## 自动HTTPS
当符合下面一些合理的标准时，Caddy会自动为所有站点启用HTTPS:

* 主机名
    - 不为空
    - 不是localhost
    - 不是一个IP地址
    - 不超过一个通配符（*）
    - 通配符必须是最左边的标签
* 没有显式指定端口为80
* 没有显式指定使用http协议
* TLS没有在站点的定义中被关闭
* 不是你自己提供的证书和密钥
* Caddy能够绑定到端口80和443（除非使用DNS验证）

Caddy还会将所有HTTP请求重定向到与HTTPS对应的地址，只要Caddyfile中没有定义主机名的纯文本变体。

---

## 安装部署
- docker-compose.yml
```yaml
version: "3"

services:
  caddy:
    container_name: caddy
    image: caddy:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "80:80/udp"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./caddy/:/data/caddy/
```

- Caddyfile
```Caddyfile
:80 {
  redir https://{host}{uri}
}

uing.vip {
  log {
    output stdout
    format console
    level  ERROR
  }
  root * /var/www/uing.vip
  handle_errors {
    rewrite * /404.html
    file_server
  }
  file_server
}

gitea.uing.vip {
  log {
    output stdout
    format console
    level  ERROR
  }
  reverse_proxy gitea:3000
}

https://example.com {
  reverse_proxy localhost:8080 {
    header_up Host {host}
    header_up X-Real-IP {remote_host}
    header_up X-Forwarded-For {remote_host}
    header_up X-Forwarded-Proto {scheme}
  }
}
```

## 如果需要接入 Cloudflare CDN 上

1. 打开 https://dash.cloudflare.com/ 注册登录
2. 添加网站，更改域名的 DNS
3. 打开 https://dash.cloudflare.com/profile/api-tokens
4. API 令牌 -> 创建 API 令牌 -> 编辑区域 DNS -> 选择模板 -> 区域资源 -> 对应网站
3.  获取到的API KEY -> docker-compose.yml -> caddy 容器 -> 替换 CF_API_TOKEN 环境变量 -> 替换 DOMAIN 环境变量（也可以是二级或三级域名）
5. https://dash.cloudflare.com -> 对应网站
6. SSL/TLS -> 源服务器 -> 源证书 ->  经过身份验证的源服务器拉取 -> 打开
7. SSL/TLS -> 概述 -> 您的 SSL/TLS 加密模式为 -> 完全（严格）

- docker-compose.yml
```yaml
version: "3"
services:
  caddy:
    container_name: caddy
    build: 
      dockerfile: ./caddy-cloudflare-Dockerfile
    restart: unless-stopped
    ports:
      - "80:80"
      - "80:80/udp"
      - "443:443"
      - "443:443/udp"
    environment:
      - CF_API_TOKEN=XXX
      - DOMAIN=XXX
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - ./caddy:/data/caddy
```

- Caddyfile
```Caddyfile
{env.DOMAIN} {
  log {
    output stdout
    format console
    level  ERROR
  }
  reverse_proxy gitea:3000
}
```

- caddy-cloudflare-Dockerfile
```Dockerfile
FROM caddy:builder-alpine AS builder
RUN xcaddy build --with github.com/caddy-dns/cloudflare

FROM caddy:alpine
COPY --from=builder /usr/bin/caddy /usr/bin/caddy
```

## 接入到 DNS
- [Alibaba Cloud DNS](https://github.com/caddy-dns/alidns)
- [DNSPOD](https://github.com/caddy-dns/dnspod)
- [其它 DNS...](https://github.com/orgs/caddy-dns/repositories)

## 相关连接
- [Caddy Docs](https://caddyserver.com/docs)
- [Caddy v2中文文档](https://caddy2.dengxiaolong.com/docs/)
- [Caddy中文文档(V1)](https://dengxiaolong.com/caddy/zh/)
- [Cloudflare module for Caddy](https://github.com/caddy-dns/cloudflare)

Caddy2 - 能够自动申请证书的 HTTPS/HTTP 服务器

- docker-compose.yml
```yaml
version: "3"

services:
  caddy:
    container_name: caddy
    image: caddy:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "80:80/udp"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
  harbor:
    container_name: harbor
    build:
      dockerfile: ./harbor-Dockerfile
    privileged: true
    volumes:
      - ./harbor/data:/data
      - ./harbor/harbor:/opt/harbor
```

- Caddyfile
```Caddyfile
registry.uing.vip {
  log {
    output stdout
    format console
    level  ERROR
  }
  reverse_proxy harbor:9000
}
```

- harbor-Dockerfile
```Dockerfile
FROM docker:dind
MAINTAINER cainiao <565499699@qq.com>

COPY harbor/harbor-entrypoint.sh /usr/local/bin/harbor-entrypoint.sh
COPY harbor/supervisord.conf /etc/supervisord.conf
COPY harbor/harbor.yml /harbor.yml

RUN apk add --no-cache supervisor && chmod a+x /usr/local/bin/harbor-entrypoint.sh

ENTRYPOINT ["/usr/bin/supervisord", "-c", "/etc/supervisord.conf"]
```

- harbor/harbor-entrypoint.sh
```bash
#!/bin/sh

if [ -f /opt/harbor/docker-compose.yml ]; then
    cd /opt/harbor/ && docker-compose up
else
    cd /opt
    apk add --no-cache --virtual .build_tools ncurses bash wget
    
    wget -O harbor-online-installer.tgz \
        https://github.com/goharbor/harbor/releases/download/v2.8.4/harbor-online-installer-v2.8.4.tgz \
        && tar xzf harbor-online-installer.tgz \
        && rm -f harbor-online-installer.tgz
    
    cd /opt/harbor
    
    cp -f /harbor.yml .
    bash ./install.sh

    apk del .build_tools
    
    docker-compose logs -f
fi
``` 

- harbor/supervisord.conf
```ini
[supervisord]
nodaemon=true

[program:dockerd]
command=/usr/local/bin/dockerd-entrypoint.sh
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
autostar=true
autorestart=true

[program:harbor]
command=/usr/local/bin/harbor-entrypoint.sh
stdout_logfile=/dev/stdout
stdout_logfile_maxbytes=0
stderr_logfile=/dev/stderr
stderr_logfile_maxbytes=0
autostar=true
autorestart=true
startsecs=3
```

- harbor/harbor.yml
```yaml
# Configuration file of Harbor

# The IP address or hostname to access admin UI and registry service.
# DO NOT use localhost or 127.0.0.1, because Harbor needs to be accessed by external clients.
hostname: registry.uing.vip

# http related config
http:
  # port for http, default is 80. If https enabled, this port will redirect to https port
  port: 80

# # https related config
# https:
#   # https port for harbor, default is 443
#   port: 443
#   # The path of cert and key files for nginx
#   certificate: /your/certificate/path
#   private_key: /your/private/key/path


# # Uncomment following will enable tls communication between all harbor components
# internal_tls:
#   # set enabled to true means internal tls is enabled
#   enabled: true
#   # put your cert and key files on dir
#   dir: /etc/harbor/tls/internal
#   # enable strong ssl ciphers (default: false)
#   strong_ssl_ciphers: false

# Uncomment external_url if you want to enable external proxy
# And when it enabled the hostname will no longer used
external_url: https://registry.uing.vip

# The initial password of Harbor admin
# It only works in first time to install harbor
# Remember Change the admin password from UI after launching Harbor.
harbor_admin_password: XXXXXXXXXXXX

# Harbor DB configuration
database:
  # The password for the root user of Harbor DB. Change this before any production use.
  password: root123
  # The maximum number of connections in the idle connection pool. If it <=0, no idle connections are retained.
  max_idle_conns: 100
  # The maximum number of open connections to the database. If it <= 0, then there is no limit on the number of open connections.
  # Note: the default number of connections is 1024 for postgres of harbor.
  max_open_conns: 900
  # The maximum amount of time a connection may be reused. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's age.
  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
  conn_max_lifetime: 5m
  # The maximum amount of time a connection may be idle. Expired connections may be closed lazily before reuse. If it <= 0, connections are not closed due to a connection's idle time.
  # The value is a duration string. A duration string is a possibly signed sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms", "-1.5h" or "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".
  conn_max_idle_time: 0

# The default data volume
data_volume: /data

# Harbor Storage settings by default is using /data dir on local filesystem
# Uncomment storage_service setting If you want to using external storage
# storage_service:
#   # ca_bundle is the path to the custom root ca certificate, which will be injected into the truststore
#   # of registry's containers.  This is usually needed when the user hosts a internal storage with self signed certificate.
#   ca_bundle:

#   # storage backend, default is filesystem, options include filesystem, azure, gcs, s3, swift and oss
#   # for more info about this configuration please refer https://docs.docker.com/registry/configuration/
#   filesystem:
#     maxthreads: 100
#   # set disable to true when you want to disable registry redirect
#   redirect:
#     disable: false

# Trivy configuration
#
# Trivy DB contains vulnerability information from NVD, Red Hat, and many other upstream vulnerability databases.
# It is downloaded by Trivy from the GitHub release page https://github.com/aquasecurity/trivy-db/releases and cached
# in the local file system. In addition, the database contains the update timestamp so Trivy can detect whether it
# should download a newer version from the Internet or use the cached one. Currently, the database is updated every
# 12 hours and published as a new release to GitHub.
trivy:
  # ignoreUnfixed The flag to display only fixed vulnerabilities
  ignore_unfixed: false
  # skipUpdate The flag to enable or disable Trivy DB downloads from GitHub
  #
  # You might want to enable this flag in test or CI/CD environments to avoid GitHub rate limiting issues.
  # If the flag is enabled you have to download the `trivy-offline.tar.gz` archive manually, extract `trivy.db` and
  # `metadata.json` files and mount them in the `/home/scanner/.cache/trivy/db` path.
  skip_update: false
  #
  # The offline_scan option prevents Trivy from sending API requests to identify dependencies.
  # Scanning JAR files and pom.xml may require Internet access for better detection, but this option tries to avoid it.
  # For example, the offline mode will not try to resolve transitive dependencies in pom.xml when the dependency doesn't
  # exist in the local repositories. It means a number of detected vulnerabilities might be fewer in offline mode.
  # It would work if all the dependencies are in local.
  # This option doesn't affect DB download. You need to specify "skip-update" as well as "offline-scan" in an air-gapped environment.
  offline_scan: false
  #
  # Comma-separated list of what security issues to detect. Possible values are `vuln`, `config` and `secret`. Defaults to `vuln`.
  security_check: vuln
  #
  # insecure The flag to skip verifying registry certificate
  insecure: false
  # github_token The GitHub access token to download Trivy DB
  #
  # Anonymous downloads from GitHub are subject to the limit of 60 requests per hour. Normally such rate limit is enough
  # for production operations. If, for any reason, it's not enough, you could increase the rate limit to 5000
  # requests per hour by specifying the GitHub access token. For more details on GitHub rate limiting please consult
  # https://docs.github.com/rest/overview/resources-in-the-rest-api#rate-limiting
  #
  # You can create a GitHub token by following the instructions in
  # https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line
  #
  # github_token: xxx

jobservice:
  # Maximum number of job workers in job service
  max_job_workers: 10
  # The jobLoggers backend name, only support "STD_OUTPUT", "FILE" and/or "DB"
  job_loggers:
    - STD_OUTPUT
    - FILE
    # - DB
  # The jobLogger sweeper duration (ignored if `jobLogger` is `stdout`)
  logger_sweeper_duration: 1 #days

notification:
  # Maximum retry count for webhook job
  webhook_job_max_retry: 3
  # HTTP client timeout for webhook job
  webhook_job_http_client_timeout: 3 #seconds

# Log configurations
log:
  # options are debug, info, warning, error, fatal
  level: info
  # configs for logs in local storage
  local:
    # Log files are rotated log_rotate_count times before being removed. If count is 0, old versions are removed rather than rotated.
    rotate_count: 50
    # Log files are rotated only if they grow bigger than log_rotate_size bytes. If size is followed by k, the size is assumed to be in kilobytes.
    # If the M is used, the size is in megabytes, and if G is used, the size is in gigabytes. So size 100, size 100k, size 100M and size 100G
    # are all valid.
    rotate_size: 200M
    # The directory on your host that store log
    location: /var/log/harbor

  # Uncomment following lines to enable external syslog endpoint.
  # external_endpoint:
  #   # protocol used to transmit log to external endpoint, options is tcp or udp
  #   protocol: tcp
  #   # The host of external endpoint
  #   host: localhost
  #   # Port of external endpoint
  #   port: 5140

#This attribute is for migrator to detect the version of the .cfg file, DO NOT MODIFY!
_version: 2.9.0

# Uncomment external_database if using external database.
# external_database:
#   harbor:
#     host: harbor_db_host
#     port: harbor_db_port
#     db_name: harbor_db_name
#     username: harbor_db_username
#     password: harbor_db_password
#     ssl_mode: disable
#     max_idle_conns: 2
#     max_open_conns: 0

# Uncomment redis if need to customize redis db
# redis:
#   # db_index 0 is for core, it's unchangeable
#   # registry_db_index: 1
#   # jobservice_db_index: 2
#   # trivy_db_index: 5
#   # it's optional, the db for harbor business misc, by default is 0, uncomment it if you want to change it.
#   # harbor_db_index: 6
#   # it's optional, the db for harbor cache layer, by default is 0, uncomment it if you want to change it.
#   # cache_db_index: 7

# Uncomment redis if need to customize redis db
# redis:
#   # db_index 0 is for core, it's unchangeable
#   # registry_db_index: 1
#   # jobservice_db_index: 2
#   # trivy_db_index: 5
#   # it's optional, the db for harbor business misc, by default is 0, uncomment it if you want to change it.
#   # harbor_db_index: 6
#   # it's optional, the db for harbor cache layer, by default is 0, uncomment it if you want to change it.
#   # cache_layer_db_index: 7

# Uncomment external_redis if using external Redis server
# external_redis:
#   # support redis, redis+sentinel
#   # host for redis: <host_redis>:<port_redis>
#   # host for redis+sentinel:
#   #  <host_sentinel1>:<port_sentinel1>,<host_sentinel2>:<port_sentinel2>,<host_sentinel3>:<port_sentinel3>
#   host: redis:6379
#   password: 
#   # Redis AUTH command was extended in Redis 6, it is possible to use it in the two-arguments AUTH <username> <password> form.
#   # there's a known issue when using external redis username ref:https://github.com/goharbor/harbor/issues/18892
#   # if you care about the image pull/push performance, please refer to this https://github.com/goharbor/harbor/wiki/Harbor-FAQs#external-redis-username-password-usage
#   # username:
#   # sentinel_master_set must be set to support redis+sentinel
#   #sentinel_master_set:
#   # db_index 0 is for core, it's unchangeable
#   registry_db_index: 1
#   jobservice_db_index: 2
#   trivy_db_index: 5
#   idle_timeout_seconds: 30
#   # it's optional, the db for harbor business misc, by default is 0, uncomment it if you want to change it.
#   # harbor_db_index: 6
#   # it's optional, the db for harbor cache layer, by default is 0, uncomment it if you want to change it.
#   # cache_layer_db_index: 7

# Uncomment uaa for trusting the certificate of uaa instance that is hosted via self-signed cert.
# uaa:
#   ca_file: /path/to/ca

# Global proxy
# Config http proxy for components, e.g. http://my.proxy.com:3128
# Components doesn't need to connect to each others via http proxy.
# Remove component from `components` array if want disable proxy
# for it. If you want use proxy for replication, MUST enable proxy
# for core and jobservice, and set `http_proxy` and `https_proxy`.
# Add domain to the `no_proxy` field, when you want disable proxy
# for some special registry.
proxy:
  http_proxy:
  https_proxy:
  no_proxy:
  components:
    - core
    - jobservice
    - trivy

# metric:
#   enabled: false
#   port: 9090
#   path: /metrics

# Trace related config
# only can enable one trace provider(jaeger or otel) at the same time,
# and when using jaeger as provider, can only enable it with agent mode or collector mode.
# if using jaeger collector mode, uncomment endpoint and uncomment username, password if needed
# if using jaeger agetn mode uncomment agent_host and agent_port
# trace:
#   enabled: true
#   # set sample_rate to 1 if you wanna sampling 100% of trace data; set 0.5 if you wanna sampling 50% of trace data, and so forth
#   sample_rate: 1
#   # # namespace used to differenciate different harbor services
#   # namespace:
#   # # attributes is a key value dict contains user defined attributes used to initialize trace provider
#   # attributes:
#   #   application: harbor
#   # # jaeger should be 1.26 or newer.
#   # jaeger:
#   #   endpoint: http://hostname:14268/api/traces
#   #   username:
#   #   password:
#   #   agent_host: hostname
#   #   # export trace data by jaeger.thrift in compact mode
#   #   agent_port: 6831
#   # otel:
#   #   endpoint: hostname:4318
#   #   url_path: /v1/traces
#   #   compression: false
#   #   insecure: true
#   #   # timeout is in seconds
#   #   timeout: 10

# Enable purge _upload directories
upload_purging:
  enabled: true
  # remove files in _upload directories which exist for a period of time, default is one week.
  age: 168h
  # the interval of the purge operations
  interval: 24h
  dryrun: false

# Cache layer configurations
# If this feature enabled, harbor will cache the resource
# `project/project_metadata/repository/artifact/manifest` in the redis
# which can especially help to improve the performance of high concurrent
# manifest pulling.
# NOTICE
# If you are deploying Harbor in HA mode, make sure that all the harbor
# instances have the same behaviour, all with caching enabled or disabled,
# otherwise it can lead to potential data inconsistency.
cache:
  # not enabled by default
  enabled: false
  # keep cache for one day by default
  expire_hours: 24

# Harbor core configurations
# Uncomment to enable the following harbor core related configuration items.
# core:
#   # The provider for updating project quota(usage), there are 2 options, redis or db,
#   # by default is implemented by db but you can switch the updation via redis which
#   # can improve the performance of high concurrent pushing to the same project,
#   # and reduce the database connections spike and occupies.
#   # By redis will bring up some delay for quota usage updation for display, so only
#   # suggest switch provider to redis if you were ran into the db connections spike aroud
#   # the scenario of high concurrent pushing to same project, no improvment for other scenes.
#   quota_update_provider: redis # Or db

```

---

## 遇到的问题

1. 权限问题（could not change group /var/run/docker.sock to docker: group docker not found），请用 root 权限执行 docker-compose up -d
```log
[+] Running 1/0
 ✔ Container harbor  Created                                                                                                 0.0s
Attaching to harbor
harbor  | Certificate request self-signature ok
harbor  | subject=CN = docker:dind server
harbor  | /certs/server/cert.pem: OK
harbor  | Certificate request self-signature ok
harbor  | subject=CN = docker:dind client
harbor  | /certs/client/cert.pem: OK
harbor  | [WARN  tini (12)] Tini is not running as PID 1 and isn't registered as a child subreaper.
harbor  | Zombie processes will not be re-parented to Tini, so zombie reaping won't work.
harbor  | To fix the problem, use the -s option or set the environment variable TINI_SUBREAPER to register Tini as a child subreaper, or run Tini as PID 1.
harbor  | time="2023-08-30T10:38:50.129710991Z" level=info msg="Starting up"
harbor  | time="2023-08-30T10:38:50.131978924Z" level=warning msg="could not change group /var/run/docker.sock to docker: group docker not found"
harbor  | time="2023-08-30T10:38:50.132116243Z" level=info msg="containerd not running, starting managed containerd"
harbor  | failed to start containerd: libcontainerd: failed to save daemon pid to disk: process with PID 57 is still running
harbor  | Cannot connect to the Docker daemon at unix:///var/run/docker.sock. Is the docker daemon running?
harbor exited with code 1
```


Harbor - 私有化容器仓库

## docker-compose 安装部署

```bash
mkdir jenkins_home
chown -R 1000:1000 ./jenkins_home
```

- docker-compose.yml
```yaml
version: "3"

services:
  caddy:
    container_name: caddy
    image: caddy:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "80:80/udp"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
  jenkins:
    container_name: jenkins
    image: jenkins/jenkins:lts-jdk11
    restart: unless-stopped
    volumes:
      # chown -R 1000:1000 ./jenkins_home
      - ./jenkins_home:/var/jenkins_home
```

- Caddyfile
```Caddyfile
jenkins.uing.vip {
  log {
    output stdout
    format console
    level  ERROR
  }
  reverse_proxy jenkins:8080
}
```

Jenkins - CI/CD（持续集成、持续交付和持续部署）

## docker-compose 安装部署

- docker-compose.yml
```yaml
version: "3"

services:
  caddy:
    container_name: caddy
    image: caddy:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "80:80/udp"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
  portainer:
    container_name: portainer
    image: portainer/portainer-ce:latest
    command: -H unix:///var/run/docker.sock
    restart: unless-stopped
    # ports:
    #   - 8000:8000
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ./portainer:/data

  redis:
    container_name: redis
    image: redis:alpine
    restart: unless-stopped
    volumes:
      - ./redis:/data
```

- Caddyfile
```Caddyfile
portainer.uing.vip {
  log {
    output stdout
    format console
    level  ERROR
  }
  reverse_proxy portainer:9000
}
```

Portainer - 容器运行监控管理

# Gitea 安装部署

## 配置 SSH 直通（可选，不需要 SSH 协议同步无需此步骤，可以使用 https/http 协议同步代替）
```bash
# 记录下 UID/GID 替换中的 USER_UID USER_GID
sudo adduser --system --shell /bin/bash --gecos 'Git Version Control' --group --disabled-password --home /home/git git
# 生成 SSH 密钥对
sudo -u git ssh-keygen -t rsa -b 4096 -C "Gitea Host Key"

# ----------------------------------------------------------------

sudo -u git cat /home/git/.ssh/id_rsa.pub | sudo -u git tee -a /home/git/.ssh/authorized_keys
sudo -u git chmod 600 /home/git/.ssh/authorized_keys

cat <<"EOF" | sudo tee /usr/local/bin/gitea
#!/bin/sh
ssh -p 2222 -o StrictHostKeyChecking=no git@127.0.0.1 "SSH_ORIGINAL_COMMAND=\"$SSH_ORIGINAL_COMMAND\" $0 $@"
EOF
sudo chmod +x /usr/local/bin/gitea
```

## docker-compose 安装部署
- docker-compose.yml
```yaml
version: "3"

services:
  caddy:
    container_name: caddy
    image: caddy:alpine
    restart: unless-stopped
    ports:
      - "80:80"
      - "80:80/udp"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
  gitea:
    container_name: gitea
    image: gitea/gitea:latest
    restart: unless-stopped
    # depends_on:
    #   - redis
    environment:
      - USER=git
      - USER_UID=111
      - USER_GID=122
    volumes:
      - ./gitea:/data
      - /home/git/.ssh:/data/git/.ssh
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "127.0.0.1:2222:22"


  # redis:
  #   container_name: redis
  #   image: redis:alpine
  #   restart: unless-stopped
  #   volumes:
  #     - ./redis:/data
```

- Caddyfile
```Caddyfile
:80 {
  redir https://{host}{uri}
}
gitea.uing.vip {
  log {
    output stdout
    format console
    level  ERROR
  }
  reverse_proxy gitea:3000
}
```

## 启用 Gitea Actions 内置的 CI/CD （持续集成、持续交付和持续部署）解决方案

### 配置 Gitea 服务器
```bash
cat << EOF >> gitea/gitea/conf/app.ini
[actions]
ENABLED=true
EOF
docker-compose restart gitea
```

### 生成  Gitea Runner 配置文件
```
mkdir gitea_runner && cd gitea_runner
docker run --entrypoint="" --rm -it gitea/act_runner:latest act_runner generate-config > config.yaml
```

### docker-compose 安装 Gitea Runner 部署
- docker-compose.yml
```yaml
version: "3"

services:
  gitea_runner:
    container_name: gitea_runner
    image: gitea/act_runner:latest
    # 如果使用服务器容器名称作为 URL HOST 的话，需要先启动 Gitea
    depends_on:
      - gitea
    environment:
      CONFIG_FILE: /config.yaml
      # Gitea 服务器地址（也可以是内网地址或者容器内部地址）
      GITEA_INSTANCE_URL: https://gitea.uing.vip
      # 获取地址 https://gitea.uing.vip/admin/actions/runners/
      GITEA_RUNNER_REGISTRATION_TOKEN: ""
      # Runner名称（可选）。如果留空，将使用主机名
      GITEA_RUNNER_NAME: ""
      GITEA_RUNNER_LABELS: ""
    volumes:
      - ./gitea_runner/config.yaml:/config.yaml
      - ./gitea_runner/data:/data
      - /var/run/docker.sock:/var/run/docker.sock
```

## 配置仓库启用 Gitea Actions

1. 打开仓库设置 https://gitea.uing.vip/\<owner\>/\<repo\>/settings
2. 找到并勾选 **启用 Actions** ，并 **更新仓库设置** 保存设置

![enable_actions](/static/img/d32bf0a67ee84027af617b96fac509dc.1693367900388.png)

3. 在仓库代码下新建目录 **.gitea/workflows/**，新建 Yaml 文件编写 Gitea Actions 执行代码
```bash
git clone git@gitea.uing.vip:cainiao/gitea_runner.git

cd gitea_runner && mkdir -p .gitea/workflows/

cat <<"EOF" > .gitea/workflows/demo.yaml
name: Gitea Actions Demo
run-name: ${{ gitea.actor }} is testing out Gitea Actions 🚀
on: [push]

jobs:
  Explore-Gitea-Actions:
    runs-on: ubuntu-latest
    steps:
      - run: echo "🎉 The job was automatically triggered by a ${{ gitea.event_name }} event."
      - run: echo "🐧 This job is now running on a ${{ runner.os }} server hosted by Gitea!"
      - run: echo "🔎 The name of your branch is ${{ gitea.ref }} and your repository is ${{ gitea.repository }}."
      - name: Check out repository code
        uses: actions/checkout@v3
      - run: echo "💡 The ${{ gitea.repository }} repository has been cloned to the runner."
      - run: echo "🖥️ The workflow is now ready to test your code on the runner."
      - name: List files in the repository
        run: |
          ls ${{ gitea.workspace }}
      - run: echo "🍏 This job's status is ${{ job.status }}."
EOF

git add .gitea/workflows/demo.yaml
git commit -m "add .gitea/workflows/demo.yaml"
git push
```
4. 在仓库的 Actions 下查看到执行过程及结果：https://gitea.uing.vip/\<owner\>/\<repo\>/actions


## 相关连接
- (Configuration Cheat Sheet)[https://docs.gitea.com/administration/config-cheat-sheet]