mirror of
https://gitea.com/gitea/docs.git
synced 2026-09-17 19:55:34 +00:00
Update TLS settings docs (#489)
Update for https://github.com/go-gitea/gitea/pull/38687. Reviewed-on: https://gitea.com/gitea/docs/pulls/489 Reviewed-by: techknowlogick <[email protected]> Co-authored-by: silverwind <[email protected]>
This commit is contained in:
silverwind
@@ -451,42 +451,10 @@ The following configuration set `Content-Type: application/vnd.android.package-a
|
||||
- `REDIRECT_OTHER_PORT`: **false**: If true and `PROTOCOL` is https, allows redirecting http requests on `PORT_TO_REDIRECT` to the https port Gitea listens on.
|
||||
- `REDIRECTOR_USE_PROXY_PROTOCOL`: **`{USE_PROXY_PROTOCOL}`**: expect PROXY protocol header on connections to https redirector.
|
||||
- `PORT_TO_REDIRECT`: **80**: Port for the http redirection service to listen on. Used when `REDIRECT_OTHER_PORT` is true.
|
||||
- `SSL_MIN_VERSION`: **TLSv1.2**: Set the minimum version of ssl support.
|
||||
- `SSL_MAX_VERSION`: **_empty_**: Set the maximum version of ssl support.
|
||||
- `SSL_CURVE_PREFERENCES`: **X25519,P256**: Set the preferred curves,
|
||||
- `SSL_CIPHER_SUITES`: **ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305**: Set the preferred cipher suites.
|
||||
- If there is no hardware support for AES suites, by default the ChaCha suites will be preferred over the AES suites.
|
||||
- supported suites as of Go 1.18 are:
|
||||
- TLS 1.0 - 1.2 cipher suites
|
||||
- "rsa_with_rc4_128_sha"
|
||||
- "rsa_with_3des_ede_cbc_sha"
|
||||
- "rsa_with_aes_128_cbc_sha"
|
||||
- "rsa_with_aes_256_cbc_sha"
|
||||
- "rsa_with_aes_128_cbc_sha256"
|
||||
- "rsa_with_aes_128_gcm_sha256"
|
||||
- "rsa_with_aes_256_gcm_sha384"
|
||||
- "ecdhe_ecdsa_with_rc4_128_sha"
|
||||
- "ecdhe_ecdsa_with_aes_128_cbc_sha"
|
||||
- "ecdhe_ecdsa_with_aes_256_cbc_sha"
|
||||
- "ecdhe_rsa_with_rc4_128_sha"
|
||||
- "ecdhe_rsa_with_3des_ede_cbc_sha"
|
||||
- "ecdhe_rsa_with_aes_128_cbc_sha"
|
||||
- "ecdhe_rsa_with_aes_256_cbc_sha"
|
||||
- "ecdhe_ecdsa_with_aes_128_cbc_sha256"
|
||||
- "ecdhe_rsa_with_aes_128_cbc_sha256"
|
||||
- "ecdhe_rsa_with_aes_128_gcm_sha256"
|
||||
- "ecdhe_ecdsa_with_aes_128_gcm_sha256"
|
||||
- "ecdhe_rsa_with_aes_256_gcm_sha384"
|
||||
- "ecdhe_ecdsa_with_aes_256_gcm_sha384"
|
||||
- "ecdhe_rsa_with_chacha20_poly1305_sha256"
|
||||
- "ecdhe_ecdsa_with_chacha20_poly1305_sha256"
|
||||
- TLS 1.3 cipher suites
|
||||
- "aes_128_gcm_sha256"
|
||||
- "aes_256_gcm_sha384"
|
||||
- "chacha20_poly1305_sha256"
|
||||
- Aliased names
|
||||
- "ecdhe_rsa_with_chacha20_poly1305" is an alias for "ecdhe_rsa_with_chacha20_poly1305_sha256"
|
||||
- "ecdhe_ecdsa_with_chacha20_poly1305" is alias for "ecdhe_ecdsa_with_chacha20_poly1305_sha256"
|
||||
- `SSL_MIN_VERSION`: **_empty_**: Minimum supported TLS version, one of TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3. Unset uses Go's default.
|
||||
- `SSL_MAX_VERSION`: **_empty_**: Maximum supported TLS version, one of TLSv1.0, TLSv1.1, TLSv1.2, TLSv1.3. Unset uses Go's default.
|
||||
- `SSL_CURVE_PREFERENCES`: **_empty_**: Comma-separated list of SSL curve preferences. Unset uses Go's default.
|
||||
- `SSL_CIPHER_SUITES`: **_empty_**: Comma-separated list of SSL cipher suites. Unset uses Go's default.
|
||||
- `ENABLE_ACME`: **false**: Flag to enable automatic certificate management via an ACME capable Certificate Authority (CA) server (default: Lets Encrypt). If enabled, `CERT_FILE` and `KEY_FILE` are ignored, and the CA must resolve `DOMAIN` to this gitea server. Ensure that DNS records are set and either port `80` or port `443` are accessible by the CA server (the public internet by default), and redirected to the appropriate ports `PORT_TO_REDIRECT` or `HTTP_PORT` respectively.
|
||||
- `ACME_URL`: **_empty_**: The CA's ACME directory URL, e.g. for a self-hosted [smallstep CA server](https://github.com/smallstep/certificates), it can look like `https://ca.example.com/acme/acme/directory`. If left empty, it defaults to using Let's Encerypt's production CA (check `LETSENCRYPT_ACCEPTTOS` as well).
|
||||
- `ACME_ACCEPTTOS`: **false**: This is an explicit check that you accept the terms of service of the ACME provider. The default is Lets Encrypt [terms of service](https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf).
|
||||
|
||||
+4
-36
@@ -396,42 +396,10 @@ aliases:
|
||||
- `REDIRECT_OTHER_PORT`: **false**: 如果为 true 并且 `PROTOCOL` 为 https，则允许将 http 请求重定向到 Gitea 监听的 https 端口的 `PORT_TO_REDIRECT`。
|
||||
- `REDIRECTOR_USE_PROXY_PROTOCOL`: **`{USE_PROXY_PROTOCOL}`**: 在连接到 https 重定向器时，需要 PROXY 协议头。
|
||||
- `PORT_TO_REDIRECT`: **80**: http 重定向服务监听的端口。当 `REDIRECT_OTHER_PORT` 为 true 时使用。
|
||||
- `SSL_MIN_VERSION`: **TLSv1.2**: 设置最低支持的 SSL 版本。
|
||||
- `SSL_MAX_VERSION`: **_empty_**: 设置最大支持的 SSL 版本。
|
||||
- `SSL_CURVE_PREFERENCES`: **X25519,P256**: 设置首选的曲线。
|
||||
- `SSL_CIPHER_SUITES`: **ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305**: 设置首选的密码套件。
|
||||
- 如果没有对 AES 套件的硬件支持，默认情况下，ChaCha 套件将优先于 AES 套件。
|
||||
- 根据 Go 1.18 的支持的套件有：
|
||||
- TLS 1.0 - 1.2 套件
|
||||
- "rsa_with_rc4_128_sha"
|
||||
- "rsa_with_3des_ede_cbc_sha"
|
||||
- "rsa_with_aes_128_cbc_sha"
|
||||
- "rsa_with_aes_256_cbc_sha"
|
||||
- "rsa_with_aes_128_cbc_sha256"
|
||||
- "rsa_with_aes_128_gcm_sha256"
|
||||
- "rsa_with_aes_256_gcm_sha384"
|
||||
- "ecdhe_ecdsa_with_rc4_128_sha"
|
||||
- "ecdhe_ecdsa_with_aes_128_cbc_sha"
|
||||
- "ecdhe_ecdsa_with_aes_256_cbc_sha"
|
||||
- "ecdhe_rsa_with_rc4_128_sha"
|
||||
- "ecdhe_rsa_with_3des_ede_cbc_sha"
|
||||
- "ecdhe_rsa_with_aes_128_cbc_sha"
|
||||
- "ecdhe_rsa_with_aes_256_cbc_sha"
|
||||
- "ecdhe_ecdsa_with_aes_128_cbc_sha256"
|
||||
- "ecdhe_rsa_with_aes_128_cbc_sha256"
|
||||
- "ecdhe_rsa_with_aes_128_gcm_sha256"
|
||||
- "ecdhe_ecdsa_with_aes_128_gcm_sha256"
|
||||
- "ecdhe_rsa_with_aes_256_gcm_sha384"
|
||||
- "ecdhe_ecdsa_with_aes_256_gcm_sha384"
|
||||
- "ecdhe_rsa_with_chacha20_poly1305_sha256"
|
||||
- "ecdhe_ecdsa_with_chacha20_poly1305_sha256"
|
||||
- TLS 1.3 套件
|
||||
- "aes_128_gcm_sha256"
|
||||
- "aes_256_gcm_sha384"
|
||||
- "chacha20_poly1305_sha256"
|
||||
- 别名
|
||||
- "ecdhe_rsa_with_chacha20_poly1305" 是 "ecdhe_rsa_with_chacha20_poly1305_sha256" 的别名
|
||||
- "ecdhe_ecdsa_with_chacha20_poly1305" 是 "ecdhe_ecdsa_with_chacha20_poly1305_sha256" 的别名
|
||||
- `SSL_MIN_VERSION`: **_empty_**: 最低支持的 TLS 版本，可选 TLSv1.0、TLSv1.1、TLSv1.2、TLSv1.3。留空则使用 Go 的默认值。
|
||||
- `SSL_MAX_VERSION`: **_empty_**: 最高支持的 TLS 版本，可选 TLSv1.0、TLSv1.1、TLSv1.2、TLSv1.3。留空则使用 Go 的默认值。
|
||||
- `SSL_CURVE_PREFERENCES`: **_empty_**: 以逗号分隔的 SSL 曲线偏好列表。留空则使用 Go 的默认值。
|
||||
- `SSL_CIPHER_SUITES`: **_empty_**: 以逗号分隔的 SSL 密码套件列表。留空则使用 Go 的默认值。
|
||||
- `ENABLE_ACME`: **false**: 通过 ACME 能力的证书颁发机构（CA）服务器（默认为 Let's Encrypt）启用自动证书管理的标志。如果启用，将忽略 `CERT_FILE` 和 `KEY_FILE`，并且 CA 必须将 `DOMAIN` 解析为此 Gitea 服务器。确保设置了 DNS 记录，并且端口 `80` 或端口 `443` 可以被 CA 服务器访问（默认情况下是公共互联网），并重定向到相应的端口 `PORT_TO_REDIRECT` 或 `HTTP_PORT`。
|
||||
- `ACME_URL`: **_empty_**: CA 的 ACME 目录 URL，例如自托管的 [smallstep CA 服务器](https://github.com/smallstep/certificates)，它可以是 `https://ca.example.com/acme/acme/directory`。如果留空，默认使用 Let's Encrypt 的生产 CA（还要检查 `LETSENCRYPT_ACCEPTTOS`）。
|
||||
- `ACME_ACCEPTTOS`: **false**: 这是一个明确的检查，您是否接受 ACME 提供者的服务条款。默认为 Let's Encrypt 的 [服务条款](https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf)。
|
||||
|
||||
+4
-36
@@ -399,42 +399,10 @@ aliases:
|
||||
- `REDIRECT_OTHER_PORT`: **false**: 如果為 true 並且 `PROTOCOL` 為 https，則允許將 http 請求重定向到 Gitea 監聽的 https 端口的 `PORT_TO_REDIRECT`。
|
||||
- `REDIRECTOR_USE_PROXY_PROTOCOL`: **`{USE_PROXY_PROTOCOL}`**: 在連接到 https 重定向器時，需要 PROXY 協議頭。
|
||||
- `PORT_TO_REDIRECT`: **80**: http 重定向服務監聽的端口。當 `REDIRECT_OTHER_PORT` 為 true 時使用。
|
||||
- `SSL_MIN_VERSION`: **TLSv1.2**: 設定最低支援的 SSL 版本。
|
||||
- `SSL_MAX_VERSION`: **_empty_**: 設定最大支援的 SSL 版本。
|
||||
- `SSL_CURVE_PREFERENCES`: **X25519,P256**: 設定首選的曲線。
|
||||
- `SSL_CIPHER_SUITES`: **ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305**: 設定首選的密碼套件。
|
||||
- 如果沒有對 AES 套件的硬件支援，預設情況下，ChaCha 套件將優先於 AES 套件。
|
||||
- 根據 Go 1.18 的支援的套件有：
|
||||
- TLS 1.0 - 1.2 套件
|
||||
- "rsa_with_rc4_128_sha"
|
||||
- "rsa_with_3des_ede_cbc_sha"
|
||||
- "rsa_with_aes_128_cbc_sha"
|
||||
- "rsa_with_aes_256_cbc_sha"
|
||||
- "rsa_with_aes_128_cbc_sha256"
|
||||
- "rsa_with_aes_128_gcm_sha256"
|
||||
- "rsa_with_aes_256_gcm_sha384"
|
||||
- "ecdhe_ecdsa_with_rc4_128_sha"
|
||||
- "ecdhe_ecdsa_with_aes_128_cbc_sha"
|
||||
- "ecdhe_ecdsa_with_aes_256_cbc_sha"
|
||||
- "ecdhe_rsa_with_rc4_128_sha"
|
||||
- "ecdhe_rsa_with_3des_ede_cbc_sha"
|
||||
- "ecdhe_rsa_with_aes_128_cbc_sha"
|
||||
- "ecdhe_rsa_with_aes_256_cbc_sha"
|
||||
- "ecdhe_ecdsa_with_aes_128_cbc_sha256"
|
||||
- "ecdhe_rsa_with_aes_128_cbc_sha256"
|
||||
- "ecdhe_rsa_with_aes_128_gcm_sha256"
|
||||
- "ecdhe_ecdsa_with_aes_128_gcm_sha256"
|
||||
- "ecdhe_rsa_with_aes_256_gcm_sha384"
|
||||
- "ecdhe_ecdsa_with_aes_256_gcm_sha384"
|
||||
- "ecdhe_rsa_with_chacha20_poly1305_sha256"
|
||||
- "ecdhe_ecdsa_with_chacha20_poly1305_sha256"
|
||||
- TLS 1.3 套件
|
||||
- "aes_128_gcm_sha256"
|
||||
- "aes_256_gcm_sha384"
|
||||
- "chacha20_poly1305_sha256"
|
||||
- 別名
|
||||
- "ecdhe_rsa_with_chacha20_poly1305" 是 "ecdhe_rsa_with_chacha20_poly1305_sha256" 的別名
|
||||
- "ecdhe_ecdsa_with_chacha20_poly1305" 是 "ecdhe_ecdsa_with_chacha20_poly1305_sha256" 的別名
|
||||
- `SSL_MIN_VERSION`: **_empty_**: 最低支援的 TLS 版本，可選 TLSv1.0、TLSv1.1、TLSv1.2、TLSv1.3。留空則使用 Go 的預設值。
|
||||
- `SSL_MAX_VERSION`: **_empty_**: 最高支援的 TLS 版本，可選 TLSv1.0、TLSv1.1、TLSv1.2、TLSv1.3。留空則使用 Go 的預設值。
|
||||
- `SSL_CURVE_PREFERENCES`: **_empty_**: 以逗號分隔的 SSL 曲線偏好列表。留空則使用 Go 的預設值。
|
||||
- `SSL_CIPHER_SUITES`: **_empty_**: 以逗號分隔的 SSL 密碼套件列表。留空則使用 Go 的預設值。
|
||||
- `ENABLE_ACME`: **false**: 通過 ACME 能力的證書頒發機構（CA）伺服器（預設為 Let's Encrypt）啟用自動證書管理的標誌。如果啟用，將忽略 `CERT_FILE` 和 `KEY_FILE`，並且 CA 必須將 `DOMAIN` 解析為此 Gitea 伺服器。確保設定了 DNS 記錄，並且端口 `80` 或端口 `443` 可以被 CA 伺服器訪問（預設情況下是公共互聯網），並重定向到相應的端口 `PORT_TO_REDIRECT` 或 `HTTP_PORT`。
|
||||
- `ACME_URL`: **_empty_**: CA 的 ACME 目錄 URL，例如自託管的 [smallstep CA 伺服器](https://github.com/smallstep/certificates)，它可以是 `https://ca.example.com/acme/acme/directory`。如果留空，預設使用 Let's Encrypt 的生產 CA（還要檢查 `LETSENCRYPT_ACCEPTTOS`）。
|
||||
- `ACME_ACCEPTTOS`: **false**: 這是一個明確的檢查，您是否接受 ACME 提供者的服務條款。預設為 Let's Encrypt 的 [服務條款](https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf)。
|
||||
|
||||
Reference in New Issue
Block a user