mirror of
https://gitea.com/gitea/docs.git
synced 2026-09-18 03:58:52 +00:00
Merge branch 'main' into audit
This commit is contained in:
Lunny Xiao
+81
-18
@@ -14,6 +14,8 @@ aliases:
|
||||
2. 将 `https://git.example.com/foo` 反向代理到 `http://gitea:3000/foo`
|
||||
3. 确保反向代理不会解码 URI。`https://git.example.com/a%2Fb`的请求应该被传递给 `http://gitea:3000/a%2Fb`。
|
||||
4. 确保 `Host` 和 `X-Forwarded-Proto` 头被正确的传递给 Gitea，使 Gitea 可以看到正在访问的真实 URL。
|
||||
5. 确保 Web 服务器有完整的证书（包括所有中间证书和根证书），以便 `git clone` 和 `git pull` 正常工作。
|
||||
6. Gitea 会在 `/-/ws` 使用 WebSocket 连接，用于通知计数等实时更新。请确保反向代理使用 HTTP/1.1，并转发 `Upgrade` 和 `Connection` 头，参见下面的示例。否则 Gitea 会回退为定期轮询。
|
||||
|
||||
## 使用子路径
|
||||
|
||||
@@ -39,6 +41,7 @@ server {
|
||||
location / {
|
||||
client_max_body_size 512M;
|
||||
proxy_pass http://localhost:3000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection $http_connection;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
@@ -61,8 +64,9 @@ server {
|
||||
|
||||
# 确保 nginx 使用未转义 URI， 按原样保持 "%2F"。 确保 nginx 去除 "/gitea" 子路径前缀， 按原样传递 "/v2"。
|
||||
rewrite ^ $request_uri;
|
||||
rewrite ^(/gitea)?(/.*) $2 break;
|
||||
rewrite ^/(gitea($|/))?(.*) /$3 break;
|
||||
proxy_pass http://127.0.0.1:3000$uri;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
# 其他的常规 HTTP 表头，见上面“使用 Nginx 作为反向代理服务”小节的配置
|
||||
proxy_set_header Connection $http_connection;
|
||||
@@ -107,6 +111,7 @@ server {
|
||||
}
|
||||
|
||||
location / {
|
||||
# 其他指令见上面「使用 Nginx 作为反向代理服务」小节
|
||||
proxy_pass http://localhost:3000;
|
||||
}
|
||||
}
|
||||
@@ -123,6 +128,7 @@ server {
|
||||
server_name git.example.com;
|
||||
|
||||
location / {
|
||||
# 其他指令见上面「使用 Nginx 作为反向代理服务」小节
|
||||
proxy_pass http://localhost:3000;
|
||||
}
|
||||
}
|
||||
@@ -144,6 +150,20 @@ server {
|
||||
}
|
||||
```
|
||||
|
||||
## Nginx Proxy Manager
|
||||
|
||||
如果使用 Nginx Proxy Manager 作为 Gitea 的反向代理，配置与原生 Nginx 略有不同。
|
||||
|
||||
它会[默认给自定义 location 加上一些指令](https://github.com/NginxProxyManager/nginx-proxy-manager/blob/master/docker/rootfs/etc/nginx/conf.d/include/proxy.conf)，因此上面 Nginx 配置里对应的指令不要再写一遍。否则会因为指令重复（尤其是 `proxy_set_header Host $host`）出现 `400 bad request`。
|
||||
|
||||
创建 `/` 自定义 location 时，只需在其配置中加入：
|
||||
|
||||
```nginx
|
||||
client_max_body_size 512M;
|
||||
```
|
||||
|
||||
在代理主机上启用 `Websockets Support`，Nginx Proxy Manager 会自行加入 WebSocket 相关指令。再额外添加 `proxy_http_version` 会导致 Nginx 拒绝启动。
|
||||
|
||||
## 使用 Apache HTTPD 作为反向代理服务
|
||||
|
||||
如果您想使用 Apache HTTPD 作为 Gitea 的反向代理服务，您可以为您的 Apache HTTPD 作如下配置（在 Ubuntu 中，配置文件通常在 `/etc/apache2/httpd.conf` 目录下）：
|
||||
@@ -154,30 +174,23 @@ server {
|
||||
ProxyPreserveHost On
|
||||
ProxyRequests off
|
||||
AllowEncodedSlashes NoDecode
|
||||
ProxyPass / http://localhost:3000/ nocanon
|
||||
ProxyPass / http://localhost:3000/ nocanon upgrade=websocket
|
||||
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
注：必须启用以下 Apache HTTPD 组件：`proxy`， `proxy_http`
|
||||
:::note
|
||||
必须启用以下 Apache HTTPD 组件：`proxy`， `proxy_http`。
|
||||
|
||||
`upgrade=websocket` 需要 Apache HTTPD 2.4.48 或更高版本。更旧的版本**必须**去掉它，否则 Apache HTTPD 将无法启动。
|
||||
:::
|
||||
|
||||
如果希望用 Let's Encrypt 的 webroot 验证，请在 `ProxyPass` 之前加入 `ProxyPass /.well-known !`，避免把这些请求代理到 Gitea。
|
||||
|
||||
## 使用 Apache HTTPD 作为反向代理服务并将 Gitea 路由至一个子路径
|
||||
|
||||
如果您已经有一个域名并且想与 Gitea 共享该域名，您可以增加以下配置为 Gitea 添加路由规则（在 Ubuntu 中，配置文件通常在 `/etc/apache2/httpd.conf` 目录下）：
|
||||
|
||||
```
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
<Proxy *>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Proxy>
|
||||
AllowEncodedSlashes NoDecode
|
||||
# 注意: 路径和 URL 后面都不要写路径符号 '/'
|
||||
ProxyPass /git http://localhost:3000 nocanon
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
```apacheconf
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
@@ -187,7 +200,7 @@ server {
|
||||
</Proxy>
|
||||
AllowEncodedSlashes NoDecode
|
||||
# 注意: 路径和 URL 后面都不要写路径符号 '/'
|
||||
ProxyPass /git http://localhost:3000 nocanon
|
||||
ProxyPass /git http://localhost:3000 nocanon upgrade=websocket
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
|
||||
</VirtualHost>
|
||||
@@ -195,7 +208,55 @@ server {
|
||||
|
||||
然后您**必须**在 Gitea 的配置文件中正确的添加类似 `[server] ROOT_URL = http://git.example.com/git/` 的配置项。
|
||||
|
||||
注：必须启用以下 Apache HTTPD 组件：`proxy`， `proxy_http`
|
||||
:::note
|
||||
必须启用以下 Apache HTTPD 组件：`proxy`， `proxy_http`。`upgrade=websocket` 需要 Apache HTTPD 2.4.48 或更高版本，更旧的版本请去掉它。
|
||||
:::
|
||||
|
||||
## 使用 Apache HTTPD 直接提供静态资源
|
||||
|
||||
我们可以通过将资源分为静态和动态两种类型来调节性能。
|
||||
|
||||
CSS 文件、JavaScript 文件、图片和字体是静态内容。首页、仓库视图和工单列表是动态内容。
|
||||
|
||||
Apache HTTPD 可以直接提供静态资源，并且只代理动态资源请求给 Gitea。
|
||||
|
||||
将 Gitea 源代码仓库的一个快照下载到 `/path/to/gitea/`。
|
||||
在此之后，在本地仓库目录运行 `make frontend` 来生成静态资源。在这个情况下，我们只对 `public/` 目录感兴趣，您可以删除剩下的其他目录。
|
||||
（为了生成静态资源，您需要安装一个[带 npm 的 Node ](https://nodejs.org/en/download/)和 `make`）
|
||||
|
||||
取决于您的用户量的大小，您可以将流量分离到两个不同的服务器，或者为静态资源配置一个 cdn。
|
||||
|
||||
### 单服务器节点，单域名
|
||||
|
||||
将 `[server] STATIC_URL_PREFIX = /_/static` 写入您的 Gitea 配置文件：
|
||||
|
||||
```apacheconf
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
<Proxy *>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Proxy>
|
||||
|
||||
ProxyPass /_/static/ !
|
||||
Alias /_/static/ /path/to/gitea/public/
|
||||
<Directory /path/to/gitea/public/>
|
||||
Options FollowSymlinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
AllowEncodedSlashes NoDecode
|
||||
# 注意: 路径和 URL 后面都不要写路径符号 '/'
|
||||
ProxyPass / http://localhost:3000/ nocanon upgrade=websocket
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
:::note
|
||||
必须启用以下 Apache HTTPD 组件：`proxy`， `proxy_http`。`upgrade=websocket` 需要 Apache HTTPD 2.4.48 或更高版本，更旧的版本请去掉它。
|
||||
:::
|
||||
|
||||
## 使用 Caddy 作为反向代理服务
|
||||
|
||||
@@ -231,11 +292,13 @@ git.example.com {
|
||||
|
||||
- 使用 Microsoft Web Platform Installer 5.1 (WebPI) 安装 Application Request Routing（简称 ARR），或者在 [IIS.net](https://www.iis.net/downloads/microsoft/application-request-routing) 下载这个插件。
|
||||
- 一但这个模块被安装到 IIS 上，你将会在 IIS 管理控制台看到一个叫做 URL Rewrite 的新图标。
|
||||
- 安装 Windows 功能 `WebSocket Protocol`，否则 ARR 无法代理 Gitea 的 WebSocket 端点。
|
||||
- 打开 IIS 管理控制台，在左边的列表中点击 `Gitea Proxy` 网页。在中间选中并且双击 URL Rewrite 的图标来加载 URL 重写的面板。
|
||||
- 在管理控制台的右边选择 `Add Rule` 操作，并且在 `Inbound and Outbound Rules` 分类中选择 `Reverse Proxy Rule`。
|
||||
- 在 Inbound Rules 中， 将 server name 设置为 Gitea 正在运行的主机以及对应端口。例如，如果你在 localhost 的 3000 端口上运行 Gitea，则设置为 `127.0.0.1:3000`。
|
||||
- 启用 SSL Offloading
|
||||
- 在 Outbound Rules 中，确保设置了 `Rewrite the domain names of the links in HTTP response`，并且将 `From:` 设置为上面的 server name，将 `To:` 设置为你的外部访问名称，例如：`git.example.com`
|
||||
- 关闭 Application Request Routing 的 `Server Proxy Settings` 中的 `Reverse rewrite host in response headers`（在 IIS 管理器中选择服务器节点，打开 `Application Request Routing Cache`，再打开右侧的 `Server Proxy Settings`）。若保持开启，ARR 会把 `Location` 头里的主机改回内部地址，导致登录或表单提交后的重定向把浏览器送到 `127.0.0.1:3000` 而不是 `git.example.com`。
|
||||
- 现在，根据下面的内容为您的网页编辑 `web.config`（将 `127.0.0.1:3000` 和 `git.example.com` 改为适当的值）
|
||||
|
||||
```xml
|
||||
|
||||
+61
-15
@@ -14,6 +14,7 @@ aliases:
|
||||
2. 将 `https://git.example.com/foo` 反向代理到 `http://gitea:3000/foo`
|
||||
3. 确保反向代理不会解码 URI。`https://git.example.com/a%2Fb`的请求应该被传递给 `http://gitea:3000/a%2Fb`。
|
||||
4. 确保 `Host` 和 `X-Forwarded-Proto` 头被正确的传递给 Gitea，使 Gitea 可以看到正在访问的真实 URL。
|
||||
5. 确保 Web 服务器有完整的证书（包括所有中间证书和根证书），以便 `git clone` 和 `git pull` 正常工作。
|
||||
|
||||
## 使用子路径
|
||||
|
||||
@@ -61,7 +62,7 @@ server {
|
||||
|
||||
# 确保 nginx 使用未转义 URI， 按原样保持 "%2F"。 确保 nginx 去除 "/gitea" 子路径前缀， 按原样传递 "/v2"。
|
||||
rewrite ^ $request_uri;
|
||||
rewrite ^(/gitea)?(/.*) $2 break;
|
||||
rewrite ^/(gitea($|/))?(.*) /$3 break;
|
||||
proxy_pass http://127.0.0.1:3000$uri;
|
||||
|
||||
# 其他的常规 HTTP 表头，见上面“使用 Nginx 作为反向代理服务”小节的配置
|
||||
@@ -75,7 +76,7 @@ server {
|
||||
}
|
||||
```
|
||||
|
||||
然后您**必须**在 Gitea 的配置文件中正确的添加类似 `[server] ROOT_URL = http://git.example.com/git/` 的配置项。
|
||||
然后您**必须**在 Gitea 的配置文件中正确的添加类似 `[server] ROOT_URL = http://git.example.com/gitea/` 的配置项。
|
||||
|
||||
## 使用 Nginx 直接提供静态资源
|
||||
|
||||
@@ -144,6 +145,20 @@ server {
|
||||
}
|
||||
```
|
||||
|
||||
## Nginx Proxy Manager
|
||||
|
||||
如果使用 Nginx Proxy Manager 作为 Gitea 的反向代理，配置与原生 Nginx 略有不同。
|
||||
|
||||
它会[默认给自定义 location 加上一些指令](https://github.com/NginxProxyManager/nginx-proxy-manager/blob/master/docker/rootfs/etc/nginx/conf.d/include/proxy.conf)，因此上面 Nginx 配置里对应的指令不要再写一遍。否则会因为指令重复（尤其是 `proxy_set_header Host $host`）出现 `400 bad request`。
|
||||
|
||||
创建 `/` 自定义 location 时，只需在其配置中加入：
|
||||
|
||||
```nginx
|
||||
client_max_body_size 512M;
|
||||
proxy_set_header Connection $http_connection;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
```
|
||||
|
||||
## 使用 Apache HTTPD 作为反向代理服务
|
||||
|
||||
如果您想使用 Apache HTTPD 作为 Gitea 的反向代理服务，您可以为您的 Apache HTTPD 作如下配置（在 Ubuntu 中，配置文件通常在 `/etc/apache2/httpd.conf` 目录下）：
|
||||
@@ -161,23 +176,12 @@ server {
|
||||
|
||||
注：必须启用以下 Apache HTTPD 组件：`proxy`， `proxy_http`
|
||||
|
||||
如果希望用 Let's Encrypt 的 webroot 验证，请在 `ProxyPass` 之前加入 `ProxyPass /.well-known !`，避免把这些请求代理到 Gitea。
|
||||
|
||||
## 使用 Apache HTTPD 作为反向代理服务并将 Gitea 路由至一个子路径
|
||||
|
||||
如果您已经有一个域名并且想与 Gitea 共享该域名，您可以增加以下配置为 Gitea 添加路由规则（在 Ubuntu 中，配置文件通常在 `/etc/apache2/httpd.conf` 目录下）：
|
||||
|
||||
```
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
<Proxy *>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Proxy>
|
||||
AllowEncodedSlashes NoDecode
|
||||
# 注意: 路径和 URL 后面都不要写路径符号 '/'
|
||||
ProxyPass /git http://localhost:3000 nocanon
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
```apacheconf
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
@@ -197,6 +201,48 @@ server {
|
||||
|
||||
注：必须启用以下 Apache HTTPD 组件：`proxy`， `proxy_http`
|
||||
|
||||
## 使用 Apache HTTPD 直接提供静态资源
|
||||
|
||||
我们可以通过将资源分为静态和动态两种类型来调节性能。
|
||||
|
||||
CSS 文件、JavaScript 文件、图片和字体是静态内容。首页、仓库视图和工单列表是动态内容。
|
||||
|
||||
Apache HTTPD 可以直接提供静态资源，并且只代理动态资源请求给 Gitea。
|
||||
|
||||
将 Gitea 源代码仓库的一个快照下载到 `/path/to/gitea/`。
|
||||
在此之后，在本地仓库目录运行 `make frontend` 来生成静态资源。在这个情况下，我们只对 `public/` 目录感兴趣，您可以删除剩下的其他目录。
|
||||
（为了生成静态资源，您需要安装一个[带 npm 的 Node ](https://nodejs.org/en/download/)和 `make`）
|
||||
|
||||
取决于您的用户量的大小，您可以将流量分离到两个不同的服务器，或者为静态资源配置一个 cdn。
|
||||
|
||||
### 单服务器节点，单域名
|
||||
|
||||
将 `[server] STATIC_URL_PREFIX = /_/static` 写入您的 Gitea 配置文件：
|
||||
|
||||
```apacheconf
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
<Proxy *>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Proxy>
|
||||
|
||||
ProxyPass /_/static/ !
|
||||
Alias /_/static/ /path/to/gitea/public/
|
||||
<Directory /path/to/gitea/public/>
|
||||
Options FollowSymlinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
AllowEncodedSlashes NoDecode
|
||||
# 注意: 路径和 URL 后面都不要写路径符号 '/'
|
||||
ProxyPass / http://localhost:3000/ nocanon
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
## 使用 Caddy 作为反向代理服务
|
||||
|
||||
如果您想使用 Caddy 作为 Gitea 的反向代理服务，您可以在 `Caddyfile` 中添加如下配置：
|
||||
|
||||
+81
-18
@@ -14,6 +14,8 @@ aliases:
|
||||
2. 將 `https://git.example.com/foo` 反向代理到 `http://gitea:3000/foo`
|
||||
3. 確保反向代理不會解碼 URI。`https://git.example.com/a%2Fb`的請求應該被傳遞給 `http://gitea:3000/a%2Fb`。
|
||||
4. 確保 `Host` 和 `X-Forwarded-Proto` 頭被正確的傳遞給 Gitea，使 Gitea 可以看到正在訪問的真實 URL。
|
||||
5. 確保 Web 伺服器有完整的憑證（包括所有中間憑證和根憑證），以便 `git clone` 和 `git pull` 正常工作。
|
||||
6. Gitea 會在 `/-/ws` 使用 WebSocket 連線，用於通知計數等即時更新。請確保反向代理使用 HTTP/1.1，並轉發 `Upgrade` 和 `Connection` 頭，參見下面的示例。否則 Gitea 會改為定期輪詢。
|
||||
|
||||
## 使用子路徑
|
||||
|
||||
@@ -39,6 +41,7 @@ server {
|
||||
location / {
|
||||
client_max_body_size 512M;
|
||||
proxy_pass http://localhost:3000;
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Connection $http_connection;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Host $host;
|
||||
@@ -61,8 +64,9 @@ server {
|
||||
|
||||
# 確保 nginx 使用未轉義 URI， 按原樣保持 "%2F"。 確保 nginx 去除 "/gitea" 子路徑前綴， 按原樣傳遞 "/v2"。
|
||||
rewrite ^ $request_uri;
|
||||
rewrite ^(/gitea)?(/.*) $2 break;
|
||||
rewrite ^/(gitea($|/))?(.*) /$3 break;
|
||||
proxy_pass http://127.0.0.1:3000$uri;
|
||||
proxy_http_version 1.1;
|
||||
|
||||
# 其他的常規 HTTP 表頭，見上面“使用 Nginx 作為反向代理服務”小節的配置
|
||||
proxy_set_header Connection $http_connection;
|
||||
@@ -107,6 +111,7 @@ server {
|
||||
}
|
||||
|
||||
location / {
|
||||
# 其他指令見上面「使用 Nginx 作為反向代理服務」小節
|
||||
proxy_pass http://localhost:3000;
|
||||
}
|
||||
}
|
||||
@@ -123,6 +128,7 @@ server {
|
||||
server_name git.example.com;
|
||||
|
||||
location / {
|
||||
# 其他指令見上面「使用 Nginx 作為反向代理服務」小節
|
||||
proxy_pass http://localhost:3000;
|
||||
}
|
||||
}
|
||||
@@ -144,6 +150,20 @@ server {
|
||||
}
|
||||
```
|
||||
|
||||
## Nginx Proxy Manager
|
||||
|
||||
如果使用 Nginx Proxy Manager 作為 Gitea 的反向代理，設定與原生 Nginx 略有不同。
|
||||
|
||||
它會[預設給自訂 location 加上一些指令](https://github.com/NginxProxyManager/nginx-proxy-manager/blob/master/docker/rootfs/etc/nginx/conf.d/include/proxy.conf)，因此上面 Nginx 設定裡對應的指令不要再寫一遍。否則會因為指令重複（尤其是 `proxy_set_header Host $host`）出現 `400 bad request`。
|
||||
|
||||
建立 `/` 自訂 location 時，只需在其設定中加入：
|
||||
|
||||
```nginx
|
||||
client_max_body_size 512M;
|
||||
```
|
||||
|
||||
在代理主機上啟用 `Websockets Support`，Nginx Proxy Manager 會自行加入 WebSocket 相關指令。再額外添加 `proxy_http_version` 會導致 Nginx 拒絕啟動。
|
||||
|
||||
## 使用 Apache HTTPD 作為反向代理服務
|
||||
|
||||
如果您想使用 Apache HTTPD 作為 Gitea 的反向代理服務，您可以為您的 Apache HTTPD 作如下設定（在 Ubuntu 中，設定文件通常在 `/etc/apache2/httpd.conf` 目錄下）：
|
||||
@@ -154,30 +174,23 @@ server {
|
||||
ProxyPreserveHost On
|
||||
ProxyRequests off
|
||||
AllowEncodedSlashes NoDecode
|
||||
ProxyPass / http://localhost:3000/ nocanon
|
||||
ProxyPass / http://localhost:3000/ nocanon upgrade=websocket
|
||||
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
注：必須啟用以下 Apache HTTPD 元件：`proxy`， `proxy_http`
|
||||
:::note
|
||||
必須啟用以下 Apache HTTPD 元件：`proxy`， `proxy_http`。
|
||||
|
||||
`upgrade=websocket` 需要 Apache HTTPD 2.4.48 或更高版本。更舊的版本**必須**去掉它，否則 Apache HTTPD 將無法啟動。
|
||||
:::
|
||||
|
||||
如果希望用 Let's Encrypt 的 webroot 驗證，請在 `ProxyPass` 之前加入 `ProxyPass /.well-known !`，避免把這些請求代理到 Gitea。
|
||||
|
||||
## 使用 Apache HTTPD 作為反向代理服務並將 Gitea 路由至一個子路徑
|
||||
|
||||
如果您已經有一個域名並且想與 Gitea 共享該域名，您可以增加以下設定為 Gitea 添加路由規則（在 Ubuntu 中，設定文件通常在 `/etc/apache2/httpd.conf` 目錄下）：
|
||||
|
||||
```
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
<Proxy *>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Proxy>
|
||||
AllowEncodedSlashes NoDecode
|
||||
# 注意: 路徑和 URL 後面都不要寫路徑符號 '/'
|
||||
ProxyPass /git http://localhost:3000 nocanon
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
```apacheconf
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
@@ -187,7 +200,7 @@ server {
|
||||
</Proxy>
|
||||
AllowEncodedSlashes NoDecode
|
||||
# 注意: 路徑和 URL 後面都不要寫路徑符號 '/'
|
||||
ProxyPass /git http://localhost:3000 nocanon
|
||||
ProxyPass /git http://localhost:3000 nocanon upgrade=websocket
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
|
||||
</VirtualHost>
|
||||
@@ -195,7 +208,55 @@ server {
|
||||
|
||||
然後您**必須**在 Gitea 的設定文件中正確的添加類似 `[server] ROOT_URL = http://git.example.com/git/` 的設定項。
|
||||
|
||||
注：必須啟用以下 Apache HTTPD 元件：`proxy`， `proxy_http`
|
||||
:::note
|
||||
必須啟用以下 Apache HTTPD 元件：`proxy`， `proxy_http`。`upgrade=websocket` 需要 Apache HTTPD 2.4.48 或更高版本，更舊的版本請去掉它。
|
||||
:::
|
||||
|
||||
## 使用 Apache HTTPD 直接提供靜態資源
|
||||
|
||||
我們可以通過將資源分為靜態和動態兩種類型來調節性能。
|
||||
|
||||
CSS 文件、JavaScript 文件、圖片和字體是靜態內容。首頁、倉庫視圖和工單列表是動態內容。
|
||||
|
||||
Apache HTTPD 可以直接提供靜態資源，並且只代理動態資源請求給 Gitea。
|
||||
|
||||
將 Gitea 源代碼倉庫的一個快照下載到 `/path/to/gitea/`。
|
||||
在此之後，在本地倉庫目錄運行 `make frontend` 來生成靜態資源。在這個情況下，我們只對 `public/` 目錄感興趣，您可以刪除剩下的其他目錄。
|
||||
（為了生成靜態資源，您需要安裝一個[帶 npm 的 Node ](https://nodejs.org/en/download/)和 `make`）
|
||||
|
||||
取決於您的用戶量的大小，您可以將流量分離到兩個不同的服務器，或者為靜態資源設定一個 cdn。
|
||||
|
||||
### 單伺服器節點，單域名
|
||||
|
||||
將 `[server] STATIC_URL_PREFIX = /_/static` 寫入您的 Gitea 設定文件：
|
||||
|
||||
```apacheconf
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
<Proxy *>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Proxy>
|
||||
|
||||
ProxyPass /_/static/ !
|
||||
Alias /_/static/ /path/to/gitea/public/
|
||||
<Directory /path/to/gitea/public/>
|
||||
Options FollowSymlinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
AllowEncodedSlashes NoDecode
|
||||
# 注意: 路徑和 URL 後面都不要寫路徑符號 '/'
|
||||
ProxyPass / http://localhost:3000/ nocanon upgrade=websocket
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
:::note
|
||||
必須啟用以下 Apache HTTPD 元件：`proxy`， `proxy_http`。`upgrade=websocket` 需要 Apache HTTPD 2.4.48 或更高版本，更舊的版本請去掉它。
|
||||
:::
|
||||
|
||||
## 使用 Caddy 作為反向代理服務
|
||||
|
||||
@@ -231,11 +292,13 @@ git.example.com {
|
||||
|
||||
- 使用 Microsoft Web Platform Installer 5.1 (WebPI) 安裝 Application Request Routing（簡稱 ARR），或者在 [IIS.net](https://www.iis.net/downloads/microsoft/application-request-routing) 下載這個外掛。
|
||||
- 一但這個模組被安裝到 IIS 上，你將會在 IIS 管理控制檯看到一個叫做 URL Rewrite 的新圖標。
|
||||
- 安裝 Windows 功能 `WebSocket Protocol`，否則 ARR 無法代理 Gitea 的 WebSocket 端點。
|
||||
- 打開 IIS 管理控制檯，在左邊的列表中點擊 `Gitea Proxy` 網頁。在中間選中並且雙擊 URL Rewrite 的圖標來加載 URL 重寫的面板。
|
||||
- 在管理控制檯的右邊選擇 `Add Rule` 操作，並且在 `Inbound and Outbound Rules` 分類中選擇 `Reverse Proxy Rule`。
|
||||
- 在 Inbound Rules 中， 將 server name 設定為 Gitea 正在運行的主機以及對應端口。例如，如果你在 localhost 的 3000 端口上運行 Gitea，則設定為 `127.0.0.1:3000`。
|
||||
- 啟用 SSL Offloading
|
||||
- 在 Outbound Rules 中，確保設定了 `Rewrite the domain names of the links in HTTP response`，並且將 `From:` 設定為上面的 server name，將 `To:` 設定為你的外部訪問名稱，例如：`git.example.com`
|
||||
- 關閉 Application Request Routing 的 `Server Proxy Settings` 中的 `Reverse rewrite host in response headers`（在 IIS 管理員中選擇伺服器節點，打開 `Application Request Routing Cache`，再開啟右側的 `Server Proxy Settings`）。若保持開啟，ARR 會把 `Location` 頭裡的主機改回內部位址，導致登入或表單提交後的重新導向把瀏覽器送到 `127.0.0.1:3000` 而不是 `git.example.com`。
|
||||
- 現在，根據下面的內容為您的網頁編輯 `web.config`（將 `127.0.0.1:3000` 和 `git.example.com` 改為適當的值）
|
||||
|
||||
```xml
|
||||
|
||||
+61
-15
@@ -14,6 +14,7 @@ aliases:
|
||||
2. 將 `https://git.example.com/foo` 反向代理到 `http://gitea:3000/foo`
|
||||
3. 確保反向代理不會解碼 URI。`https://git.example.com/a%2Fb`的請求應該被傳遞給 `http://gitea:3000/a%2Fb`。
|
||||
4. 確保 `Host` 和 `X-Forwarded-Proto` 頭被正確的傳遞給 Gitea，使 Gitea 可以看到正在訪問的真實 URL。
|
||||
5. 確保 Web 伺服器有完整的憑證（包括所有中間憑證和根憑證），以便 `git clone` 和 `git pull` 正常工作。
|
||||
|
||||
## 使用子路徑
|
||||
|
||||
@@ -61,7 +62,7 @@ server {
|
||||
|
||||
# 確保 nginx 使用未轉義 URI， 按原樣保持 "%2F"。 確保 nginx 去除 "/gitea" 子路徑前綴， 按原樣傳遞 "/v2"。
|
||||
rewrite ^ $request_uri;
|
||||
rewrite ^(/gitea)?(/.*) $2 break;
|
||||
rewrite ^/(gitea($|/))?(.*) /$3 break;
|
||||
proxy_pass http://127.0.0.1:3000$uri;
|
||||
|
||||
# 其他的常規 HTTP 表頭，見上面“使用 Nginx 作為反向代理服務”小節的配置
|
||||
@@ -75,7 +76,7 @@ server {
|
||||
}
|
||||
```
|
||||
|
||||
然後您**必須**在 Gitea 的設定文件中正確的添加類似 `[server] ROOT_URL = http://git.example.com/git/` 的設定項。
|
||||
然後您**必須**在 Gitea 的設定文件中正確的添加類似 `[server] ROOT_URL = http://git.example.com/gitea/` 的設定項。
|
||||
|
||||
## 使用 Nginx 直接提供靜態資源
|
||||
|
||||
@@ -144,6 +145,20 @@ server {
|
||||
}
|
||||
```
|
||||
|
||||
## Nginx Proxy Manager
|
||||
|
||||
如果使用 Nginx Proxy Manager 作為 Gitea 的反向代理，設定與原生 Nginx 略有不同。
|
||||
|
||||
它會[預設給自訂 location 加上一些指令](https://github.com/NginxProxyManager/nginx-proxy-manager/blob/master/docker/rootfs/etc/nginx/conf.d/include/proxy.conf)，因此上面 Nginx 設定裡對應的指令不要再寫一遍。否則會因為指令重複（尤其是 `proxy_set_header Host $host`）出現 `400 bad request`。
|
||||
|
||||
建立 `/` 自訂 location 時，只需在其設定中加入：
|
||||
|
||||
```nginx
|
||||
client_max_body_size 512M;
|
||||
proxy_set_header Connection $http_connection;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
```
|
||||
|
||||
## 使用 Apache HTTPD 作為反向代理服務
|
||||
|
||||
如果您想使用 Apache HTTPD 作為 Gitea 的反向代理服務，您可以為您的 Apache HTTPD 作如下設定（在 Ubuntu 中，設定文件通常在 `/etc/apache2/httpd.conf` 目錄下）：
|
||||
@@ -161,23 +176,12 @@ server {
|
||||
|
||||
注：必須啟用以下 Apache HTTPD 元件：`proxy`， `proxy_http`
|
||||
|
||||
如果希望用 Let's Encrypt 的 webroot 驗證，請在 `ProxyPass` 之前加入 `ProxyPass /.well-known !`，避免把這些請求代理到 Gitea。
|
||||
|
||||
## 使用 Apache HTTPD 作為反向代理服務並將 Gitea 路由至一個子路徑
|
||||
|
||||
如果您已經有一個域名並且想與 Gitea 共享該域名，您可以增加以下設定為 Gitea 添加路由規則（在 Ubuntu 中，設定文件通常在 `/etc/apache2/httpd.conf` 目錄下）：
|
||||
|
||||
```
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
<Proxy *>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Proxy>
|
||||
AllowEncodedSlashes NoDecode
|
||||
# 注意: 路徑和 URL 後面都不要寫路徑符號 '/'
|
||||
ProxyPass /git http://localhost:3000 nocanon
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
```apacheconf
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
@@ -197,6 +201,48 @@ server {
|
||||
|
||||
注：必須啟用以下 Apache HTTPD 元件：`proxy`， `proxy_http`
|
||||
|
||||
## 使用 Apache HTTPD 直接提供靜態資源
|
||||
|
||||
我們可以通過將資源分為靜態和動態兩種類型來調節性能。
|
||||
|
||||
CSS 文件、JavaScript 文件、圖片和字體是靜態內容。首頁、倉庫視圖和工單列表是動態內容。
|
||||
|
||||
Apache HTTPD 可以直接提供靜態資源，並且只代理動態資源請求給 Gitea。
|
||||
|
||||
將 Gitea 源代碼倉庫的一個快照下載到 `/path/to/gitea/`。
|
||||
在此之後，在本地倉庫目錄運行 `make frontend` 來生成靜態資源。在這個情況下，我們只對 `public/` 目錄感興趣，您可以刪除剩下的其他目錄。
|
||||
（為了生成靜態資源，您需要安裝一個[帶 npm 的 Node ](https://nodejs.org/en/download/)和 `make`）
|
||||
|
||||
取決於您的用戶量的大小，您可以將流量分離到兩個不同的服務器，或者為靜態資源設定一個 cdn。
|
||||
|
||||
### 單伺服器節點，單域名
|
||||
|
||||
將 `[server] STATIC_URL_PREFIX = /_/static` 寫入您的 Gitea 設定文件：
|
||||
|
||||
```apacheconf
|
||||
<VirtualHost *:80>
|
||||
...
|
||||
<Proxy *>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Proxy>
|
||||
|
||||
ProxyPass /_/static/ !
|
||||
Alias /_/static/ /path/to/gitea/public/
|
||||
<Directory /path/to/gitea/public/>
|
||||
Options FollowSymlinks
|
||||
AllowOverride None
|
||||
Require all granted
|
||||
</Directory>
|
||||
|
||||
AllowEncodedSlashes NoDecode
|
||||
# 注意: 路徑和 URL 後面都不要寫路徑符號 '/'
|
||||
ProxyPass / http://localhost:3000/ nocanon
|
||||
ProxyPreserveHost On
|
||||
RequestHeader set "X-Forwarded-Proto" expr=%{REQUEST_SCHEME}
|
||||
</VirtualHost>
|
||||
```
|
||||
|
||||
## 使用 Caddy 作為反向代理服務
|
||||
|
||||
如果您想使用 Caddy 作為 Gitea 的反向代理服務，您可以在 `Caddyfile` 中添加如下設定：
|
||||
|
||||
@@ -68,11 +68,12 @@ runner:
|
||||
# scratch directories (left behind when a host cleanup delete stalls) older than
|
||||
# this duration. Setting either workdir_cleanup_age or idle_cleanup_interval to 0
|
||||
# (or any non-positive value) disables stale-directory cleanup entirely, along with
|
||||
# the docker network cleanup below.
|
||||
# the docker network and volume cleanup below.
|
||||
#workdir_cleanup_age: 24h
|
||||
# Cadence for the idle cleanup pass. Besides the directories above, on runners that use
|
||||
# docker it removes the per-job networks of jobs this runner did not live to tear down,
|
||||
# which would otherwise hold a subnet of the daemon address pool until the host is rebuilt.
|
||||
# docker it removes the per-job networks and volumes of jobs this runner did not live to
|
||||
# tear down, which would otherwise hold a subnet of the daemon address pool and the job's
|
||||
# workspace contents until the host is rebuilt.
|
||||
#idle_cleanup_interval: 10m
|
||||
# The base interval for periodic log flush to the Gitea instance.
|
||||
# Logs may be sent earlier if the buffer reaches log_report_batch_size
|
||||
@@ -154,7 +155,8 @@ runner:
|
||||
# job_completed: ''
|
||||
|
||||
cache:
|
||||
# Enable the built-in cache server (used by actions/cache and similar actions).
|
||||
# Enable caching (used by actions/cache and similar actions). Off means no built-in server is
|
||||
# started and no job is registered with an external_server either.
|
||||
#enabled: true
|
||||
# Directory where cache blobs are stored on disk. Default: $HOME/.cache/actcache
|
||||
# Ignored when external_server is set.
|
||||
@@ -191,9 +193,9 @@ cache:
|
||||
# until its cache entry expires or is manually removed.
|
||||
#offline_mode: false
|
||||
# Serve the actions cache service v2 API. The actions that use it refuse any host they do not
|
||||
# take for GitHub, so reaching it means editing that check out of their own bundle, undone
|
||||
# whenever it is downloaded again. That edit is made either way, this only governs the API
|
||||
# advertised. A bundle that does not match is left alone.
|
||||
# take for GitHub, so reaching it means editing that check out of their own bundle, put back
|
||||
# after the copy into the job. That edit is made either way, this only governs the API
|
||||
# advertised. A bundle that does not match is left alone. With v2, uploads need a reachable cache.
|
||||
#v2: true
|
||||
# How the cache server discards entries, ignored when external_server is set since that
|
||||
# server applies its own. Leave a setting out for its default; 0s or 0 turns the three
|
||||
@@ -271,11 +273,10 @@ container:
|
||||
#require_docker: false
|
||||
# Timeout to wait for the docker daemon to be reachable, if docker is required by require_docker or runner
|
||||
#docker_timeout: 0s
|
||||
# Bind the workspace to the host filesystem instead of using Docker volumes.
|
||||
# This is required for Docker-in-Docker (DinD) setups when jobs use docker compose
|
||||
# with bind mounts (e.g., ".:/app"), as volume-based workspaces are not accessible
|
||||
# from the DinD daemon's filesystem. When enabled, ensure the workspace parent
|
||||
# directory is also mounted into the runner container and listed in valid_volumes.
|
||||
# Mount the workspace from a host directory instead of a Docker volume, so jobs
|
||||
# can bind-mount it by its own path into sibling containers (".:/app" in docker
|
||||
# compose). Not needed when workflows use the GITEA_DOCKER_WORKSPACE variable.
|
||||
# The workspace parent directory must be mounted into the runner container.
|
||||
#bind_workdir: false
|
||||
# How long a job waits for a service container that declares a healthcheck to become
|
||||
# healthy. A negative value (e.g. -1s) starts the steps without waiting.
|
||||
|
||||
@@ -103,13 +103,15 @@ Flags:
|
||||
--detect-event Use first event type from workflow as event that triggered the workflow
|
||||
-C, --directory string working directory (default ".")
|
||||
-n, --dryrun dryrun mode
|
||||
--env stringArray env to make available to actions with optional value (e.g. --env myenv=foo or --env myenv)
|
||||
--env stringArray env to make available to actions with optional value (e.g. --env myenv=foo or --env myenv; override env-file)
|
||||
--env-file string environment file to read and use as env in the containers (default ".env")
|
||||
-E, --event string run a event name
|
||||
-e, --eventpath string path to a JSON event payload file exposed as the event that triggered the workflow
|
||||
--gitea-instance string Gitea instance to use.
|
||||
-h, --help help for exec
|
||||
-i, --image string Docker image to use. Use "-self-hosted" to run directly on the host. (default "docker.gitea.com/runner-images:ubuntu-latest")
|
||||
--input stringArray set an input the workflow declares under its workflow_dispatch or workflow_call trigger, others stay invisible to the inputs context (e.g. --input name=bar; can be specified multiple times with highest precedence)
|
||||
--input-file string path to an .env-format file containing key=value pairs as baseline workflow inputs (override event inputs)
|
||||
--insecure-secrets NOT RECOMMENDED! Doesn't hide secrets while printing logs.
|
||||
-j, --job string run a specific job ID; when several workflow files define that job, also pass --workflows/-W to select the file
|
||||
--json Output logs in json format
|
||||
|
||||
@@ -154,7 +154,8 @@ runner:
|
||||
# job_completed: ''
|
||||
|
||||
cache:
|
||||
# Enable the built-in cache server (used by actions/cache and similar actions).
|
||||
# Enable caching (used by actions/cache and similar actions). Off means no built-in server is
|
||||
# started and no job is registered with an external_server either.
|
||||
#enabled: true
|
||||
# Directory where cache blobs are stored on disk. Default: $HOME/.cache/actcache
|
||||
# Ignored when external_server is set.
|
||||
@@ -191,9 +192,9 @@ cache:
|
||||
# until its cache entry expires or is manually removed.
|
||||
#offline_mode: false
|
||||
# Serve the actions cache service v2 API. The actions that use it refuse any host they do not
|
||||
# take for GitHub, so reaching it means editing that check out of their own bundle, undone
|
||||
# whenever it is downloaded again. That edit is made either way, this only governs the API
|
||||
# advertised. A bundle that does not match is left alone.
|
||||
# take for GitHub, so reaching it means editing that check out of their own bundle, put back
|
||||
# after the copy into the job. That edit is made either way, this only governs the API
|
||||
# advertised. A bundle that does not match is left alone. With v2, uploads need a reachable cache.
|
||||
#v2: true
|
||||
# How the cache server discards entries, ignored when external_server is set since that
|
||||
# server applies its own. Leave a setting out for its default; 0s or 0 turns the three
|
||||
@@ -271,11 +272,10 @@ container:
|
||||
#require_docker: false
|
||||
# Timeout to wait for the docker daemon to be reachable, if docker is required by require_docker or runner
|
||||
#docker_timeout: 0s
|
||||
# Bind the workspace to the host filesystem instead of using Docker volumes.
|
||||
# This is required for Docker-in-Docker (DinD) setups when jobs use docker compose
|
||||
# with bind mounts (e.g., ".:/app"), as volume-based workspaces are not accessible
|
||||
# from the DinD daemon's filesystem. When enabled, ensure the workspace parent
|
||||
# directory is also mounted into the runner container and listed in valid_volumes.
|
||||
# Mount the workspace from a host directory instead of a Docker volume, so jobs
|
||||
# can bind-mount it by its own path into sibling containers (".:/app" in docker
|
||||
# compose). Not needed when workflows use the GITEA_DOCKER_WORKSPACE variable.
|
||||
# The workspace parent directory must be mounted into the runner container.
|
||||
#bind_workdir: false
|
||||
# How long a job waits for a service container that declares a healthcheck to become
|
||||
# healthy. A negative value (e.g. -1s) starts the steps without waiting.
|
||||
|
||||
@@ -12058,6 +12058,9 @@
|
||||
"403": {
|
||||
"$ref": "#/components/responses/forbidden"
|
||||
},
|
||||
"409": {
|
||||
"$ref": "#/components/responses/error"
|
||||
},
|
||||
"422": {
|
||||
"$ref": "#/components/responses/validationError"
|
||||
}
|
||||
@@ -12142,6 +12145,9 @@
|
||||
"403": {
|
||||
"$ref": "#/components/responses/forbidden"
|
||||
},
|
||||
"409": {
|
||||
"$ref": "#/components/responses/error"
|
||||
},
|
||||
"422": {
|
||||
"$ref": "#/components/responses/validationError"
|
||||
}
|
||||
@@ -34999,6 +35005,12 @@
|
||||
"201": {
|
||||
"$ref": "#/components/responses/EmailList"
|
||||
},
|
||||
"400": {
|
||||
"$ref": "#/components/responses/error"
|
||||
},
|
||||
"409": {
|
||||
"$ref": "#/components/responses/error"
|
||||
},
|
||||
"422": {
|
||||
"$ref": "#/components/responses/validationError"
|
||||
}
|
||||
|
||||
@@ -945,6 +945,9 @@
|
||||
"403": {
|
||||
"$ref": "#/responses/forbidden"
|
||||
},
|
||||
"409": {
|
||||
"$ref": "#/responses/error"
|
||||
},
|
||||
"422": {
|
||||
"$ref": "#/responses/validationError"
|
||||
}
|
||||
@@ -1029,6 +1032,9 @@
|
||||
"403": {
|
||||
"$ref": "#/responses/forbidden"
|
||||
},
|
||||
"409": {
|
||||
"$ref": "#/responses/error"
|
||||
},
|
||||
"422": {
|
||||
"$ref": "#/responses/validationError"
|
||||
}
|
||||
@@ -22273,6 +22279,12 @@
|
||||
"201": {
|
||||
"$ref": "#/responses/EmailList"
|
||||
},
|
||||
"400": {
|
||||
"$ref": "#/responses/error"
|
||||
},
|
||||
"409": {
|
||||
"$ref": "#/responses/error"
|
||||
},
|
||||
"422": {
|
||||
"$ref": "#/responses/validationError"
|
||||
}
|
||||
|
||||
@@ -51,6 +51,11 @@ Example:
|
||||
|
||||
> This bug was introduced in [e59ff077](#)
|
||||
|
||||
Commits in other repositories can be referred to as well
|
||||
using the form `owner/repository@e59ff077`:
|
||||
|
||||
> This bug was introduced in [mike/compiler@e59ff077](#)
|
||||
|
||||
## Issues and Pull Requests
|
||||
|
||||
A reference to another issue or pull request can be created using the simple
|
||||
@@ -177,7 +182,7 @@ In the examples, `User1/Repo1` refers to the repository where the reference is u
|
||||
| `UserZ/RepoZ!1234` | - | no | A link to issue/pull 1234 in `UserZ/RepoZ` |
|
||||
| `UserZ/RepoZ#1234` | - | yes | A link to _external issue_ 1234 for `UserZ/RepoZ` |
|
||||
| `UserZ/RepoZ!1234` | - | yes | A link to _PR_ 1234 for `UserZ/RepoZ` |
|
||||
| **Alphanumeric issue IDs:** | - | - | - |
|
||||
| **Alphanumeric issue IDs:** | - | - | - |
|
||||
| `AAA-1234` | yes | - | A link to _external issue_ `AAA-1234` for `User1/Repo1` |
|
||||
| `!1234` | yes | - | A link to _PR_ 1234 for `User1/Repo1` |
|
||||
| `User1/Repo1!1234` | yes | - | A link to _PR_ 1234 for `User1/Repo1` |
|
||||
|
||||
Reference in New Issue
Block a user