recipe-maintainers/gitea
0
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(config): make app.ini writable so Gitea can persist secrets on (re)deploy #2

Closed
autonomic-bot wants to merge 1 commits from ci/app-ini-writable into main
pull from: ci/app-ini-writable
merge into: :main
Conversation 1 Commits 1 Files Changed 3
+16 -2
autonomic-bot commented 2026-06-18 01:53:23 +00:00
Owner
Copy Link
Copy Source

Fixes the warm-canonical advance failure surfaced by the cc-ci sweep: cold deploy + cold 3.5.3->3.6.0 upgrade are green, but the in-place warm reattach-advance to 3.6.0 crash-loops at config load.

Root cause: Gitea 1.24+ (re)generates and SAVES the [oauth2] JWT secret to /etc/gitea/app.ini during LoadCommonSettings(). With app.ini mounted directly as a read-only swarm config, this fails fatally:

LoadCommonSettings() [F] ... error saving JWT Secret for custom config: failed to save "/etc/gitea/app.ini": open /etc/gitea/app.ini: read-only file system

(crash before any DB migration; observed deterministically on a warm reattach to 3.6.0).

Fix: mount the rendered config read-only at /etc/gitea/app.ini.init and seed it once into the writable config:/etc/gitea volume via docker-setup.sh, so Gitea owns a writable /etc/gitea/app.ini and can persist the JWT secret. Seed-once preserves runtime state across restarts. Bumps DOCKER_SETUP_SH_VERSION so the new entrypoint actually deploys (swarm configs are immutable).

Verified by cc-ci on the warm-advance path.

cc @trav @notplants

Fixes the warm-canonical advance failure surfaced by the cc-ci sweep: cold deploy + cold 3.5.3->3.6.0 upgrade are green, but the in-place warm reattach-advance to 3.6.0 crash-loops at config load. **Root cause:** Gitea 1.24+ (re)generates and SAVES the `[oauth2]` JWT secret to `/etc/gitea/app.ini` during `LoadCommonSettings()`. With `app.ini` mounted directly as a **read-only** swarm config, this fails fatally: ``` LoadCommonSettings() [F] ... error saving JWT Secret for custom config: failed to save "/etc/gitea/app.ini": open /etc/gitea/app.ini: read-only file system ``` (crash before any DB migration; observed deterministically on a warm reattach to 3.6.0). **Fix:** mount the rendered config read-only at `/etc/gitea/app.ini.init` and seed it once into the **writable** `config:/etc/gitea` volume via `docker-setup.sh`, so Gitea owns a writable `/etc/gitea/app.ini` and can persist the JWT secret. Seed-once preserves runtime state across restarts. Bumps `DOCKER_SETUP_SH_VERSION` so the new entrypoint actually deploys (swarm configs are immutable). Verified by cc-ci on the warm-advance path. cc @trav @notplants
autonomic-bot added 1 commit 2026-06-18 01:53:23 +00:00
fix(config): make app.ini writable so Gitea can persist secrets on (re)deploy 1a098452f4 
Gitea 1.24+ (re)generates and SAVES the [oauth2] JWT secret to /etc/gitea/app.ini at
LoadCommonSettings. With app.ini mounted directly as a read-only swarm config this fails fatally
(open /etc/gitea/app.ini: read-only file system) on a warm reattach/redeploy, crash-looping the
container before any DB migration. Mount the rendered config at /etc/gitea/app.ini.init (read-only)
and seed it once into the writable config volume via docker-setup.sh, so Gitea owns a writable
/etc/gitea/app.ini. Bumps DOCKER_SETUP_SH_VERSION so the new entrypoint actually deploys.
autonomic-bot added 1 commit 2026-06-18 02:52:51 +00:00
fix(config): seed app.ini when missing OR empty (-s), bump v3 d41452663f 
A release that mounted app.ini directly as a read-only swarm config leaves a 0-byte placeholder at
/etc/gitea/app.ini in the reattached config volume on upgrade; the original seed guard (! -f) treated
that as present and skipped, so Gitea booted the install wizard on an empty config (/api/v1/version
404). Guard on ! -s (missing OR empty) so the rendered config is seeded; bump DOCKER_SETUP_SH_VERSION
so the corrected entrypoint deploys (immutable swarm configs).
autonomic-bot force-pushed ci/app-ini-writable from d41452663f to a0f2db8872 2026-06-18 05:34:40 +00:00 Compare
autonomic-bot commented 2026-06-19 03:03:53 +00:00
Author
Owner
Copy Link
Copy Source

This fix is now included in PR #3 (upgrade to gitea 1.26.2-rootless + postgres 15.18). The app.ini-writable patch was cherry-picked into the upgrade branch. Superseded by #3

This fix is now included in PR #3 (upgrade to gitea 1.26.2-rootless + postgres 15.18). The app.ini-writable patch was cherry-picked into the upgrade branch. Superseded by https://git.autonomic.zone/recipe-maintainers/gitea/pulls/3
autonomic-bot closed this pull request 2026-06-19 03:03:53 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/gitea#2