gitea on fly.io

readme.md

gitea on fly.io

1. update <name> fields in fly.toml and commands below to your desired domain, then run:

fly apps create <name>
fly volumes create gitea_data --size 1 --app <name> -y
fly deploy --config fly.toml

2. create account and set GITEA__service__DISABLE_REGISTRATION in fly.toml to true and redeploy
3. add locally generated SSH key to /user/settings/keys (ssh-keygen -t ed25519 -C "<email>")
4. add domain to trusted hosts:

ssh-keygen -R <name>.fly.dev

~/.ssh/config:

Host <name>.fly.dev
  User git
  IdentityFile ~/.ssh/<private_key>
  IdentitiesOnly yes

5. verify:

ssh -T git@<name>.fly.dev
# if above fails
# ssh -i <private_key> -T git@<name>.fly.dev

6. 🥷

fly.toml

app = "<name>"
primary_region = "cdg"

kill_timeout = 5

[build]
  # NOTE: Rootless avoids a hard port-22 collision that breaks Fly’s own SSH
  image = "docker.gitea.com/gitea:1.25-rootless"

[env]
  GITEA__database__DB_TYPE = "sqlite3"
  GITEA__database__PATH = "/data/gitea/gitea.db"

  # HTTP
  GITEA__server__HTTP_ADDR = "0.0.0.0"
  GITEA__server__HTTP_PORT = "3000"
  GITEA__server__DOMAIN = "<name>.fly.dev"
  GITEA__server__ROOT_URL = "https://<name>.fly.dev"
  GITEA__server__REDIRECT_OTHER_PORT = "true"

  # SSH: listen on 2222 inside the machine, but *advertise* port 22 externally
  GITEA__server__START_SSH_SERVER = "true"
  GITEA__server__SSH_LISTEN_HOST = "0.0.0.0"
  GITEA__server__SSH_LISTEN_PORT = "2222"
  GITEA__server__SSH_DOMAIN = "<name>.fly.dev"
  GITEA__server__SSH_PORT = "22"

  GITEA__security__INSTALL_LOCK = "true"
  GITEA__service__DISABLE_REGISTRATION = "true" # TODO: set this to false after first install

[[mounts]]
  destination = "/data"
  source = "gitea_data"

# SSH (public 22 -> internal 2222)
[[services]]
  internal_port = 2222
  protocol = "tcp"
  [[services.ports]]
    port = 22

# HTTP->HTTPS redirect
[[services]]
  internal_port = 3000
  protocol = "tcp"
  [[services.ports]]
    handlers = ["http"]
    port = 80

# HTTPS
[[services]]
  internal_port = 3000
  protocol = "tcp"
  [[services.ports]]
    handlers = ["tls", "http"]
    port = 443

[[vm]]
  memory = "512mb"
  cpus = 1