change secret mechanism and continue with README clenaup

README.md

@@ -94,16 +94,16 @@ Here is a deeper insight into the variables of this gitea role. For the exact fu
 ### Security
 | variable name | default value | description |
 | ------------- | ------------- | ----------- |
-| `gitea_secret_key` | **PLEASE CHANGE** | Global secret key. This should be changed. |
-| `gitea_internal_token`: Internal API token
-* `gitea_disable_git_hooks`: Do you want to disable the interface to add git hooks? If enabled it could be a security bug as it can be used for RCE. Defaults to true (true/false)
+| `gitea_secret_key` | `''` | Global secret key. Will be autogenerated if not defined. Should be unique. |
+| `gitea_internal_token` | `''` | Internal API token. Will be autogenerated if not defined. Should be unique. |
+| `gitea_disable_git_hooks` | `true` | Set to false to enable users with git hook privilege to create custom git hooks. Can be dangerous. |
+| `gitea_user_repo_limit` | `-1` | Limit how many repos a user can have *(`-1` for unlimited)* |
+| `gitea_lfs_secret` | `''` < JWT secret for remote LFS usage. Can be generated with ``gitea generate secret JWT_SECRET``. Will be autogenerated if not defined |
+|
+| `gitea_oauth2_jwt_secret` | `''` | Oauth2 JWT secret. Can be generated with ``gitea generate secret JWT_SECRET``. Will be autogenerated if not defined. |
 
-* `gitea_systemd_cap_net_bind_service`: Adds `AmbientCapabilities=CAP_NET_BIND_SERVICE` to systemd service file
-* `gitea_extra_config`: Additional configuration
 
-### Limits
 
-* `gitea_user_repo_limit`: Limit how many repos a user can have (-1 for unlimited)
 
 ### HTTP configuration
 
@@ -148,7 +148,6 @@ Here is a deeper insight into the variables of this gitea role. For the exact fu
 
 * `gitea_lfs_enabled`: Enable GIT LFS *(git large file storeage: [git-lfs](https://git-lfs.github.com/))*. Default: `false`
 * `gitea_lfs_content_path`: path where the lfs files are stored
-* `gitea_lfs_secret`: JWT secret for remote LFS usage. Can be generated with ``gitea generate secret JWT_SECRET``
 
 ### Log configuration
 * `gitea_log_systemd` Disable logging into `file`, use systemd-journald
@@ -169,7 +168,6 @@ As this will only deploy config files, fail2ban already has to be installed or o
 ### Oauth2 provider configuration
 
 * `gitea_oauth2_enabled`: Enable the Oauth2 provider (true/false)
-* `gitea_oauth2_jwt_secret`: Oauth2 JWT secret. Can be generated with ``gitea generate secret JWT_SECRET``
 
 
 ### Metrics endpoint configuration
@@ -189,6 +187,8 @@ As this will only deploy config files, fail2ban already has to be installed or o
 * `gitea_backup_on_upgrade`: Optionally a backup can be created with every update of gitea. Default: `false`
 * `gitea_backup_location`: Where to store the gitea backup if one is created with this role. Default: `{{ gitea_home }}/backups/`
 
+* `gitea_systemd_cap_net_bind_service`: Adds `AmbientCapabilities=CAP_NET_BIND_SERVICE` to systemd service file
+* `gitea_extra_config`: Additional configuration
 ## Contributing
 Don't hesitate to create a pull request, and when in doubt you can reach me on
 Mastodon [@l3d@chaos.social](https://chaos.social/@l3d).

defaults/main.yml

@@ -30,9 +30,12 @@ gitea_themes: gitea,arc-green
 gitea_theme_default: gitea
 
 # security
-gitea_secret_key: T0pS3cr31
-gitea_internal_token: SomethingVeryLong
+gitea_secret_key: ''
+gitea_internal_token: ''
 gitea_disable_git_hooks: true
+gitea_user_repo_limit: -1
+gitea_lfs_jwt_secret: ''
+gitea_oauth2_jwt_secret: ''
 
 gitea_http_domain: localhost
 
@@ -44,10 +47,8 @@ gitea_http_port: 3000
 gitea_disable_http_git: false
 
 
-gitea_user_repo_limit: -1
 gitea_lfs_server_enabled: false
 gitea_lfs_content_path: "{{ gitea_home }}/data/lfs"
-gitea_lfs_jwt_secret: ''
 
 gitea_systemd_cap_net_bind_service: false
 gitea_db_type: sqlite3
@@ -87,7 +88,6 @@ gitea_fail2ban_jail_bantime: 900
 gitea_fail2ban_jail_action: iptables-allports
 
 gitea_oauth2_enabled: true
-gitea_oauth2_jwt_secret: ''
 
 gitea_metrics_enabled: false
 gitea_metrics_token: ~

tasks/gitea_secrets.yml

@@ -0,0 +1,38 @@
+---
+- name: generate gitea SECRET_KEY if not provided
+  become: true
+  shell: 'umask 077; /usr/local/bin/gitea generate secret SECRET_KEY > /etc/gitea/gitea_secret_key'
+  args:
+    creates: '/etc/gitea/gitea_secret_key'
+  when: gitea_secret_key | length == 0
+
+- name: read gitea SECRET_KEY from file
+  become: true
+  slurp:
+    src: '/etc/gitea/gitea_secret_key'
+  register: remote_secret_key:
+  when: gitea_secret_key | length == 0
+
+- name: set fact gitea_secret_key
+  set_fact:
+    gitea_secret_key: "{{ remote_secret_key['content'] | b64decode }}"
+  when: gitea_secret_key | length == 0
+
+- name: generate gitea INTERNAL_TOKEN if not provided
+  become: true
+  shell: 'umask 077; /usr/local/bin/gitea generate secret INTERNAL_TOKEN > /etc/gitea/gitea_internal_token'
+  args:
+    creates: '/etc/gitea/gitea_internal_token'
+  when: gitea_internal_token | length == 0
+
+- name: read gitea INTERNAL_TOKEN from file
+  become: true
+  slurp:
+    src: '/etc/gitea/gitea_internal_token'
+  register: remote_internal_token
+  when: gitea_internal_token | length == 0
+
+- name: set fact gitea_internal_token
+  set_fact:
+    gitea_internal_token: "{{ remote_internal_token['content'] | b64decode }}"
+  when: gitea_internal_token | length == 0

tasks/main.yml

@@ -59,6 +59,8 @@
 
 - include_tasks: jwt_secrets.yml
 
+- include_tasks: gitea_secrets.yml
+
 - name: "Configure gitea"
   template:
     src: gitea.ini.j2