digitale-selbstverteidigung/digitale-selbstverteidigung-website
1
0
Fork 0
Code Issues Pull requests 4 Activity Actions

update README to reflect infrastructure changes
All checks were successful
/ build (pull_request) Successful in 1m51s
Details

Browse source
This commit is contained in:
June 2025-07-25 11:32:12 +02:00
commit 17fb8a910c
Signed by: june
SSH key fingerprint: SHA256:o9EAq4Y9N9K0pBQeBTqhSDrND5E7oB+60ZNx0U1yPe0
1 changed files with 17 additions and 37 deletions
Download patch file Download diff file Expand all files Collapse all files

54
README.md
View file

@ -11,12 +11,12 @@ Linux Distributions, install them like this:
Now you can clone the repository: Now you can clone the repository:
$ git clone ssh://git@gitlab.hamburg.ccc.de:4242/cryptoparty/website-content.git $ git clone ssh://forgejo@git.hamburg.ccc.de/Cryptoparty/cryptoparty-website.git
If this doesn't work, you may need to add a ssh authentication key to If this doesn't work, you may need to add a ssh authentication key to
your gitlab profile on [this page]: your Forgejo profile on [this page]:
[this page]: https://gitlab.hamburg.ccc.de/profile/keys [this page]: https://git.hamburg.ccc.de/user/settings/keys
Furthermore, you need to checkout the submodules: Furthermore, you need to checkout the submodules:
@ -64,44 +64,24 @@ If you are satisfied, add it to the branch, and push it to the server:
$ git commit -m 'Added new post.' $ git commit -m 'Added new post.'
$ git push $ git push
Then, [create a merge request] on gitlab. Press the blue button Then, [create a pull request] on Forgejo. Press the button labeled
labeled `Create merge request`. On the following site, press the `New pull request`. On the following site, select the branch you want to merge
green `Submit merge request` button, then press the blue button (`my-new-post`) in the `pull from:` dropdown, press the green `New pull request`
labeled `Merge once pipeline succeeds`. Your change will be published button. The CI will now build a website with your changes. Once that's done
once the continuous integration setup confirmed the validity of the and you verified everything looks alright, you can then merge the pull request
change. to publish the change.
[create a merge request]: https://gitlab.hamburg.ccc.de/cryptoparty/website-content/merge_requests [create a pull request]: https://git.hamburg.ccc.de/Cryptoparty/cryptoparty-website/pulls
How this is set up on the server How this is set up on the server
================================ ================================
On the server, the website is built using gitlab's ci runner, see The website gets built and deployed using Forgejo Actions, see
`.gitlab-ci.yml`. To deploy the site, the ci job rsyncs it to the `.forgejo/workflows/deploy.yaml`. It using the same mechanism for hosting and
host. For this purpose, a restricted user is created: deployment as the [CCCHH Website] and is therefore using the CCCHH
infrastructure, see [ansible-infra] and [nix-infra].
# adduser --system --home /var/www/www-data-rsync --shell /bin/sh --disabled-password --ingroup www-data www-data-rsync [CCCHH Website]: https://git.hamburg.ccc.de/CCCHH/ccchh-website
Create a key and restrict it to invoke the restricted-rsync script: [ansible-infra]: https://git.hamburg.ccc.de/CCCHH/ansible-infra
[nix-infra]: https://git.hamburg.ccc.de/CCCHH/nix-infra
# mkdir /var/www/www-data-rsync/.ssh
# chmod 700 /var/www/www-data-rsync/.ssh
# ssh-keygen -t ed25519 -C 'Used for website deployment.' -f www-data-rsync-id_ed25519
# echo 'command="/usr/local/bin/rrsync /var/www/html --safe-links",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOBBpthbSQ3HgOkhoBwsrZCA9VMX7hRftB5t6LePqtr3 Used for website deployment.' > /var/www/www-data-rsync/.ssh/authorized_keys
# chmod 400 /var/www/www-data-rsync/.ssh/authorized_keys
# chown -R www-data-rsync:www-data /var/www/www-data-rsync/.ssh
Copy the restricted-rsync script from the docs and make it executable:
# cp /usr/share/doc/rsync/scripts/rrsync /usr/local/bin/
# chmod +x /usr/local/bin/rrsync
Finally, allow www-data-rsync to write to the document root:
# chown root:www-data /var/www/html
# chmod g+w /var/www/html
The last bit is to supply the generated secret to gitlab's ci runner
via RSYNC_TARGET_SECRET_KEY. Other information that needs to be
provided are RSYNC_TARGET_HOST, RSYNC_TARGET_PORT,
RSYNC_TARGET_HOST_KEY, and RSYNC_TARGET_USER.