f := range []struct{ name, val string }{
373 {"push.key_file", c.Push.KeyFile},
374 {"push.key_id", c.Push.KeyID},
375 {"push.team_id", c.Push.TeamID},
376 {"push.topic", c.Push.Topic},
377 } {
378 if f.val == "" {
379 errs = append(errs, fmt.Errorf("%s is required when push.enabled", f.name))
380 }
381 }
382 if err := oneOf("push.environment", c.Push.Environment, "production", "sandbox"); err != nil {
383 errs = append(errs, err)
384 }
385 if c.Push.KeyFile != "" {
386 if _, err := LoadAPNSKey(c.Push.KeyFile); err != nil {
387 errs = append(errs, fmt.Errorf("push.key_file: %w", err))
388 }
389 }
390 }
391 if c.SSH.Port < 1 || c.SSH.Port > 65535 {
392 errs = append(errs, fmt.Errorf("ssh.port %d out of range", c.SSH.Port))
393 }
394 if err := oneOf("http.tls", c.HTTP.TLS, "acme", "files", "off"); err != nil {
395 errs = append(errs, err)
396 }
397 if _, err := c.HTTP.TrustedProxyNets(); err != nil {
398 errs = append(errs, err)
399 }
400 if c.HTTP.TLS == "files" && (c.HTTP.CertFile == "" || c.HTTP.KeyFile == "") {
401 errs = append(errs, errors.New("http.tls = \"files\" requires cert_file and key_file"))
402 }
403 if c.HTTP.TLS == "acme" {
404 host := c.SiteHost()
405 switch {
406 case !strings.HasPrefix(c.Server.SiteURL, "https://"):
407 errs = append(errs, errors.New("http.tls = \"acme\" requires an https:// site_url: certificates are issued for that host"))
408 case host == "" || host == "localhost" || net.ParseIP(host) != nil:
409 errs = append(errs, fmt.Errorf("http.tls = \"acme\" cannot issue a certificate for %q: use a public DNS name in site_url", host))
410 }
411 }
412 if err := oneOf("web.mode", c.Web.Mode, "view_only", "accounts"); err != nil {
413 errs = append(errs, err)
414 }
415 if err := oneOf("registration.mode", c.Registration.Mode, "closed", "invite", "open"); err != nil {
416 errs = append(errs, err)
417 }
418
419 for module, repo := range c.GoImport {
420 host, _, ok := strings.Cut(module, "/")
421 if !ok || host == "" || !strings.Contains(host, ".") {
422 errs = append(errs, fmt.Errorf("go_import key %q must be host/path (e.g. gitbay.org/gitbay)", module))
423 }
424 if parts := strings.Split(repo, "/"); len(parts) != 2 || parts[0] == "" || parts[1] == "" {
425 errs = append(errs, fmt.Errorf("go_import value %q must be owner/name", repo))
426 }
427 }
428
429 // Contradictions.
430 if c.Mail.SMTPHost != "" && c.Mail.From == "" {
431 errs = append(errs, errors.New("[mail] from is required when smtp_host is set"))
432 }
433 if t := c.Mail.TLS; t != "" && t != "starttls" && t != "implicit" {
434 errs = append(errs, fmt.Errorf("mail.tls must be starttls or implicit, got %q", t))
435 }
436 if c.Registration.Mode != "closed" && c.Mail.SMTPHost == "" {
437 errs = append(errs, fmt.Errorf(
438 "registration.mode = %q requires [mail] smtp_host: email verification cannot run without SMTP",
439 c.Registration.Mode))
440 }
441 if c.Registration.NotifyAdmin && c.Mail.SMTPHost == "" {
442 errs = append(errs, errors.New(
443 "registration.notify_admin = true requires [mail] smtp_host: there is nowhere to send the notice"))
444 }
445 if c.SSH.Mode == "system" && c.Registration.Mode != "closed" {
446 errs = append(errs, fmt.Errorf(
447 "ssh.mode = \"system\" requires registration.mode = \"closed\": host sshd rejects unknown keys before the dispatcher runs, so registration by unknown key is impossible"))
448 }
449 if c.Web.PasswordAuth && c.Web.Mode == "view_only" {
450 errs = append(errs, errors.New(
451 "web.password_auth = true is meaningless with web.mode = \"view_only\": no login route exists"))
452 }
453 if c.Web.PasswordAuth && c.Web.Mode == "accounts" {
454 errs = append(errs, errors.New(
455 "web.password_auth is not implemented yet; browser sessions are minted over SSH (gitbay web login)"))
456 }
457
458 return errors.Join(errs...)
459}
460
461// SiteHost returns the bare hostname from site_url (no scheme, port, path).
462func (c Config) SiteHost() string {
463 h := strings.TrimPrefix(strings.TrimPrefix(c.Server.SiteURL, "https://"), "http://")
464 h = strings.TrimSuffix(h, "/")
465 if i := strings.IndexByte(h, '/'); i >= 0 {
466 h = h[:i]
467 }
468 if host, _, err := net.SplitHostPort(h); err == nil {
469 return host
470 }
471 return h
472}
473
474// CheckHost performs environment probes that only make sense on the target
475// machine: port availability for the embedded listener and root existence.
476func (c Config) CheckHost() error {
477 var errs []error
478
479 if st, err := os.Stat(c.Server.Root); err != nil {
480 errs = append(errs, fmt.Errorf("server.root: %w", err))
481 } else if !st.IsDir() {
482 errs = append(errs, fmt.Errorf("server.root %q is not a directory", c.Server.Root))
483 }
484
485 if c.SSH.Mode == "embedded" {
486 addr := net.JoinHostPort("", strconv.Itoa(c.SSH.Port))
487 ln, err := net.Listen("tcp", addr)
488 if err != nil {
489 errs = append(errs, fmt.Errorf("ssh.port %d is not bindable (already in use by another daemon?): %w", c.SSH.Port, err))
490 } else {
491 ln.Close()
492 }
493 }
494
495 return errors.Join(errs...)
496}
497
498// TrustedProxyNets parses http.trusted_proxies; a bare address is a /32
499// or /128.
500func (h HTTP) TrustedProxyNets() ([]*net.IPNet, error) {
501 var nets []*net.IPNet
502 for _, p := range h.TrustedProxies {
503 if _, n, err := net.ParseCIDR(p); err == nil {
504 nets = append(nets, n)
505 continue
506 }
507 ip := net.ParseIP(p)
508 if ip == nil {
509 return nil, fmt.Errorf("http.trusted_proxies: %q is not an address or CIDR", p)
510 }
511 bits := 32
512 if ip.To4() == nil {
513 bits = 128
514 }
515 nets = append(nets, &net.IPNet{IP: ip, Mask: net.CIDRMask(bits, bits)})
516 }
517 return nets, nil
518}