diff --git a/docs/administration/authentication.md b/docs/administration/authentication.md index 5febea12..bbfe0ea3 100644 --- a/docs/administration/authentication.md +++ b/docs/administration/authentication.md @@ -337,9 +337,13 @@ The default login user email is `X-WEBAUTH-EMAIL`, you can change it via changin If set `ENABLE_REVERSE_PROXY_FULL_NAME=true`, a user full name expected in `X-WEBAUTH-FULLNAME` will be assigned to the user when auto creating the user. You can also change the header name with `REVERSE_PROXY_AUTHENTICATION_FULL_NAME`. -You can also limit the reverse proxy's IP address range with `REVERSE_PROXY_TRUSTED_PROXIES` which default value is `127.0.0.0/8,::1/128`. By `REVERSE_PROXY_LIMIT`, you can limit trusted proxies level. +It applies to the web interface, Git over HTTP, Git LFS and the package registry. -You can enable the this authentication method for the API with +:::warning +Gitea trusts these headers on every request it receives. Make sure Gitea is only reachable through your authenticating proxy, and that the proxy sets or removes these headers on every request, including on paths you exempt from authentication, for example for Git or package clients. `REVERSE_PROXY_TRUSTED_PROXIES` does not restrict them. +::: + +To also accept them on the REST API under `/api/v1`, enable: ```ini [service] diff --git a/docs/administration/config-cheat-sheet.md b/docs/administration/config-cheat-sheet.md index 166baf6f..f08ac133 100644 --- a/docs/administration/config-cheat-sheet.md +++ b/docs/administration/config-cheat-sheet.md @@ -740,8 +740,8 @@ And the following unique queues: If you set it to false, maybe it also needs to set `ENABLE_BASIC_AUTHENTICATION` to false to completely disable password-based authentication. - `ENABLE_PASSKEY_AUTHENTICATION`: **true**: Allow users to sign-in with a passkey -- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable this to allow reverse proxy authentication for web requests -- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable this to allow reverse proxy authentication for API requests, the reverse proxy is responsible for ensuring that no CSRF is possible. +- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable reverse proxy authentication for the web interface, Git over HTTP, Git LFS and the package registry. Gitea must only be reachable through the proxy, see [Reverse Proxy](authentication.md#reverse-proxy). +- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable reverse proxy authentication for the REST API under `/api/v1`. - `ENABLE_REVERSE_PROXY_AUTO_REGISTRATION`: **false**: Enable this to allow auto-registration for reverse authentication. - `ENABLE_REVERSE_PROXY_EMAIL`: **false**: Enable this to allow to auto-registration with a @@ -1707,7 +1707,7 @@ PROXY_HOSTS = *.github.com But it will save storage space and network bandwidth, so it's still recommended to use compression. - `ARTIFACT_RETENTION_DAYS`: **90**: Days to keep artifacts. Old artifacts will be deleted after this period. 0 means keep forever. Changes only apply to newly uploaded artifacts, existing ones keep the expiry stored when they were uploaded. - Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step. + Workflows can request a shorter retention period, down to 1 day. - `ARTIFACT_PREVIEW_MAX_SIZE`: **10485760**: Maximum total artifact size in bytes that can be browsed or previewed in the web UI. Set to `0` to disable artifact previews or `-1` for no limit. Individual files are also limited by [`MAX_DISPLAY_FILE_SIZE`](#ui-ui). - `RUN_RETENTION_DAYS`: **400**: Days to keep completed runs. Old runs and everything under them will be deleted after this period. 0 means keep forever. - `ZOMBIE_TASK_TIMEOUT`: **10m**: Timeout to stop the task which have running status, but haven't been updated for a long time diff --git a/docs/usage/actions/variables.md b/docs/usage/actions/variables.md index e38652ff..6ca4492e 100644 --- a/docs/usage/actions/variables.md +++ b/docs/usage/actions/variables.md @@ -39,7 +39,7 @@ These environment variables are set automatically in every workflow run and can | `GITHUB_REF_TYPE` | The type of ref: `branch` or `tag`. | `branch` | | `GITHUB_REPOSITORY` | The owner and repository name. | `gitea/docs` | | `GITHUB_REPOSITORY_OWNER` | The repository owner's username. | `gitea` | -| `GITHUB_RETENTION_DAYS` | The number of days that workflow run logs and artifacts are kept. | `90` | +| `GITHUB_RETENTION_DAYS` | The number of days that artifacts are kept, empty when kept forever. | `90` | | `GITHUB_RUN_ATTEMPT` | The attempt number of the workflow run. | `1` | | `GITHUB_RUN_ID` | A unique number for each workflow run. | `1234` | | `GITHUB_RUN_NUMBER` | A unique number for each run of a particular workflow. | `42` | @@ -98,7 +98,7 @@ These variables are available in workflow expressions via `${{ gitea. }}`. | `gitea.repository`
`github.repository` | The owner and repository name. | `gitea/docs` | | `gitea.repository_owner`
`github.repository_owner` | The repository owner's username. | `gitea` | | `gitea.repositoryUrl`
`github.repositoryUrl` | The HTML URL to the repository. | `https://gitea.com/gitea/docs` | -| `gitea.retention_days`
`github.retention_days` | The number of days that workflow run logs and artifacts are kept. | `90` | +| `gitea.retention_days`
`github.retention_days` | The number of days that artifacts are kept, empty when kept forever. | `90` | | `gitea.run_id`
`github.run_id` | A unique number for each workflow run within a repository. Does not change on re-run. | `1234` | | `gitea.run_number`
`github.run_number` | A unique number for each run of a particular workflow. Starts at 1 and increments with each new run. | `42` | | `gitea.run_attempt`
`github.run_attempt` | A unique number for each re-run attempt. Starts at 1 and increments with each re-run. | `1` | diff --git a/versioned_docs/version-1.27/administration/authentication.md b/versioned_docs/version-1.27/administration/authentication.md index 2cbd44cc..42bd0633 100644 --- a/versioned_docs/version-1.27/administration/authentication.md +++ b/versioned_docs/version-1.27/administration/authentication.md @@ -337,9 +337,13 @@ The default login user email is `X-WEBAUTH-EMAIL`, you can change it via changin If set `ENABLE_REVERSE_PROXY_FULL_NAME=true`, a user full name expected in `X-WEBAUTH-FULLNAME` will be assigned to the user when auto creating the user. You can also change the header name with `REVERSE_PROXY_AUTHENTICATION_FULL_NAME`. -You can also limit the reverse proxy's IP address range with `REVERSE_PROXY_TRUSTED_PROXIES` which default value is `127.0.0.0/8,::1/128`. By `REVERSE_PROXY_LIMIT`, you can limit trusted proxies level. +It applies to the web interface, Git over HTTP, Git LFS and the package registry. -You can enable the this authentication method for the API with +:::warning +Gitea trusts these headers on every request it receives. Make sure Gitea is only reachable through your authenticating proxy, and that the proxy sets or removes these headers on every request, including on paths you exempt from authentication, for example for Git or package clients. `REVERSE_PROXY_TRUSTED_PROXIES` does not restrict them. +::: + +To also accept them on the REST API under `/api/v1`, enable: ```ini [service] diff --git a/versioned_docs/version-1.27/administration/config-cheat-sheet.md b/versioned_docs/version-1.27/administration/config-cheat-sheet.md index b2938f54..32b5f695 100644 --- a/versioned_docs/version-1.27/administration/config-cheat-sheet.md +++ b/versioned_docs/version-1.27/administration/config-cheat-sheet.md @@ -746,8 +746,8 @@ And the following unique queues: If you set it to false, maybe it also needs to set `ENABLE_BASIC_AUTHENTICATION` to false to completely disable password-based authentication. - `ENABLE_PASSKEY_AUTHENTICATION`: **true**: Allow users to sign-in with a passkey -- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable this to allow reverse proxy authentication for web requests -- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable this to allow reverse proxy authentication for API requests, the reverse proxy is responsible for ensuring that no CSRF is possible. +- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable reverse proxy authentication for the web interface, Git over HTTP, Git LFS and the package registry. Gitea must only be reachable through the proxy, see [Reverse Proxy](authentication.md#reverse-proxy). +- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable reverse proxy authentication for the REST API under `/api/v1`. - `ENABLE_REVERSE_PROXY_AUTO_REGISTRATION`: **false**: Enable this to allow auto-registration for reverse authentication. - `ENABLE_REVERSE_PROXY_EMAIL`: **false**: Enable this to allow to auto-registration with a diff --git a/versioned_docs/version-28/administration/authentication.md b/versioned_docs/version-28/administration/authentication.md index 5febea12..bbfe0ea3 100644 --- a/versioned_docs/version-28/administration/authentication.md +++ b/versioned_docs/version-28/administration/authentication.md @@ -337,9 +337,13 @@ The default login user email is `X-WEBAUTH-EMAIL`, you can change it via changin If set `ENABLE_REVERSE_PROXY_FULL_NAME=true`, a user full name expected in `X-WEBAUTH-FULLNAME` will be assigned to the user when auto creating the user. You can also change the header name with `REVERSE_PROXY_AUTHENTICATION_FULL_NAME`. -You can also limit the reverse proxy's IP address range with `REVERSE_PROXY_TRUSTED_PROXIES` which default value is `127.0.0.0/8,::1/128`. By `REVERSE_PROXY_LIMIT`, you can limit trusted proxies level. +It applies to the web interface, Git over HTTP, Git LFS and the package registry. -You can enable the this authentication method for the API with +:::warning +Gitea trusts these headers on every request it receives. Make sure Gitea is only reachable through your authenticating proxy, and that the proxy sets or removes these headers on every request, including on paths you exempt from authentication, for example for Git or package clients. `REVERSE_PROXY_TRUSTED_PROXIES` does not restrict them. +::: + +To also accept them on the REST API under `/api/v1`, enable: ```ini [service] diff --git a/versioned_docs/version-28/administration/config-cheat-sheet.md b/versioned_docs/version-28/administration/config-cheat-sheet.md index a75d7284..0e4b651f 100644 --- a/versioned_docs/version-28/administration/config-cheat-sheet.md +++ b/versioned_docs/version-28/administration/config-cheat-sheet.md @@ -739,8 +739,8 @@ And the following unique queues: If you set it to false, maybe it also needs to set `ENABLE_BASIC_AUTHENTICATION` to false to completely disable password-based authentication. - `ENABLE_PASSKEY_AUTHENTICATION`: **true**: Allow users to sign-in with a passkey -- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable this to allow reverse proxy authentication for web requests -- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable this to allow reverse proxy authentication for API requests, the reverse proxy is responsible for ensuring that no CSRF is possible. +- `ENABLE_REVERSE_PROXY_AUTHENTICATION`: **false**: Enable reverse proxy authentication for the web interface, Git over HTTP, Git LFS and the package registry. Gitea must only be reachable through the proxy, see [Reverse Proxy](authentication.md#reverse-proxy). +- `ENABLE_REVERSE_PROXY_AUTHENTICATION_API`: **false**: Enable reverse proxy authentication for the REST API under `/api/v1`. - `ENABLE_REVERSE_PROXY_AUTO_REGISTRATION`: **false**: Enable this to allow auto-registration for reverse authentication. - `ENABLE_REVERSE_PROXY_EMAIL`: **false**: Enable this to allow to auto-registration with a @@ -1706,7 +1706,7 @@ PROXY_HOSTS = *.github.com But it will save storage space and network bandwidth, so it's still recommended to use compression. - `ARTIFACT_RETENTION_DAYS`: **90**: Days to keep artifacts. Old artifacts will be deleted after this period. 0 means keep forever. Changes only apply to newly uploaded artifacts, existing ones keep the expiry stored when they were uploaded. - Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step. + Workflows can request a shorter retention period, down to 1 day. - `ARTIFACT_PREVIEW_MAX_SIZE`: **10485760**: Maximum total artifact size in bytes that can be browsed or previewed in the web UI. Set to `0` to disable artifact previews or `-1` for no limit. Individual files are also limited by [`MAX_DISPLAY_FILE_SIZE`](#ui-ui). - `RUN_RETENTION_DAYS`: **400**: Days to keep completed runs. Old runs and everything under them will be deleted after this period. 0 means keep forever. - `ZOMBIE_TASK_TIMEOUT`: **10m**: Timeout to stop the task which have running status, but haven't been updated for a long time diff --git a/versioned_docs/version-28/usage/actions/variables.md b/versioned_docs/version-28/usage/actions/variables.md index ac157a64..f060aca5 100644 --- a/versioned_docs/version-28/usage/actions/variables.md +++ b/versioned_docs/version-28/usage/actions/variables.md @@ -39,7 +39,7 @@ These environment variables are set automatically in every workflow run and can | `GITHUB_REF_TYPE` | The type of ref: `branch` or `tag`. | `branch` | | `GITHUB_REPOSITORY` | The owner and repository name. | `gitea/docs` | | `GITHUB_REPOSITORY_OWNER` | The repository owner's username. | `gitea` | -| `GITHUB_RETENTION_DAYS` | The number of days that workflow run logs and artifacts are kept. | `90` | +| `GITHUB_RETENTION_DAYS` | The number of days that artifacts are kept, empty when kept forever. | `90` | | `GITHUB_RUN_ATTEMPT` | The attempt number of the workflow run. | `1` | | `GITHUB_RUN_ID` | A unique number for each workflow run. | `1234` | | `GITHUB_RUN_NUMBER` | A unique number for each run of a particular workflow. | `42` | @@ -98,7 +98,7 @@ These variables are available in workflow expressions via `${{ gitea. }}`. | `gitea.repository`
`github.repository` | The owner and repository name. | `gitea/docs` | | `gitea.repository_owner`
`github.repository_owner` | The repository owner's username. | `gitea` | | `gitea.repositoryUrl`
`github.repositoryUrl` | The HTML URL to the repository. | `https://gitea.com/gitea/docs` | -| `gitea.retention_days`
`github.retention_days` | The number of days that workflow run logs and artifacts are kept. | `90` | +| `gitea.retention_days`
`github.retention_days` | The number of days that artifacts are kept, empty when kept forever. | `90` | | `gitea.run_id`
`github.run_id` | A unique number for each workflow run within a repository. Does not change on re-run. | `1234` | | `gitea.run_number`
`github.run_number` | A unique number for each run of a particular workflow. Starts at 1 and increments with each new run. | `42` | | `gitea.run_attempt`
`github.run_attempt` | A unique number for each re-run attempt. Starts at 1 and increments with each re-run. | `1` |