Alliance-Boreale/Set-OPS-Public
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Zéro-confiance : Forgejo→PG en verify-full

Browse source 
SSL_MODE=verify-full dans app.ini [database] + PGSSLROOTCERT (root_ca step-ca)
dans l'unité systemd (lib/pq lit l'env). root_ca déjà 0644 (fix client_pki).

Prouvé sur forge-01 : accueil 200, SSL_MODE=verify-full, PGSSLROOTCERT ok,
aucune erreur TLS/DB. Déploiement propre du 1er coup (patron éprouvé).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Daniel Allaire 2026-07-04 18:53:31 -04:00
parent fa6ef8b031
commit a51ddc6296
3 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
roles/serveur_forgejo/defaults/main.yml
View file

@ -48,3 +48,8 @@ serveur_forgejo_oidc_client_id: "forgejo"
serveur_forgejo_oidc_client_secret: "{{ vault_forgejo_oidc | default('') }}" # voûte (vault_forgejo_oidc)
serveur_forgejo_oidc_realm: "chezlepro"
serveur_forgejo_oidc_discovery: "https://keycloak.{{ domaine_interne }}/realms/{{ serveur_forgejo_oidc_realm }}/.well-known/openid-configuration"
# TLS vers PostgreSQL (zero-confiance). 'disable' = compat ; 'verify-full' = chiffre + verifie
# le cert serveur contre le root_ca step-ca (via PGSSLROOTCERT dans l'unite systemd).
serveur_forgejo_db_sslmode: "disable"
serveur_forgejo_db_sslrootcert: "/etc/step/certs/root_ca.crt"

1
roles/serveur_forgejo/templates/app.ini.j2
View file

@ -17,6 +17,7 @@ HOST = {{ serveur_forgejo_db_host }}:{{ serveur_forgejo_db_port | default(5432)
NAME = {{ serveur_forgejo_entree.base }}
USER = {{ serveur_forgejo_entree.proprietaire }}
PASSWD = {{ serveur_forgejo_db_password }}
SSL_MODE = {{ serveur_forgejo_db_sslmode | default('disable') }}
[security]
INSTALL_LOCK = true

3
roles/serveur_forgejo/templates/forgejo.service.j2
View file

@ -15,6 +15,9 @@ RestartSec=5
Environment=USER={{ serveur_forgejo_utilisateur }}
Environment=HOME=/home/{{ serveur_forgejo_utilisateur }}
Environment=GITEA_WORK_DIR={{ serveur_forgejo_data }}
{% if serveur_forgejo_db_sslmode | default('disable') in ['verify-ca', 'verify-full'] %}
Environment=PGSSLROOTCERT={{ serveur_forgejo_db_sslrootcert }}
{% endif %}
[Install]
WantedBy=multi-user.target