69 lines
3.0 KiB
Bash
69 lines
3.0 KiB
Bash
# Copy to .env and fill in the secrets. Never commit .env.
|
|
#
|
|
# Three values are what a new instance needs:
|
|
# 1. GITEA_URL -- the instance the bot manages
|
|
# 2. GITEA_TOKEN -- a DEDICATED BOT ACCOUNT's token (never an admin token)
|
|
# 3. WEBHOOK_SECRET -- the HMAC secret of the org webhook (webhooks are the
|
|
# only trigger)
|
|
# plus NETWORK_NAME, the Docker network Gitea already runs on.
|
|
#
|
|
# On an instance whose Gitea runs on the same Docker daemon, point GITEA_URL at
|
|
# the name Gitea's container has ON that network, so the bot needs no egress and
|
|
# no published port. The alias is instance-specific -- it is the Gitea
|
|
# container's name plus its Compose service name:
|
|
# GITEA_URL=http://gitea:3000 # a Compose service named `gitea`
|
|
# GITEA_URL=http://gitea_dcntrlized:3000 # prod: /docker/org.dcntrlized.git
|
|
#
|
|
# NETWORK_NAME is the REAL (project-prefixed) Docker network name, not just the
|
|
# key in Gitea's compose file -- a Compose-defined network is named
|
|
# `<project>_<key>`. Derive it from the running Gitea container:
|
|
# docker inspect -f '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}' gitea_dcntrlized
|
|
# -> orgdcntrlizedgit_gitea_dcntrlized
|
|
# deploy.sh does this for you when NETWORK_NAME is empty.
|
|
#
|
|
# Remote/HTTPS instance (e.g. behind a tunnel or reverse proxy):
|
|
# GITEA_URL=https://git.example.org
|
|
# NETWORK_NAME=dcntrlized_net
|
|
GITEA_URL=
|
|
|
|
# The URL a HUMAN follows from the bot's comments (commit/file links). Set this
|
|
# whenever GITEA_URL is the internal alias so the links are clickable:
|
|
# GITEA_URL=http://gitea:3000
|
|
# GITEA_PUBLIC_URL=https://git.example.org
|
|
# Defaults to GITEA_URL when empty.
|
|
GITEA_PUBLIC_URL=
|
|
|
|
# Bot-account token with write access to the allowlisted repositories. Scopes:
|
|
# write:repository (clone/push/commit status) + read:issue + write:issue
|
|
# (read the PR file list, post/update the comment).
|
|
GITEA_TOKEN=
|
|
|
|
# HMAC-SHA256 secret configured on the Gitea webhook. Generate one with:
|
|
# openssl rand -hex 32
|
|
# The bot rejects any delivery whose X-Gitea-Signature does not match.
|
|
WEBHOOK_SECRET=
|
|
|
|
# Docker network that already contains Gitea (see docker-compose.yaml). This is
|
|
# the real Docker name, project-prefixed if Gitea's compose defines it. Leave
|
|
# empty and deploy.sh derives it from the Gitea container; set it explicitly
|
|
# (recommended) once you know it.
|
|
NETWORK_NAME=
|
|
|
|
# Comma-separated owner/name allowlist. Nothing outside it is ever touched.
|
|
REPOS=Dcntrlized/Maestro,Dcntrlized/KeepNote,Dcntrlized/Calendar,Dcntrlized/dcntrlized-auth,Dcntrlized/dcntrlized-db
|
|
|
|
# Commit-status context. It must equal the string configured in branch
|
|
# protection, byte for byte, or the merge gate silently never matches.
|
|
STATUS_CONTEXT="license-bot / addlicense"
|
|
|
|
LISTEN=:8080
|
|
DRY_RUN=false
|
|
LOG_LEVEL=info
|
|
|
|
# Optional host binding for the webhook/health port (loopback by default).
|
|
BOT_BIND=127.0.0.1
|
|
BOT_PORT=18080
|
|
|
|
# Optional: pin the image tag (default license-bot:dev, built locally).
|
|
# LICENSE_BOT_IMAGE=registry.example/owner/license-bot:1
|