internal/config/config.go
598 lines · 21525 bytes
1// Package config loads and validates the gitbayd server configuration.
2package config
3
4import (
5 "crypto/ecdsa"
6 "crypto/x509"
7 "encoding/pem"
8 "errors"
9 "fmt"
10 "net"
11 "os"
12 "path/filepath"
13 "strconv"
14 "strings"
15 "time"
16
17 "filippo.io/age"
18 "github.com/BurntSushi/toml"
19)
20
21// DefaultWriteRate is the per-account write budget when the config leaves
22// write_rate at zero: generous for a person at a terminal, and a bound on
23// what one account can enqueue — every write also queues notification mail
24// and webhook deliveries.
25const DefaultWriteRate = 60
26
27type Config struct {
28 Server Server `toml:"server"`
29 SSH SSH `toml:"ssh"`
30 HTTP HTTP `toml:"http"`
31 GitDaemon GitDaemon `toml:"git_daemon"`
32 Web Web `toml:"web"`
33 Registration Registration `toml:"registration"`
34 API API `toml:"api"`
35 Webhooks Webhooks `toml:"webhooks"`
36 Pages Pages `toml:"pages"`
37 LFS LFS `toml:"lfs"`
38 Limits Limits `toml:"limits"`
39 Mail Mail `toml:"mail"`
40 Mirrors Mirrors `toml:"mirrors"`
41 Deps Deps `toml:"deps"`
42 Retention Retention `toml:"retention"`
43 Push Push `toml:"push"`
44 Backup Backup `toml:"backup"`
45 // GoImport maps vanity Go module paths to repositories, e.g.
46 // "gitbay.org/gitbay" = "krz/gitbay". Requests carrying ?go-get=1
47 // under a mapped path get a go-import meta tag.
48 GoImport map[string]string `toml:"go_import"`
49}
50
51type Server struct {
52 Root string `toml:"root"`
53 SiteURL string `toml:"site_url"`
54
55 // SourceRepo names the repository this instance develops itself in, as
56 // "owner/name". When set, startup warns if the running build's commit is
57 // not on that repository's default branch. Empty disables the check, which
58 // is right for any instance that does not host its own source.
59 SourceRepo string `toml:"source_repo"`
60
61 // SecretKeyFile holds the keys that seal the secret columns of the
62 // database (internal/seal). It lives outside Root, so neither a
63 // backup archive nor a snapshot of Root carries it.
64 SecretKeyFile string `toml:"secret_key_file"`
65}
66
67type SSH struct {
68 Mode string `toml:"mode"` // embedded | system
69 Port int `toml:"port"`
70 HostKeys []string `toml:"host_keys"`
71}
72
73type HTTP struct {
74 Addr string `toml:"addr"`
75 TLS string `toml:"tls"` // acme | files | off
76 CertFile string `toml:"cert_file"`
77 KeyFile string `toml:"key_file"`
78 // ACME (Let's Encrypt by default). Certificates are cached under
79 // server.root/acme. acme_http_addr serves HTTP-01 challenges and
80 // redirects to HTTPS; "off" disables it (TLS-ALPN-01 on the HTTPS
81 // port still works).
82 ACMEEmail string `toml:"acme_email"`
83 ACMEHTTPAddr string `toml:"acme_http_addr"`
84 // TrustedProxies are the addresses or CIDRs of reverse proxies in front
85 // of this process. A request from one of them is attributed to the
86 // last X-Forwarded-For hop that is not itself a trusted proxy; from
87 // anyone else the peer address is the client and the header is
88 // ignored. Empty means no proxy, which is how gitbayd is deployed by
89 // default: it terminates TLS itself.
90 TrustedProxies []string `toml:"trusted_proxies,omitempty"`
91}
92
93type GitDaemon struct {
94 Enabled bool `toml:"enabled"`
95 Port int `toml:"port"`
96}
97
98type Web struct {
99 Mode string `toml:"mode"` // view_only | accounts
100 PasswordAuth bool `toml:"password_auth"`
101 // Title is the instance's display name in the header and page titles.
102 // Empty falls back to the site host.
103 Title string `toml:"title"`
104 // PrivacyNotice is operator-provided text shown on /privacy under the
105 // fixed project-level statement. Plain text; blank paragraphs split.
106 PrivacyNotice string `toml:"privacy_notice"`
107}
108
109type Registration struct {
110 Mode string `toml:"mode"` // closed | invite | open
111 // PendingExpiry is how long a self-registered account may stay
112 // unverified before it is removed, as a duration ("168h"). Empty
113 // keeps such accounts forever.
114 PendingExpiry string `toml:"pending_expiry"`
115 // NotifyAdmin mails the instance's admins when an account becomes
116 // active: an invite redeemed, or an open-mode signup that verified
117 // its address. The unverified row an open signup creates is not
118 // reported — anyone can post the form, so mailing on that would
119 // aim a flood at the admins (#234).
120 NotifyAdmin bool `toml:"notify_admin"`
121}
122
123// PendingExpiryDuration parses PendingExpiry; zero means never.
124func (r Registration) PendingExpiryDuration() time.Duration {
125 d, _ := time.ParseDuration(r.PendingExpiry)
126 return d
127}
128
129// Retention is how long the append-only tables keep a row. Each is a
130// duration string ("2160h"); empty or zero keeps forever, which is what
131// an instance that has never configured this gets. Expired sessions and
132// tokens are swept regardless: they are dead weight the moment they
133// expire and no setting makes them worth keeping.
134type Retention struct {
135 Audit string `toml:"audit"`
136 Events string `toml:"events"`
137 WebhookDeliveries string `toml:"webhook_deliveries"`
138 // Mail is the outbound queue: rows already sent or given up on.
139 Mail string `toml:"mail"`
140 // Push is the outbound device queue: rows already sent or given up on.
141 Push string `toml:"push"`
142}
143
144// Durations parses the five, mapping each to zero when unset or bad.
145func (r Retention) Durations() (audit, events, deliveries, mail, push time.Duration) {
146 parse := func(s string) time.Duration {
147 d, err := time.ParseDuration(s)
148 if err != nil || d < 0 {
149 return 0
150 }
151 return d
152 }
153 return parse(r.Audit), parse(r.Events), parse(r.WebhookDeliveries), parse(r.Mail), parse(r.Push)
154}
155
156// LFS stores large-file objects content-addressed under Root (default
157// <server.root>/lfs). MaxObjectBytes caps a single object; 0 means the
158// 512MB default.
159type LFS struct {
160 Root string `toml:"root"`
161 MaxObjectBytes int64 `toml:"max_object_bytes"`
162}
163
164// Pages serves each public repo's `pages` branch as a static site on
165// <owner>.<domain> — a separate origin, so page-authored scripts never run
166// on the forge's own host. Empty domain disables the feature.
167type Pages struct {
168 Domain string `toml:"domain"`
169}
170
171// API controls the HTTPS/JSON control-plane API (bearer tokens minted over
172// SSH). Off by default: an instance that never enables it has no
173// credential-bearing HTTP surface at all.
174type API struct {
175 Enabled bool `toml:"enabled"`
176}
177
178// Webhooks controls outbound delivery. AllowLocal permits endpoints on
179// loopback/private addresses (off by default: SSRF).
180type Webhooks struct {
181 AllowLocal bool `toml:"allow_local"`
182}
183
184type Mirrors struct {
185 PullIntervalMinutes int `toml:"pull_interval_minutes"`
186}
187
188// Deps configures the dependency-update sweep. It runs only for repos that
189// have opted in with `repo deps enable`, because checking a private repo
190// tells a public registry what it depends on.
191type Deps struct {
192 CheckIntervalHours int `toml:"check_interval_hours"`
193}
194
195type Limits struct {
196 MaxPackBytes int64 `toml:"max_pack_bytes"`
197 MaxBlobBytes int64 `toml:"max_blob_bytes"`
198 MaxAssetBytes int64 `toml:"max_asset_bytes"` // per release asset
199 MaxSnippetBytes int64 `toml:"max_snippet_bytes"` // per snippet file
200 // MaxSnippetsPerUser caps snippets an account may own. 0 means
201 // unlimited, like MaxReposPerUser.
202 MaxSnippetsPerUser int `toml:"max_snippets_per_user"`
203 CloneTimeoutSec int `toml:"clone_timeout"`
204 SSHAuthRate int `toml:"ssh_auth_rate"`
205 // APIRate is sustained JSON-API requests per minute per caller; writes
206 // draw on a tenth of it. 0 uses the default.
207 APIRate int `toml:"api_rate"`
208 // WriteRate is sustained mutating commands per minute per account,
209 // counted in the dispatcher so every surface shares one budget. 0 uses
210 // the default; a negative value turns the limit off.
211 WriteRate int `toml:"write_rate"`
212 // Per-account quotas on what a user owns directly (organizations are
213 // not capped). 0 means unlimited; admin user limits overrides per
214 // account.
215 MaxReposPerUser int `toml:"max_repos_per_user"`
216 MaxBytesPerUser int64 `toml:"max_bytes_per_user"`
217}
218
219type Mail struct {
220 SMTPHost string `toml:"smtp_host"` // host:port (port defaults to 587, 465 with tls = "implicit")
221 From string `toml:"from"`
222 SMTPUser string `toml:"smtp_user,omitempty"`
223 SMTPPass string `toml:"smtp_pass,omitempty"`
224 // RequireTLS fails delivery when the relay does not offer STARTTLS,
225 // instead of sending in clear. Unset, it is on for any relay but
226 // localhost or a loopback address (TLSRequired).
227 RequireTLS *bool `toml:"require_tls,omitempty"`
228 // TLS is "starttls" (the default, also when empty) or "implicit":
229 // TLS from the first byte, as relays on port 465 expect.
230 TLS string `toml:"tls,omitempty"`
231}
232
233// TLSRequired reports whether mail must not go to the relay in clear.
234func (m Mail) TLSRequired() bool {
235 if m.RequireTLS != nil {
236 return *m.RequireTLS
237 }
238 host := m.SMTPHost
239 if h, _, err := net.SplitHostPort(host); err == nil {
240 host = h
241 }
242 host = strings.Trim(host, "[]")
243 if host == "localhost" {
244 return false
245 }
246 ip := net.ParseIP(host)
247 return ip == nil || !ip.IsLoopback()
248}
249
250// Push is APNs delivery to registered Apple devices. A key belongs to a
251// bundle ID, so an instance pushes to the app built under the topic named
252// here and no other; a self-hoster points this at their own key and their
253// own build.
254type Push struct {
255 Enabled bool `toml:"enabled"`
256 KeyFile string `toml:"key_file"`
257 KeyID string `toml:"key_id"`
258 TeamID string `toml:"team_id"`
259 Topic string `toml:"topic"` // the app's bundle identifier
260 // Environment is a name rather than a URL so a typo cannot aim the
261 // key at a host that is not Apple's.
262 Environment string `toml:"environment"` // production | sandbox
263}
264
265// Host is the APNs endpoint for the configured environment.
266// GITBAY_APNS_HOST overrides it for tests, as GITBAY_SWEEP_TICK does for
267// the retention sweep.
268func (p Push) Host() string {
269 if h := os.Getenv("GITBAY_APNS_HOST"); h != "" {
270 return h
271 }
272 if p.Environment == "sandbox" {
273 return "api.sandbox.push.apple.com"
274 }
275 return "api.push.apple.com"
276}
277
278// LoadAPNSKey reads Apple's .p8 provider key: a PEM-wrapped PKCS#8
279// P-256 private key. Read at startup and validated there, so a
280// misconfigured [push] refuses to start rather than filling a queue
281// nobody is watching.
282func LoadAPNSKey(path string) (*ecdsa.PrivateKey, error) {
283 data, err := os.ReadFile(path)
284 if err != nil {
285 return nil, err
286 }
287 block, _ := pem.Decode(data)
288 if block == nil {
289 return nil, errors.New("not PEM")
290 }
291 any, err := x509.ParsePKCS8PrivateKey(block.Bytes)
292 if err != nil {
293 return nil, err
294 }
295 key, ok := any.(*ecdsa.PrivateKey)
296 if !ok {
297 return nil, errors.New("not an EC private key")
298 }
299 return key, nil
300}
301
302// Backup configures gitbayd admin backup.
303type Backup struct {
304 // AgeRecipients, when set, encrypts every archive to these age
305 // public keys (age1...). The matching identities stay off the host,
306 // so the host writes archives it cannot read.
307 AgeRecipients []string `toml:"age_recipients"`
308}
309
310// Recipients parses AgeRecipients.
311func (b Backup) Recipients() ([]age.Recipient, error) {
312 var rs []age.Recipient
313 for _, s := range b.AgeRecipients {
314 r, err := age.ParseX25519Recipient(s)
315 if err != nil {
316 return nil, fmt.Errorf("backup.age_recipients: %q: %w", s, err)
317 }
318 rs = append(rs, r)
319 }
320 return rs, nil
321}
322
323// Default returns the configuration used when a key is absent from the file.
324func Default() Config {
325 return Config{
326 Server: Server{Root: "/var/lib/gitbay", SecretKeyFile: "/etc/gitbay/secret.key"},
327 SSH: SSH{Mode: "embedded", Port: 22},
328 HTTP: HTTP{Addr: ":443", TLS: "acme", ACMEHTTPAddr: ":80"},
329 Web: Web{Mode: "view_only"},
330 Registration: Registration{
331 Mode: "closed",
332 },
333 GitDaemon: GitDaemon{Port: 9418},
334 Mirrors: Mirrors{PullIntervalMinutes: 15},
335 Deps: Deps{CheckIntervalHours: 24},
336 Limits: Limits{
337 MaxPackBytes: 2 << 30, // 2 GiB
338 MaxBlobBytes: 100 << 20,
339 MaxAssetBytes: 512 << 20,
340 MaxSnippetBytes: 1 << 20,
341 CloneTimeoutSec: 3600,
342 SSHAuthRate: 10,
343 APIRate: 120,
344 },
345 }
346}
347
348// Load reads path, applies defaults, and validates. It does not probe the
349// host (see CheckHost) so it is safe in tests and on non-target machines.
350func Load(path string) (Config, error) {
351 cfg := Default()
352 md, err := toml.DecodeFile(path, &cfg)
353 if err != nil {
354 return cfg, err
355 }
356 if u := md.Undecoded(); len(u) > 0 {
357 return cfg, fmt.Errorf("unknown config key %q", u[0].String())
358 }
359 return cfg, cfg.Validate()
360}
361
362// within reports whether path is dir or below it. Both are compared as
363// cleaned absolute paths (a relative path resolves against the working
364// directory, same as every other path in this config), with symlinks
365// resolved where the path exists on disk, so a path that reaches into dir
366// through a symlink, or through "..", is still reported as inside.
367func within(dir, path string) bool {
368 dir, path = resolvePath(dir), resolvePath(path)
369 rel, err := filepath.Rel(dir, path)
370 return err == nil && rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
371}
372
373// resolvePath returns path as a cleaned absolute path, resolving symlinks in
374// it. The secret key file commonly does not exist yet (it is created by
375// `gitbayd admin secrets init`), and on this platform /var itself is a
376// symlink, so a whole-path resolution is tried first and, failing that, each
377// ancestor directory in turn, walking up to the nearest one that exists and
378// reattaching the missing suffix — a symlinked ancestor still resolves even
379// though the leaf, or several levels above it, does not exist.
380func resolvePath(path string) string {
381 abs, err := filepath.Abs(path)
382 if err != nil {
383 return filepath.Clean(path)
384 }
385 dir := abs
386 var suffix []string
387 for {
388 if resolved, err := filepath.EvalSymlinks(dir); err == nil {
389 for i := len(suffix) - 1; i >= 0; i-- {
390 resolved = filepath.Join(resolved, suffix[i])
391 }
392 return resolved
393 }
394 parent := filepath.Dir(dir)
395 if parent == dir {
396 return abs
397 }
398 suffix = append(suffix, filepath.Base(dir))
399 dir = parent
400 }
401}
402
403func oneOf(field, val string, allowed ...string) error {
404 for _, a := range allowed {
405 if val == a {
406 return nil
407 }
408 }
409 return fmt.Errorf("%s must be one of %v, got %q", field, allowed, val)
410}
411
412// Validate applies the static contradiction checks from the plan.
413func (c Config) Validate() error {
414 var errs []error
415
416 if c.Server.Root == "" {
417 errs = append(errs, errors.New("server.root is required"))
418 }
419 if d := c.Pages.Domain; d != "" {
420 if d == c.SiteHost() {
421 errs = append(errs, errors.New("pages.domain must differ from the site host: pages serve repo-authored scripts, which must not run on the forge's origin"))
422 }
423 if strings.HasSuffix(c.SiteHost(), "."+d) {
424 errs = append(errs, errors.New("pages.domain must not be a parent of the site host"))
425 }
426 }
427 if c.Server.SiteURL == "" {
428 errs = append(errs, errors.New("server.site_url is required"))
429 }
430 switch {
431 case c.Server.SecretKeyFile == "":
432 errs = append(errs, errors.New("server.secret_key_file is required"))
433 case within(c.Server.Root, c.Server.SecretKeyFile):
434 errs = append(errs, fmt.Errorf("server.secret_key_file %q is inside server.root: backups of the root would carry the key beside the values it seals", c.Server.SecretKeyFile))
435 }
436 if err := oneOf("ssh.mode", c.SSH.Mode, "embedded", "system"); err != nil {
437 errs = append(errs, err)
438 }
439 if c.Registration.PendingExpiry != "" {
440 if d, err := time.ParseDuration(c.Registration.PendingExpiry); err != nil || d <= 0 {
441 errs = append(errs, fmt.Errorf("registration.pending_expiry %q must be a positive duration such as 168h", c.Registration.PendingExpiry))
442 }
443 }
444 if c.Limits.MaxReposPerUser < 0 || c.Limits.MaxBytesPerUser < 0 || c.Limits.MaxSnippetsPerUser < 0 {
445 errs = append(errs, errors.New("limits.max_repos_per_user, max_bytes_per_user and max_snippets_per_user must not be negative"))
446 }
447 if c.Push.Enabled {
448 for _, f := range []struct{ name, val string }{
449 {"push.key_file", c.Push.KeyFile},
450 {"push.key_id", c.Push.KeyID},
451 {"push.team_id", c.Push.TeamID},
452 {"push.topic", c.Push.Topic},
453 } {
454 if f.val == "" {
455 errs = append(errs, fmt.Errorf("%s is required when push.enabled", f.name))
456 }
457 }
458 if err := oneOf("push.environment", c.Push.Environment, "production", "sandbox"); err != nil {
459 errs = append(errs, err)
460 }
461 if c.Push.KeyFile != "" {
462 if _, err := LoadAPNSKey(c.Push.KeyFile); err != nil {
463 errs = append(errs, fmt.Errorf("push.key_file: %w", err))
464 }
465 }
466 }
467 if c.SSH.Port < 1 || c.SSH.Port > 65535 {
468 errs = append(errs, fmt.Errorf("ssh.port %d out of range", c.SSH.Port))
469 }
470 if err := oneOf("http.tls", c.HTTP.TLS, "acme", "files", "off"); err != nil {
471 errs = append(errs, err)
472 }
473 if _, err := c.HTTP.TrustedProxyNets(); err != nil {
474 errs = append(errs, err)
475 }
476 if c.HTTP.TLS == "files" && (c.HTTP.CertFile == "" || c.HTTP.KeyFile == "") {
477 errs = append(errs, errors.New("http.tls = \"files\" requires cert_file and key_file"))
478 }
479 if c.HTTP.TLS == "acme" {
480 host := c.SiteHost()
481 switch {
482 case !strings.HasPrefix(c.Server.SiteURL, "https://"):
483 errs = append(errs, errors.New("http.tls = \"acme\" requires an https:// site_url: certificates are issued for that host"))
484 case host == "" || host == "localhost" || net.ParseIP(host) != nil:
485 errs = append(errs, fmt.Errorf("http.tls = \"acme\" cannot issue a certificate for %q: use a public DNS name in site_url", host))
486 }
487 }
488 if err := oneOf("web.mode", c.Web.Mode, "view_only", "accounts"); err != nil {
489 errs = append(errs, err)
490 }
491 if err := oneOf("registration.mode", c.Registration.Mode, "closed", "invite", "open"); err != nil {
492 errs = append(errs, err)
493 }
494
495 for module, repo := range c.GoImport {
496 host, _, ok := strings.Cut(module, "/")
497 if !ok || host == "" || !strings.Contains(host, ".") {
498 errs = append(errs, fmt.Errorf("go_import key %q must be host/path (e.g. gitbay.org/gitbay)", module))
499 }
500 if parts := strings.Split(repo, "/"); len(parts) != 2 || parts[0] == "" || parts[1] == "" {
501 errs = append(errs, fmt.Errorf("go_import value %q must be owner/name", repo))
502 }
503 }
504
505 if _, err := c.Backup.Recipients(); err != nil {
506 errs = append(errs, err)
507 }
508
509 // Contradictions.
510 if c.Mail.SMTPHost != "" && c.Mail.From == "" {
511 errs = append(errs, errors.New("[mail] from is required when smtp_host is set"))
512 }
513 if t := c.Mail.TLS; t != "" && t != "starttls" && t != "implicit" {
514 errs = append(errs, fmt.Errorf("mail.tls must be starttls or implicit, got %q", t))
515 }
516 if c.Registration.Mode != "closed" && c.Mail.SMTPHost == "" {
517 errs = append(errs, fmt.Errorf(
518 "registration.mode = %q requires [mail] smtp_host: email verification cannot run without SMTP",
519 c.Registration.Mode))
520 }
521 if c.Registration.NotifyAdmin && c.Mail.SMTPHost == "" {
522 errs = append(errs, errors.New(
523 "registration.notify_admin = true requires [mail] smtp_host: there is nowhere to send the notice"))
524 }
525 if c.SSH.Mode == "system" && c.Registration.Mode != "closed" {
526 errs = append(errs, fmt.Errorf(
527 "ssh.mode = \"system\" requires registration.mode = \"closed\": host sshd rejects unknown keys before the dispatcher runs, so registration by unknown key is impossible"))
528 }
529 if c.Web.PasswordAuth && c.Web.Mode == "view_only" {
530 errs = append(errs, errors.New(
531 "web.password_auth = true is meaningless with web.mode = \"view_only\": no login route exists"))
532 }
533 if c.Web.PasswordAuth && c.Web.Mode == "accounts" {
534 errs = append(errs, errors.New(
535 "web.password_auth is not implemented yet; browser sessions are minted over SSH (gitbay web login)"))
536 }
537
538 return errors.Join(errs...)
539}
540
541// SiteHost returns the bare hostname from site_url (no scheme, port, path).
542func (c Config) SiteHost() string {
543 h := strings.TrimPrefix(strings.TrimPrefix(c.Server.SiteURL, "https://"), "http://")
544 h = strings.TrimSuffix(h, "/")
545 if i := strings.IndexByte(h, '/'); i >= 0 {
546 h = h[:i]
547 }
548 if host, _, err := net.SplitHostPort(h); err == nil {
549 return host
550 }
551 return h
552}
553
554// CheckHost performs environment probes that only make sense on the target
555// machine: port availability for the embedded listener and root existence.
556func (c Config) CheckHost() error {
557 var errs []error
558
559 if st, err := os.Stat(c.Server.Root); err != nil {
560 errs = append(errs, fmt.Errorf("server.root: %w", err))
561 } else if !st.IsDir() {
562 errs = append(errs, fmt.Errorf("server.root %q is not a directory", c.Server.Root))
563 }
564
565 if c.SSH.Mode == "embedded" {
566 addr := net.JoinHostPort("", strconv.Itoa(c.SSH.Port))
567 ln, err := net.Listen("tcp", addr)
568 if err != nil {
569 errs = append(errs, fmt.Errorf("ssh.port %d is not bindable (already in use by another daemon?): %w", c.SSH.Port, err))
570 } else {
571 ln.Close()
572 }
573 }
574
575 return errors.Join(errs...)
576}
577
578// TrustedProxyNets parses http.trusted_proxies; a bare address is a /32
579// or /128.
580func (h HTTP) TrustedProxyNets() ([]*net.IPNet, error) {
581 var nets []*net.IPNet
582 for _, p := range h.TrustedProxies {
583 if _, n, err := net.ParseCIDR(p); err == nil {
584 nets = append(nets, n)
585 continue
586 }
587 ip := net.ParseIP(p)
588 if ip == nil {
589 return nil, fmt.Errorf("http.trusted_proxies: %q is not an address or CIDR", p)
590 }
591 bits := 32
592 if ip.To4() == nil {
593 bits = 128
594 }
595 nets = append(nets, &net.IPNet{IP: ip, Mask: net.CIDRMask(bits, bits)})
596 }
597 return nets, nil
598}