mirror of
https://gitea.com/gitea/docs.git
synced 2026-11-08 19:10:32 +00:00
Compare commits
4
Commits
ba60edbbda
...
7d9a82df8d
| Author | SHA1 | Date | |
|---|---|---|---|
  bircniandsilverwind
|
7d9a82df8d | ||
 
|
6934d56056 | ||
 Gitea BotandLunny Xiao
|
c28356267d | ||
|
silverwind
|
c3d9115328 |
No files matched your search
@@ -403,7 +403,7 @@ The following configuration set `Content-Type: application/vnd.android.package-a
|
||||
If it is set to `(DOER_USERNAME)`, it will use current signed-in user's username.
|
||||
This option is only for some advanced users who have configured their SSH reverse-proxy and need to use different usernames for git SSH clone.
|
||||
Most users should just leave it blank and/or modify the `BUILTIN_SSH_SERVER_USER`.
|
||||
- `SSH_DOMAIN`: **`{DOMAIN}`**: Domain name of this server, used for displayed clone URL.
|
||||
- `SSH_DOMAIN`: **_empty_**: Domain name to be exposed in clone URL, defaults to the domain part of ROOT_URL
|
||||
- `SSH_PORT`: **22**: SSH port displayed in clone URL. If you need a different "SSH clone port" from the real "SSH listen port", set the SSH_LISTEN_PORT separately.
|
||||
- `SSH_LISTEN_HOST`: **0.0.0.0**: Listen address for the built-in SSH server.
|
||||
- `SSH_LISTEN_PORT`: **`{SSH_PORT}`**: Port for the built-in SSH server.
|
||||
@@ -646,14 +646,24 @@ And the following unique queues:
|
||||
- `SUCCESSFUL_TOKENS_CACHE_SIZE`: **20**: Cache successful token hashes. API tokens are stored in the DB as pbkdf2 hashes however, this means that there is a potentially significant hashing load when there are multiple API operations. This cache will store the successfully hashed tokens in a LRU cache as a balance between performance and security.
|
||||
- `DISABLE_QUERY_AUTH_TOKEN`: **false**: Reject API tokens sent in URL query string (Accept Header-based API tokens only). This setting will default to `true` in Gitea 1.23 and be deprecated in Gitea 1.24.
|
||||
- `TWO_FACTOR_AUTH`: **_empty_**: set to enforced to enforce two factor authentication. Only available in Gitea 1.24 and later.
|
||||
- `ALLOWED_HOST_LIST`: **external**: Webhook and oauth2 clients can only call allowed hosts for security reasons. Comma separated list.
|
||||
- `EGRESS_MODE`: **lax**: Egress mode toggles between strictness of outgoing requests:
|
||||
- `lax` requires addresses to be allowed only if they are in private ranges, it allows all public ones
|
||||
- `strict` requires an explicit allow of all addresses
|
||||
- `ALLOWED_HOST_LIST`: **_empty_**: Webhook and oauth2 clients can only call allowed hosts for security reasons. Comma separated list, eg: `192.168.1.0/24:3000`, `[2001:db8::/32]:9090`, `*.mydomain.com:[80|443]`
|
||||
- Built-in networks:
|
||||
- `loopback`: 127.0.0.0/8 for IPv4 and ::1/128 for IPv6, localhost is included.
|
||||
- `private`: RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 4193 (FC00::/7). Also called LAN/Intranet.
|
||||
- `external`: A valid non-private unicast IP, you can access all hosts on public internet.
|
||||
- `*`: All hosts are allowed.
|
||||
- CIDR list: `1.2.3.0/8` for IPv4 and `2001:db8::/32` for IPv6
|
||||
- Wildcard hosts: `*.mydomain.com`, `192.168.100.*`
|
||||
- `private`: RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), RFC 4193 (FC00::/7) and RFC 6598 CGNAT (100.64.0.0/10). Also called LAN/Intranet.
|
||||
- CIDR list: `1.2.3.0/8`, `2001:db8::/32`, and with a port `[2001:db8::/32]:9090` (IPv6 addresses and CIDRs need brackets when a port is given)
|
||||
- Host matching: `example.com` matches the host and any subdomain, dot-anchored so `notexample.com` never matches. `*.example.com` and `.example.com` match only subdomains, the apex itself is excluded. IDN names must be given as punycode.
|
||||
- All addresses can have ports specified. Accepted port specs:
|
||||
- a single port: `192.168.1.0/24:3000`
|
||||
- a range, both bounds inclusive: `*.mydomain.com:3000-3010`
|
||||
- a bracketed set of ports and ranges, `|` separated: `*.mydomain.com:[80|443|3000-3010]`
|
||||
- all ports: `*.mydomain.com:*`
|
||||
- A portless entry covers all ports in `lax` mode, only 80 and 443 in `strict` mode
|
||||
- Port specs apply only where the list is consulted: in `lax` mode that is private, loopback and CGNAT targets alone, public targets are allowed on every port whatever the list says. In `strict` mode every target is checked, so ports restrict public hosts too.
|
||||
- Reserved addresses like link-local and cloud metadata are denied
|
||||
- This list is enforced on direct connections only. When an HTTP proxy is configured, restricting the proxied target is the proxy server's responsibility.
|
||||
|
||||
## Audit (`audit`)
|
||||
|
||||
@@ -705,7 +715,7 @@ And the following unique queues:
|
||||
Requires `Mailer` to be enabled.
|
||||
- `REGISTER_MANUAL_CONFIRM`: **false**: Enable this to manually confirm new registrations.
|
||||
Requires `REGISTER_EMAIL_CONFIRM` to be disabled.
|
||||
- `DISABLE_REGISTRATION`: **false**: Disable registration, after which only admin can create
|
||||
- `DISABLE_REGISTRATION`: **true**: Disable registration, after which only admin can create
|
||||
accounts for users.
|
||||
- `REQUIRE_EXTERNAL_REGISTRATION_PASSWORD`: **false**: Enable this to force externally created
|
||||
accounts (via GitHub, OpenID Connect, etc) to create a password.
|
||||
@@ -764,7 +774,7 @@ And the following unique queues:
|
||||
- `DEFAULT_ALLOW_ONLY_CONTRIBUTORS_TO_TRACK_TIME`: **true**: Only allow users with write permissions to track time.
|
||||
- `EMAIL_DOMAIN_ALLOWLIST`: **_empty_**: If non-empty, comma separated list of domain names that can only be used to register on this instance, wildcard is supported.
|
||||
- `EMAIL_DOMAIN_BLOCKLIST`: **_empty_**: If non-empty, comma separated list of domain names that cannot be used to register on this instance, wildcard is supported.
|
||||
- `SHOW_REGISTRATION_BUTTON`: **! DISABLE\_REGISTRATION**: Show Registration Button
|
||||
- `SHOW_REGISTRATION_BUTTON`: **false**: Show Registration button, defaults to true only if both DISABLE_REGISTRATION and ALLOW_ONLY_EXTERNAL_REGISTRATION are false
|
||||
- `SHOW_MILESTONES_DASHBOARD_PAGE`: **true** Enable this to show the milestones dashboard page - a view of all the user's milestones
|
||||
- `AUTO_WATCH_NEW_REPOS`: **true**: Enable this to let all organisation users watch new repos when they are created
|
||||
- `AUTO_WATCH_ON_CHANGES`: **false**: Enable this to make users watch a repository after their first commit to it
|
||||
@@ -774,8 +784,7 @@ And the following unique queues:
|
||||
- `DEFAULT_ORG_MEMBER_VISIBLE`: **false** True will make the membership of the users visible when added to the organisation.
|
||||
- `ALLOW_ONLY_INTERNAL_REGISTRATION`: **false** Set to true to force registration only via Gitea.
|
||||
- `ALLOW_ONLY_EXTERNAL_REGISTRATION`: **false** Set to true to force registration only using third-party services.
|
||||
- `NO_REPLY_ADDRESS`: **noreply.DOMAIN** Value for the domain part of the user's email address in the Git log if user has set KeepEmailPrivate to true. DOMAIN resolves to the value in server.DOMAIN.
|
||||
The user's email will be replaced with a concatenation of the user name in lower case, "@" and NO_REPLY_ADDRESS.
|
||||
- `NO_REPLY_ADDRESS`: **_empty_**: Value for the domain part of the user's email address in the git log if user has set KeepEmailPrivate to true. The user's email will be replaced with a concatenation of the user name in lower case, "@" and NO_REPLY_ADDRESS. Default value is "noreply." + the domain part of ROOT_URL
|
||||
- `USER_DELETE_WITH_COMMENTS_MAX_TIME`: **0** Minimum amount of time a user must exist before comments are kept when the user is deleted.
|
||||
- `VALID_SITE_URL_SCHEMES`: **http, https**: Valid site url schemes for user profiles
|
||||
|
||||
@@ -808,9 +817,11 @@ Define allowed algorithms and their minimum key length (use -1 to disable a type
|
||||
- `DELIVER_TIMEOUT`: **5**: Delivery timeout (sec) for shooting webhooks.
|
||||
- `SKIP_TLS_VERIFY`: **false**: Allow insecure certification.
|
||||
- `PAGING_NUM`: **10**: Number of webhook history events that are shown in one page.
|
||||
- `PROXY_URL`: **_empty_**: Proxy server URL, support http://, https//, socks://, blank will follow environment http_proxy/https_proxy. If not given, will use global proxy setting.
|
||||
- `PROXY_URL`: **_empty_**: Proxy server URL, support http://, https://, socks5://, blank will follow environment http_proxy/https_proxy. If not given, will use global proxy setting.
|
||||
- `PROXY_HOSTS`: **_empty_`**: Comma separated list of host names requiring proxy. Glob patterns (*) are accepted; use ** to match all hosts. If not given, will use global proxy setting.
|
||||
|
||||
When a proxy is configured, Gitea does not enforce `[security]` `ALLOWED_HOST_LIST` on the proxied target, the proxy server is expected to restrict it.
|
||||
|
||||
## Mailer (`mailer`)
|
||||
|
||||
:::warning
|
||||
@@ -902,7 +913,7 @@ In-Reply-To =
|
||||
|
||||
## Session (`session`)
|
||||
|
||||
- `PROVIDER`: **memory**: Session engine provider \[memory, file, redis, db, mysql, couchbase, memcache, postgres\]. Setting `db` will reuse the configuration in `[database]`
|
||||
- `PROVIDER`: **file**: Session engine provider \[memory, file, redis, db, mysql, couchbase, memcache, postgres\]. Setting `db` will reuse the configuration in `[database]`
|
||||
- `PROVIDER_CONFIG`: **data/sessions**: For file, the root path; for db, empty (database config will be used); for others, the connection string. Relative paths will be made absolute against _`AppWorkPath`_. For the `redis` provider, if left empty it falls back to [redis/CONN_STR](#redis-redis) when that is set.
|
||||
- `COOKIE_SECURE`:**_empty_**: `true` or `false`. Enable this to force using HTTPS for all session access. If not set, it defaults to `true` if the ROOT_URL is an HTTPS URL.
|
||||
- `COOKIE_NAME`: **i\_like\_gitea**: The name of the cookie used for the session ID.
|
||||
@@ -1428,11 +1439,13 @@ in this mapping or the filetype using heuristics.
|
||||
|
||||
- `MAX_ATTEMPTS`: **3**: Max attempts per http/https request on migrations.
|
||||
- `RETRY_BACKOFF`: **3**: Backoff time per http/https request retry (seconds)
|
||||
- `ALLOWED_DOMAINS`: **_empty_**: Domains allowlist for migrating repositories, default is blank. It means external hosts will be allowed. Multiple domains could be separated by commas. Wildcard is supported: `github.com, *.github.com`.
|
||||
- `BLOCKED_DOMAINS`: **_empty_**: Domains blocklist for migrating repositories, default is blank. Multiple domains could be separated by commas. When `ALLOWED_DOMAINS` is not blank, this option has a higher priority to deny domains. Wildcard is supported.
|
||||
- `ALLOW_LOCALNETWORKS`: **false**: Allow private addresses defined by RFC 1918, RFC 1122, RFC 4632 and RFC 4291. If a domain is allowed by `ALLOWED_DOMAINS`, this option will be ignored.
|
||||
- `EGRESS_MODE`: **lax**: Mode toggles between strictness of scanning outgoing requests, same format as `EGRESS_MODE` in [`security`](#security-security).
|
||||
- `ALLOWED_HOST_LIST`: **_empty_**: Hosts migrations and mirrors may call, same format as `ALLOWED_HOST_LIST` in [`security`](#security-security). Private and loopback addresses need a builtin or CIDR entry. When unset, the deprecated `ALLOWED_DOMAINS` entries apply on every port with `strict` as the default mode, and the deprecated `ALLOW_LOCALNETWORKS` adds `private, loopback`.
|
||||
- `BLOCKED_HOST_LIST`: **_empty_**: Hosts migrations and mirrors may never call, portless entries cover all ports.
|
||||
- `SKIP_TLS_VERIFY`: **false**: Allow skip tls verify
|
||||
|
||||
These lists are enforced on direct connections only. When a proxy is configured (`[proxy]`, `[git.config]` `http.proxy` or the environment), restricting the proxied target is the proxy server's responsibility.
|
||||
|
||||
## Federation (`federation`)
|
||||
|
||||
- `ENABLED`: **false**: Enable/Disable federation capabilities
|
||||
@@ -1667,14 +1680,16 @@ is `data/repo-archive` and the default of `MINIO_BASE_PATH` is `repo-archive/`.
|
||||
## Proxy (`proxy`)
|
||||
|
||||
- `PROXY_ENABLED`: **false**: Enable the proxy if true, all requests to external via HTTP will be affected, if false, no proxy will be used even environment http_proxy/https_proxy
|
||||
- `PROXY_URL`: **_empty_**: Proxy server URL, support http://, https//, socks://, blank will follow environment http_proxy/https_proxy
|
||||
- `PROXY_URL`: **_empty_**: Proxy server URL, support http://, https://, socks5://, blank will follow environment http_proxy/https_proxy
|
||||
- `PROXY_HOSTS`: **_empty_**: Comma separated list of host names requiring proxy. Glob patterns (*) are accepted; use ** to match all hosts.
|
||||
|
||||
When a proxy is configured, Gitea does not enforce the egress lists (`[security]`, `[migrations]`) on the proxied target, the proxy server is expected to restrict it.
|
||||
|
||||
i.e.
|
||||
|
||||
```ini
|
||||
PROXY_ENABLED = true
|
||||
PROXY_URL = socks://127.0.0.1:1080
|
||||
PROXY_URL = socks5://127.0.0.1:1080
|
||||
PROXY_HOSTS = *.github.com
|
||||
```
|
||||
|
||||
@@ -1693,6 +1708,7 @@ PROXY_HOSTS = *.github.com
|
||||
- `ARTIFACT_RETENTION_DAYS`: **90**: Days to keep artifacts. Old artifacts will be deleted after this period. 0 means keep forever.
|
||||
Changes only apply to newly uploaded artifacts, existing ones keep the expiry stored when they were uploaded.
|
||||
Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step.
|
||||
- `ARTIFACT_PREVIEW_MAX_SIZE`: **10485760**: Maximum total artifact size in bytes that can be browsed or previewed in the web UI. Set to `0` to disable artifact previews or `-1` for no limit. Individual files are also limited by [`MAX_DISPLAY_FILE_SIZE`](#ui-ui).
|
||||
- `RUN_RETENTION_DAYS`: **400**: Days to keep completed runs. Old runs and everything under them will be deleted after this period. 0 means keep forever.
|
||||
- `ZOMBIE_TASK_TIMEOUT`: **10m**: Timeout to stop the task which have running status, but haven't been updated for a long time
|
||||
- `ENDLESS_TASK_TIMEOUT`: **3h**: Timeout to stop the tasks which have running status and continuous updates, but don't end for a long time
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
date: "2026-08-30T00:00:00+02:00"
|
||||
slug: "artifacts"
|
||||
sidebar_position: 70
|
||||
---
|
||||
|
||||
# Artifacts
|
||||
|
||||
Workflow runs can store files such as test results, coverage reports, and build output as artifacts. Artifacts are uploaded by workflows, for example with [`actions/upload-artifact`](https://github.com/actions/upload-artifact), and appear on the run page after the upload completes.
|
||||
|
||||
## Previewing artifacts
|
||||
|
||||
Select an artifact on the run page to open its file browser and preview in the same tab. The preview identifies the originating run and attempt, and provides links back to that run and to download the complete artifact. Selecting files in the browser updates the preview in the same tab.
|
||||
|
||||
Artifact previews:
|
||||
|
||||
- require sign-in and access to the Actions run to open the preview page
|
||||
- render text-based files, images (including SVG), and PDFs
|
||||
- run HTML and JavaScript content in a sandboxed frame
|
||||
|
||||
Preview content is loaded through signed URLs that expire after one hour and do not require a session cookie. Reopen the preview page to obtain a fresh URL after it expires.
|
||||
|
||||
The file browser lists up to 2,000 files per artifact. Larger artifacts show a notice when the list is truncated.
|
||||
|
||||
Unsupported or oversized files can still be downloaded with the complete artifact.
|
||||
|
||||
## Instance configuration
|
||||
|
||||
Site administrators can limit the total artifact size that can be browsed or previewed with `ARTIFACT_PREVIEW_MAX_SIZE` in the `[actions]` section of `app.ini`. The default is 10 MiB. Set it to `0` to disable previews or `-1` to allow artifacts of any size.
|
||||
|
||||
The size of an individual previewed file is also limited by [`MAX_DISPLAY_FILE_SIZE`](../../administration/config-cheat-sheet.md#ui-ui) in the `[ui]` section.
|
||||
+9
-11
@@ -681,17 +681,16 @@ Gitea 创建以下非唯一队列：
|
||||
|
||||
- `QUEUE_LENGTH`: **1000**: 钩子任务队列长度。编辑此值时要小心。
|
||||
- `DELIVER_TIMEOUT`: **5**: 发送 Webhook 的交付超时时间（秒）。
|
||||
- `ALLOWED_HOST_LIST`: **external**: 出于安全原因，Webhook 仅能调用允许的主机。以逗号分隔的列表。
|
||||
- `ALLOWED_HOST_LIST`: **_empty_**: 出于安全原因，Webhook 仅能调用允许的主机。以逗号分隔的列表。在默认的 `[security]` `EGRESS_MODE = lax` 下仅限制私有地址。
|
||||
- 内置网络：
|
||||
- `loopback`：IPv4 的 127.0.0.0/8 和 IPv6 的 ::1/128，包括 localhost。
|
||||
- `private`：RFC 1918（10.0.0.0/8，172.16.0.0/12，192.168.0.0/16）和 RFC 4193（FC00::/7）。也称为 LAN/Intranet。
|
||||
- `external`：一个有效的非私有单播 IP，您可以访问公共互联网上的所有主机。
|
||||
- `*`：允许所有主机。
|
||||
- `private`：RFC 1918（10.0.0.0/8，172.16.0.0/12，192.168.0.0/16）、RFC 4193（FC00::/7）和 RFC 6598 CGNAT（100.64.0.0/10）。也称为 LAN/Intranet。
|
||||
- CIDR 列表：IPv4 的 `1.2.3.0/8` 和 IPv6 的 `2001:db8::/32`
|
||||
- 通配符主机：`*.mydomain.com`，`192.168.100.*`
|
||||
- 通配符主机：`*.mydomain.com`
|
||||
- 链路本地和云元数据等保留地址会被拒绝。
|
||||
- `SKIP_TLS_VERIFY`: **false**: 允许不安全的证书。
|
||||
- `PAGING_NUM`: **10**: 一页中显示的 Webhook 历史事件数量。
|
||||
- `PROXY_URL`: **_empty_**: 代理服务器 URL，支持 http://、https://、socks://，留空将遵循环境的 http_proxy/https_proxy 设置。如果未提供，将使用全局代理设置。
|
||||
- `PROXY_URL`: **_empty_**: 代理服务器 URL，支持 http://、https://、socks5://，留空将遵循环境的 http_proxy/https_proxy 设置。如果未提供，将使用全局代理设置。
|
||||
- `PROXY_HOSTS`: **_empty_**: 需要代理的主机名的逗号分隔列表。支持通配符模式 (\*)；使用 \*\* 来匹配所有主机。如果未提供，将使用全局代理设置。
|
||||
|
||||
## 邮件 (`mailer`)
|
||||
@@ -1277,9 +1276,8 @@ ALLOW_DATA_URI_IMAGES = true
|
||||
|
||||
- `MAX_ATTEMPTS`：**3**: 每次 http/https 请求的最大尝试次数（用于迁移）。
|
||||
- `RETRY_BACKOFF`：**3**: 每次 http/https 请求重试的退避时间（秒）。
|
||||
- `ALLOWED_DOMAINS`：**_empty_**: 允许迁移仓库的域名允许列表，默认为空。这意味着允许外部网址。多个域名可以用逗号分隔。支持通配符：`github.com, *.github.com`。
|
||||
- `BLOCKED_DOMAINS`：**_empty_**: 阻止迁移仓库的域名阻止列表，默认为空。多个域名可以用逗号分隔。当 `ALLOWED_DOMAINS` 不为空时，此选项优先级较高，用于拒绝域名。支持通配符。
|
||||
- `ALLOW_LOCALNETWORKS`：**false**: 允许 RFC 1918、RFC 1122、RFC 4632 和 RFC 4291 中定义的私有地址。如果域名被 `ALLOWED_DOMAINS` 允许，此选项将被忽略。
|
||||
- `ALLOWED_HOST_LIST`：**_empty_**: 迁移和镜像可以访问的主机，格式与 `[security]` 的 `ALLOWED_HOST_LIST` 相同。私有和回环地址需要内置或 CIDR 条目。取代已弃用的 `ALLOWED_DOMAINS` 和 `ALLOW_LOCALNETWORKS`。
|
||||
- `BLOCKED_HOST_LIST`：**_empty_**: 迁移和镜像禁止访问的主机。取代已弃用的 `BLOCKED_DOMAINS`。
|
||||
- `SKIP_TLS_VERIFY`：**false**: 允许跳过 TLS 验证。
|
||||
|
||||
## 联邦（`federation`）
|
||||
@@ -1509,14 +1507,14 @@ MINIO_BUCKET_LOOKUP_TYPE = auto
|
||||
## 代理 (`proxy`)
|
||||
|
||||
- `PROXY_ENABLED`: **false**: 启用代理，如果为 true，所有通过 HTTP 向外部的请求都将受到影响，如果为 false，即使环境设置了 http_proxy/https_proxy 也不会使用
|
||||
- `PROXY_URL`: **_empty_**: 代理服务器地址，支持 http://, https//, socks://，为空则不启用代理而使用环境变量中的 http_proxy/https_proxy
|
||||
- `PROXY_URL`: **_empty_**: 代理服务器地址，支持 http://, https://, socks5://，为空则不启用代理而使用环境变量中的 http_proxy/https_proxy
|
||||
- `PROXY_HOSTS`: **_empty_**: 逗号分隔的多个需要代理的网址，支持 \* 号匹配符号， \*\* 表示匹配所有网站
|
||||
|
||||
i.e.
|
||||
|
||||
```ini
|
||||
PROXY_ENABLED = true
|
||||
PROXY_URL = socks://127.0.0.1:1080
|
||||
PROXY_URL = socks5://127.0.0.1:1080
|
||||
PROXY_HOSTS = *.github.com
|
||||
```
|
||||
|
||||
|
||||
+9
-11
@@ -681,17 +681,16 @@ Gitea 创建以下非唯一队列：
|
||||
|
||||
- `QUEUE_LENGTH`: **1000**: 钩子任务队列长度。编辑此值时要小心。
|
||||
- `DELIVER_TIMEOUT`: **5**: 发送 Webhook 的交付超时时间（秒）。
|
||||
- `ALLOWED_HOST_LIST`: **external**: 出于安全原因，Webhook 仅能调用允许的主机。以逗号分隔的列表。
|
||||
- `ALLOWED_HOST_LIST`: **_empty_**: 出于安全原因，Webhook 仅能调用允许的主机。以逗号分隔的列表。在默认的 `[security]` `EGRESS_MODE = lax` 下仅限制私有地址。
|
||||
- 内置网络：
|
||||
- `loopback`：IPv4 的 127.0.0.0/8 和 IPv6 的 ::1/128，包括 localhost。
|
||||
- `private`：RFC 1918（10.0.0.0/8，172.16.0.0/12，192.168.0.0/16）和 RFC 4193（FC00::/7）。也称为 LAN/Intranet。
|
||||
- `external`：一个有效的非私有单播 IP，您可以访问公共互联网上的所有主机。
|
||||
- `*`：允许所有主机。
|
||||
- `private`：RFC 1918（10.0.0.0/8，172.16.0.0/12，192.168.0.0/16）、RFC 4193（FC00::/7）和 RFC 6598 CGNAT（100.64.0.0/10）。也称为 LAN/Intranet。
|
||||
- CIDR 列表：IPv4 的 `1.2.3.0/8` 和 IPv6 的 `2001:db8::/32`
|
||||
- 通配符主机：`*.mydomain.com`，`192.168.100.*`
|
||||
- 通配符主机：`*.mydomain.com`
|
||||
- 链路本地和云元数据等保留地址会被拒绝。
|
||||
- `SKIP_TLS_VERIFY`: **false**: 允许不安全的证书。
|
||||
- `PAGING_NUM`: **10**: 一页中显示的 Webhook 历史事件数量。
|
||||
- `PROXY_URL`: **_empty_**: 代理服务器 URL，支持 http://、https://、socks://，留空将遵循环境的 http_proxy/https_proxy 设置。如果未提供，将使用全局代理设置。
|
||||
- `PROXY_URL`: **_empty_**: 代理服务器 URL，支持 http://、https://、socks5://，留空将遵循环境的 http_proxy/https_proxy 设置。如果未提供，将使用全局代理设置。
|
||||
- `PROXY_HOSTS`: **_empty_**: 需要代理的主机名的逗号分隔列表。支持通配符模式 (\*)；使用 \*\* 来匹配所有主机。如果未提供，将使用全局代理设置。
|
||||
|
||||
## 邮件 (`mailer`)
|
||||
@@ -1277,9 +1276,8 @@ ALLOW_DATA_URI_IMAGES = true
|
||||
|
||||
- `MAX_ATTEMPTS`：**3**: 每次 http/https 请求的最大尝试次数（用于迁移）。
|
||||
- `RETRY_BACKOFF`：**3**: 每次 http/https 请求重试的退避时间（秒）。
|
||||
- `ALLOWED_DOMAINS`：**_empty_**: 允许迁移仓库的域名允许列表，默认为空。这意味着允许外部网址。多个域名可以用逗号分隔。支持通配符：`github.com, *.github.com`。
|
||||
- `BLOCKED_DOMAINS`：**_empty_**: 阻止迁移仓库的域名阻止列表，默认为空。多个域名可以用逗号分隔。当 `ALLOWED_DOMAINS` 不为空时，此选项优先级较高，用于拒绝域名。支持通配符。
|
||||
- `ALLOW_LOCALNETWORKS`：**false**: 允许 RFC 1918、RFC 1122、RFC 4632 和 RFC 4291 中定义的私有地址。如果域名被 `ALLOWED_DOMAINS` 允许，此选项将被忽略。
|
||||
- `ALLOWED_HOST_LIST`：**_empty_**: 迁移和镜像可以访问的主机，格式与 `[security]` 的 `ALLOWED_HOST_LIST` 相同。私有和回环地址需要内置或 CIDR 条目。取代已弃用的 `ALLOWED_DOMAINS` 和 `ALLOW_LOCALNETWORKS`。
|
||||
- `BLOCKED_HOST_LIST`：**_empty_**: 迁移和镜像禁止访问的主机。取代已弃用的 `BLOCKED_DOMAINS`。
|
||||
- `SKIP_TLS_VERIFY`：**false**: 允许跳过 TLS 验证。
|
||||
|
||||
## 联邦（`federation`）
|
||||
@@ -1509,14 +1507,14 @@ MINIO_BUCKET_LOOKUP_TYPE = auto
|
||||
## 代理 (`proxy`)
|
||||
|
||||
- `PROXY_ENABLED`: **false**: 启用代理，如果为 true，所有通过 HTTP 向外部的请求都将受到影响，如果为 false，即使环境设置了 http_proxy/https_proxy 也不会使用
|
||||
- `PROXY_URL`: **_empty_**: 代理服务器地址，支持 http://, https//, socks://，为空则不启用代理而使用环境变量中的 http_proxy/https_proxy
|
||||
- `PROXY_URL`: **_empty_**: 代理服务器地址，支持 http://, https://, socks5://，为空则不启用代理而使用环境变量中的 http_proxy/https_proxy
|
||||
- `PROXY_HOSTS`: **_empty_**: 逗号分隔的多个需要代理的网址，支持 \* 号匹配符号， \*\* 表示匹配所有网站
|
||||
|
||||
i.e.
|
||||
|
||||
```ini
|
||||
PROXY_ENABLED = true
|
||||
PROXY_URL = socks://127.0.0.1:1080
|
||||
PROXY_URL = socks5://127.0.0.1:1080
|
||||
PROXY_HOSTS = *.github.com
|
||||
```
|
||||
|
||||
|
||||
+9
-11
@@ -686,17 +686,16 @@ Gitea 建立以下非唯一隊列：
|
||||
|
||||
- `QUEUE_LENGTH`: **1000**: 鉤子任務隊列長度。編輯此值時要小心。
|
||||
- `DELIVER_TIMEOUT`: **5**: 發送 Webhook 的交付超時時間（秒）。
|
||||
- `ALLOWED_HOST_LIST`: **external**: 出於安全原因，Webhook 僅能調用允許的主機。以逗號分隔的列表。
|
||||
- `ALLOWED_HOST_LIST`: **_empty_**: 出於安全原因，Webhook 僅能調用允許的主機。以逗號分隔的列表。在預設的 `[security]` `EGRESS_MODE = lax` 下僅限制私有位址。
|
||||
- 內置網路：
|
||||
- `loopback`：IPv4 的 127.0.0.0/8 和 IPv6 的 ::1/128，包括 localhost。
|
||||
- `private`：RFC 1918（10.0.0.0/8，172.16.0.0/12，192.168.0.0/16）和 RFC 4193（FC00::/7）。也稱為 LAN/Intranet。
|
||||
- `external`：一個有效的非私有單播 IP，您可以訪問公共互聯網上的所有主機。
|
||||
- `*`：允許所有主機。
|
||||
- `private`：RFC 1918（10.0.0.0/8，172.16.0.0/12，192.168.0.0/16）、RFC 4193（FC00::/7）和 RFC 6598 CGNAT（100.64.0.0/10）。也稱為 LAN/Intranet。
|
||||
- CIDR 列表：IPv4 的 `1.2.3.0/8` 和 IPv6 的 `2001:db8::/32`
|
||||
- 通配符主機：`*.mydomain.com`，`192.168.100.*`
|
||||
- 通配符主機：`*.mydomain.com`
|
||||
- 鏈路本地和雲端元資料等保留地址會被拒絕。
|
||||
- `SKIP_TLS_VERIFY`: **false**: 允許不安全的證書。
|
||||
- `PAGING_NUM`: **10**: 一頁中顯示的 Webhook 歷史事件數量。
|
||||
- `PROXY_URL`: **_empty_**: 代理伺服器 URL，支援 http://、https://、socks://，留空將遵循環境的 http_proxy/https_proxy 設定。如果未提供，將使用全域代理設定。
|
||||
- `PROXY_URL`: **_empty_**: 代理伺服器 URL，支援 http://、https://、socks5://，留空將遵循環境的 http_proxy/https_proxy 設定。如果未提供，將使用全域代理設定。
|
||||
- `PROXY_HOSTS`: **_empty_**: 需要代理的主機名的逗號分隔列表。支援通配符模式 (\*)；使用 \*\* 來匹配所有主機。如果未提供，將使用全域代理設定。
|
||||
|
||||
## 郵件 (`mailer`)
|
||||
@@ -1283,9 +1282,8 @@ ALLOW_DATA_URI_IMAGES = true
|
||||
|
||||
- `MAX_ATTEMPTS`：**3**: 每次 http/https 請求的最大嘗試次數（用於遷移）。
|
||||
- `RETRY_BACKOFF`：**3**: 每次 http/https 請求重試的退避時間（秒）。
|
||||
- `ALLOWED_DOMAINS`：**_empty_**: 允許遷移儲存庫的域名允許列表，預設為空。這意味著允許外部網址。多個域名可以用逗號分隔。支援通配符：`github.com, *.github.com`。
|
||||
- `BLOCKED_DOMAINS`：**_empty_**: 阻止遷移儲存庫的域名阻止列表，預設為空。多個域名可以用逗號分隔。當 `ALLOWED_DOMAINS` 不為空時，此選項優先級較高，用於拒絕域名。支援通配符。
|
||||
- `ALLOW_LOCALNETWORKS`：**false**: 允許 RFC 1918、RFC 1122、RFC 4632 和 RFC 4291 中定義的私有地址。如果域名被 `ALLOWED_DOMAINS` 允許，此選項將被忽略。
|
||||
- `ALLOWED_HOST_LIST`：**_empty_**: 遷移和鏡像可以訪問的主機，格式與 `[security]` 的 `ALLOWED_HOST_LIST` 相同。私有和回環地址需要內建或 CIDR 條目。取代已棄用的 `ALLOWED_DOMAINS` 和 `ALLOW_LOCALNETWORKS`。
|
||||
- `BLOCKED_HOST_LIST`：**_empty_**: 遷移和鏡像禁止訪問的主機。取代已棄用的 `BLOCKED_DOMAINS`。
|
||||
- `SKIP_TLS_VERIFY`：**false**: 允許跳過 TLS 驗證。
|
||||
|
||||
## 聯邦（`federation`）
|
||||
@@ -1516,14 +1514,14 @@ MINIO_BUCKET_LOOKUP_TYPE = auto
|
||||
## 代理 (`proxy`)
|
||||
|
||||
- `PROXY_ENABLED`: **false**: 啟用代理，如果為 true，所有通過 HTTP 向外部的請求都將受到影響，如果為 false，即使環境設定了 http_proxy/https_proxy 也不會使用
|
||||
- `PROXY_URL`: **_empty_**: 代理伺服器地址，支援 http://, https//, socks://，為空則不啟用代理而使用環境變量中的 http_proxy/https_proxy
|
||||
- `PROXY_URL`: **_empty_**: 代理伺服器地址，支援 http://, https://, socks5://，為空則不啟用代理而使用環境變量中的 http_proxy/https_proxy
|
||||
- `PROXY_HOSTS`: **_empty_**: 逗號分隔的多個需要代理的網址，支援 \* 號匹配符號， \*\* 表示匹配所有網站
|
||||
|
||||
i.e.
|
||||
|
||||
```ini
|
||||
PROXY_ENABLED = true
|
||||
PROXY_URL = socks://127.0.0.1:1080
|
||||
PROXY_URL = socks5://127.0.0.1:1080
|
||||
PROXY_HOSTS = *.github.com
|
||||
```
|
||||
|
||||
|
||||
+9
-11
@@ -686,17 +686,16 @@ Gitea 建立以下非唯一隊列：
|
||||
|
||||
- `QUEUE_LENGTH`: **1000**: 鉤子任務隊列長度。編輯此值時要小心。
|
||||
- `DELIVER_TIMEOUT`: **5**: 發送 Webhook 的交付超時時間（秒）。
|
||||
- `ALLOWED_HOST_LIST`: **external**: 出於安全原因，Webhook 僅能調用允許的主機。以逗號分隔的列表。
|
||||
- `ALLOWED_HOST_LIST`: **_empty_**: 出於安全原因，Webhook 僅能調用允許的主機。以逗號分隔的列表。在預設的 `[security]` `EGRESS_MODE = lax` 下僅限制私有位址。
|
||||
- 內置網路：
|
||||
- `loopback`：IPv4 的 127.0.0.0/8 和 IPv6 的 ::1/128，包括 localhost。
|
||||
- `private`：RFC 1918（10.0.0.0/8，172.16.0.0/12，192.168.0.0/16）和 RFC 4193（FC00::/7）。也稱為 LAN/Intranet。
|
||||
- `external`：一個有效的非私有單播 IP，您可以訪問公共互聯網上的所有主機。
|
||||
- `*`：允許所有主機。
|
||||
- `private`：RFC 1918（10.0.0.0/8，172.16.0.0/12，192.168.0.0/16）、RFC 4193（FC00::/7）和 RFC 6598 CGNAT（100.64.0.0/10）。也稱為 LAN/Intranet。
|
||||
- CIDR 列表：IPv4 的 `1.2.3.0/8` 和 IPv6 的 `2001:db8::/32`
|
||||
- 通配符主機：`*.mydomain.com`，`192.168.100.*`
|
||||
- 通配符主機：`*.mydomain.com`
|
||||
- 鏈路本地和雲端元資料等保留地址會被拒絕。
|
||||
- `SKIP_TLS_VERIFY`: **false**: 允許不安全的證書。
|
||||
- `PAGING_NUM`: **10**: 一頁中顯示的 Webhook 歷史事件數量。
|
||||
- `PROXY_URL`: **_empty_**: 代理伺服器 URL，支援 http://、https://、socks://，留空將遵循環境的 http_proxy/https_proxy 設定。如果未提供，將使用全域代理設定。
|
||||
- `PROXY_URL`: **_empty_**: 代理伺服器 URL，支援 http://、https://、socks5://，留空將遵循環境的 http_proxy/https_proxy 設定。如果未提供，將使用全域代理設定。
|
||||
- `PROXY_HOSTS`: **_empty_**: 需要代理的主機名的逗號分隔列表。支援通配符模式 (\*)；使用 \*\* 來匹配所有主機。如果未提供，將使用全域代理設定。
|
||||
|
||||
## 郵件 (`mailer`)
|
||||
@@ -1283,9 +1282,8 @@ ALLOW_DATA_URI_IMAGES = true
|
||||
|
||||
- `MAX_ATTEMPTS`：**3**: 每次 http/https 請求的最大嘗試次數（用於遷移）。
|
||||
- `RETRY_BACKOFF`：**3**: 每次 http/https 請求重試的退避時間（秒）。
|
||||
- `ALLOWED_DOMAINS`：**_empty_**: 允許遷移儲存庫的域名允許列表，預設為空。這意味著允許外部網址。多個域名可以用逗號分隔。支援通配符：`github.com, *.github.com`。
|
||||
- `BLOCKED_DOMAINS`：**_empty_**: 阻止遷移儲存庫的域名阻止列表，預設為空。多個域名可以用逗號分隔。當 `ALLOWED_DOMAINS` 不為空時，此選項優先級較高，用於拒絕域名。支援通配符。
|
||||
- `ALLOW_LOCALNETWORKS`：**false**: 允許 RFC 1918、RFC 1122、RFC 4632 和 RFC 4291 中定義的私有地址。如果域名被 `ALLOWED_DOMAINS` 允許，此選項將被忽略。
|
||||
- `ALLOWED_HOST_LIST`：**_empty_**: 遷移和鏡像可以訪問的主機，格式與 `[security]` 的 `ALLOWED_HOST_LIST` 相同。私有和回環地址需要內建或 CIDR 條目。取代已棄用的 `ALLOWED_DOMAINS` 和 `ALLOW_LOCALNETWORKS`。
|
||||
- `BLOCKED_HOST_LIST`：**_empty_**: 遷移和鏡像禁止訪問的主機。取代已棄用的 `BLOCKED_DOMAINS`。
|
||||
- `SKIP_TLS_VERIFY`：**false**: 允許跳過 TLS 驗證。
|
||||
|
||||
## 聯邦（`federation`）
|
||||
@@ -1516,14 +1514,14 @@ MINIO_BUCKET_LOOKUP_TYPE = auto
|
||||
## 代理 (`proxy`)
|
||||
|
||||
- `PROXY_ENABLED`: **false**: 啟用代理，如果為 true，所有通過 HTTP 向外部的請求都將受到影響，如果為 false，即使環境設定了 http_proxy/https_proxy 也不會使用
|
||||
- `PROXY_URL`: **_empty_**: 代理伺服器地址，支援 http://, https//, socks://，為空則不啟用代理而使用環境變量中的 http_proxy/https_proxy
|
||||
- `PROXY_URL`: **_empty_**: 代理伺服器地址，支援 http://, https://, socks5://，為空則不啟用代理而使用環境變量中的 http_proxy/https_proxy
|
||||
- `PROXY_HOSTS`: **_empty_**: 逗號分隔的多個需要代理的網址，支援 \* 號匹配符號， \*\* 表示匹配所有網站
|
||||
|
||||
i.e.
|
||||
|
||||
```ini
|
||||
PROXY_ENABLED = true
|
||||
PROXY_URL = socks://127.0.0.1:1080
|
||||
PROXY_URL = socks5://127.0.0.1:1080
|
||||
PROXY_HOSTS = *.github.com
|
||||
```
|
||||
|
||||
|
||||
@@ -163,19 +163,12 @@ cache:
|
||||
#dir: ""
|
||||
# Outbound IP or hostname that job containers use to reach this runner's cache server.
|
||||
# Leave empty to detect automatically. 0.0.0.0 is not valid here.
|
||||
# If the runner itself runs in Docker, automatic detection can choose an
|
||||
# address on the runner container's network that job containers cannot reach
|
||||
# when the runner creates a separate per-job network. In that case, set this
|
||||
# to a hostname/IP reachable from job containers, and set port to a fixed
|
||||
# published port or put the job containers on a shared Docker network.
|
||||
# Ignored when external_server is set.
|
||||
# A runner container on the jobs' Docker daemon attaches to each job network automatically.
|
||||
#host: ""
|
||||
# Port for the built-in cache server. 0 picks a random free port.
|
||||
# Ignored when external_server is set.
|
||||
#port: 0
|
||||
# URL of a shared `gitea-runner cache-server` to use instead of starting a local one.
|
||||
# URL of a shared `gitea-runner cache-server` to forward cache calls to.
|
||||
# Set on every runner that should share a cache pool. A trailing slash is optional.
|
||||
# Jobs reach the server at this URL too, so set it to the reverse proxy when one fronts the server.
|
||||
# Example: "http://cache-host:8088/"
|
||||
# Requires external_secret (below) to match the value on the cache-server.
|
||||
#external_server: ""
|
||||
@@ -188,6 +181,19 @@ cache:
|
||||
# Surrounding whitespace is trimmed, so a trailing newline in the file is fine.
|
||||
# Setting both external_secret and external_secret_file is an error.
|
||||
#external_secret_file: ""
|
||||
# Store the cache in an S3-compatible bucket such as AWS S3, MinIO or RustFS. Runners with
|
||||
# the same settings use the same cache. Cannot be combined with external_server. Add lifecycle
|
||||
# rules to the bucket that expire old caches and abort incomplete multipart uploads.
|
||||
# region defaults to us-east-1, and path_style to false for AWS and true otherwise.
|
||||
# access_key and secret_key can also be set directly instead of read from files.
|
||||
#s3:
|
||||
# endpoint: "http://minio:9000"
|
||||
# region: "us-east-1"
|
||||
# bucket: "runner-cache"
|
||||
# prefix: "gitea-runner-cache"
|
||||
# path_style: true
|
||||
# access_key_file: "/run/secrets/cache-s3-access-key"
|
||||
# secret_key_file: "/run/secrets/cache-s3-secret-key"
|
||||
# When true, reuse a cached action instead of fetching from the remote on every job.
|
||||
# A moved tag (e.g. a re-tagged "v6") or an updated branch stays at the cached commit
|
||||
# until its cache entry expires or is manually removed.
|
||||
@@ -196,10 +202,10 @@ cache:
|
||||
# they do not take for GitHub, so reaching it means editing that check out of their own bundle,
|
||||
# put back after the copy into the job. That edit is made either way, this only governs the API
|
||||
# advertised. A bundle that does not match is left alone. With v2, artifact uploads go via the
|
||||
# cache server unless container jobs cannot reach its Docker network.
|
||||
# cache server.
|
||||
#v2: true
|
||||
# How the cache server discards entries, ignored when external_server is set since that
|
||||
# server applies its own. Leave a setting out for its default; 0s or 0 turns the three
|
||||
# How the cache server discards entries, ignored when external_server or s3 is set since
|
||||
# those apply their own. Leave a setting out for its default; 0s or 0 turns the three
|
||||
# limits off. Sizes accept 10GB, 512mb, 1TiB or a plain byte count, binary either way.
|
||||
# Whatever these allow, the cache still sheds entries to keep free space on its volume
|
||||
# above health_check.min_free_disk_space_mb when health checks are enabled.
|
||||
@@ -216,9 +222,8 @@ cache:
|
||||
container:
|
||||
# Specifies the network to which the container will connect.
|
||||
# Could be host, bridge or the name of a custom network.
|
||||
# A runner container outside bridge cannot join it, so jobs on bridge cannot reach its cache.
|
||||
# If it's empty, runner will create a network automatically.
|
||||
# For dockerized runners using the built-in cache server, a custom shared
|
||||
# network can be required so job containers can reach cache.host/cache.port.
|
||||
# Deprecated: `network_mode` is still accepted for old configs; use `network` instead.
|
||||
#network: ""
|
||||
# network_create_options only apply when `network` is left empty and the runner
|
||||
@@ -247,7 +252,8 @@ container:
|
||||
# If it's empty, /workspace will be used.
|
||||
# Purely numeric subdirectories under this path are reserved for task workspaces and may be removed by idle cleanup.
|
||||
#workdir_parent:
|
||||
# Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
|
||||
# Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/bmatcuk/doublestar#patterns
|
||||
# `*` matches within a single path segment, `**` also matches across path separators.
|
||||
# You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
|
||||
# For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
|
||||
# valid_volumes:
|
||||
|
||||
@@ -403,7 +403,7 @@ The following configuration set `Content-Type: application/vnd.android.package-a
|
||||
If it is set to `(DOER_USERNAME)`, it will use current signed-in user's username.
|
||||
This option is only for some advanced users who have configured their SSH reverse-proxy and need to use different usernames for git SSH clone.
|
||||
Most users should just leave it blank and/or modify the `BUILTIN_SSH_SERVER_USER`.
|
||||
- `SSH_DOMAIN`: **`{DOMAIN}`**: Domain name of this server, used for displayed clone URL.
|
||||
- `SSH_DOMAIN`: **_empty_**: Domain name to be exposed in clone URL, defaults to the domain part of ROOT_URL
|
||||
- `SSH_PORT`: **22**: SSH port displayed in clone URL. If you need a different "SSH clone port" from the real "SSH listen port", set the SSH_LISTEN_PORT separately.
|
||||
- `SSH_LISTEN_HOST`: **0.0.0.0**: Listen address for the built-in SSH server.
|
||||
- `SSH_LISTEN_PORT`: **`{SSH_PORT}`**: Port for the built-in SSH server.
|
||||
@@ -646,14 +646,24 @@ And the following unique queues:
|
||||
- `SUCCESSFUL_TOKENS_CACHE_SIZE`: **20**: Cache successful token hashes. API tokens are stored in the DB as pbkdf2 hashes however, this means that there is a potentially significant hashing load when there are multiple API operations. This cache will store the successfully hashed tokens in a LRU cache as a balance between performance and security.
|
||||
- `DISABLE_QUERY_AUTH_TOKEN`: **false**: Reject API tokens sent in URL query string (Accept Header-based API tokens only). This setting will default to `true` in Gitea 1.23 and be deprecated in Gitea 1.24.
|
||||
- `TWO_FACTOR_AUTH`: **_empty_**: set to enforced to enforce two factor authentication. Only available in Gitea 1.24 and later.
|
||||
- `ALLOWED_HOST_LIST`: **external**: Webhook and oauth2 clients can only call allowed hosts for security reasons. Comma separated list.
|
||||
- `EGRESS_MODE`: **lax**: Egress mode toggles between strictness of outgoing requests:
|
||||
- `lax` requires addresses to be allowed only if they are in private ranges, it allows all public ones
|
||||
- `strict` requires an explicit allow of all addresses
|
||||
- `ALLOWED_HOST_LIST`: **_empty_**: Webhook and oauth2 clients can only call allowed hosts for security reasons. Comma separated list, eg: `192.168.1.0/24:3000`, `[2001:db8::/32]:9090`, `*.mydomain.com:[80|443]`
|
||||
- Built-in networks:
|
||||
- `loopback`: 127.0.0.0/8 for IPv4 and ::1/128 for IPv6, localhost is included.
|
||||
- `private`: RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and RFC 4193 (FC00::/7). Also called LAN/Intranet.
|
||||
- `external`: A valid non-private unicast IP, you can access all hosts on public internet.
|
||||
- `*`: All hosts are allowed.
|
||||
- CIDR list: `1.2.3.0/8` for IPv4 and `2001:db8::/32` for IPv6
|
||||
- Wildcard hosts: `*.mydomain.com`, `192.168.100.*`
|
||||
- `private`: RFC 1918 (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), RFC 4193 (FC00::/7) and RFC 6598 CGNAT (100.64.0.0/10). Also called LAN/Intranet.
|
||||
- CIDR list: `1.2.3.0/8`, `2001:db8::/32`, and with a port `[2001:db8::/32]:9090` (IPv6 addresses and CIDRs need brackets when a port is given)
|
||||
- Host matching: `example.com` matches the host and any subdomain, dot-anchored so `notexample.com` never matches. `*.example.com` and `.example.com` match only subdomains, the apex itself is excluded. IDN names must be given as punycode.
|
||||
- All addresses can have ports specified. Accepted port specs:
|
||||
- a single port: `192.168.1.0/24:3000`
|
||||
- a range, both bounds inclusive: `*.mydomain.com:3000-3010`
|
||||
- a bracketed set of ports and ranges, `|` separated: `*.mydomain.com:[80|443|3000-3010]`
|
||||
- all ports: `*.mydomain.com:*`
|
||||
- A portless entry covers all ports in `lax` mode, only 80 and 443 in `strict` mode
|
||||
- Port specs apply only where the list is consulted: in `lax` mode that is private, loopback and CGNAT targets alone, public targets are allowed on every port whatever the list says. In `strict` mode every target is checked, so ports restrict public hosts too.
|
||||
- Reserved addresses like link-local and cloud metadata are denied
|
||||
- This list is enforced on direct connections only. When an HTTP proxy is configured, restricting the proxied target is the proxy server's responsibility.
|
||||
|
||||
## Audit (`audit`)
|
||||
|
||||
@@ -705,7 +715,7 @@ And the following unique queues:
|
||||
Requires `Mailer` to be enabled.
|
||||
- `REGISTER_MANUAL_CONFIRM`: **false**: Enable this to manually confirm new registrations.
|
||||
Requires `REGISTER_EMAIL_CONFIRM` to be disabled.
|
||||
- `DISABLE_REGISTRATION`: **false**: Disable registration, after which only admin can create
|
||||
- `DISABLE_REGISTRATION`: **true**: Disable registration, after which only admin can create
|
||||
accounts for users.
|
||||
- `REQUIRE_EXTERNAL_REGISTRATION_PASSWORD`: **false**: Enable this to force externally created
|
||||
accounts (via GitHub, OpenID Connect, etc) to create a password.
|
||||
@@ -764,7 +774,7 @@ And the following unique queues:
|
||||
- `DEFAULT_ALLOW_ONLY_CONTRIBUTORS_TO_TRACK_TIME`: **true**: Only allow users with write permissions to track time.
|
||||
- `EMAIL_DOMAIN_ALLOWLIST`: **_empty_**: If non-empty, comma separated list of domain names that can only be used to register on this instance, wildcard is supported.
|
||||
- `EMAIL_DOMAIN_BLOCKLIST`: **_empty_**: If non-empty, comma separated list of domain names that cannot be used to register on this instance, wildcard is supported.
|
||||
- `SHOW_REGISTRATION_BUTTON`: **! DISABLE\_REGISTRATION**: Show Registration Button
|
||||
- `SHOW_REGISTRATION_BUTTON`: **false**: Show Registration button, defaults to true only if both DISABLE_REGISTRATION and ALLOW_ONLY_EXTERNAL_REGISTRATION are false
|
||||
- `SHOW_MILESTONES_DASHBOARD_PAGE`: **true** Enable this to show the milestones dashboard page - a view of all the user's milestones
|
||||
- `AUTO_WATCH_NEW_REPOS`: **true**: Enable this to let all organisation users watch new repos when they are created
|
||||
- `AUTO_WATCH_ON_CHANGES`: **false**: Enable this to make users watch a repository after their first commit to it
|
||||
@@ -774,8 +784,7 @@ And the following unique queues:
|
||||
- `DEFAULT_ORG_MEMBER_VISIBLE`: **false** True will make the membership of the users visible when added to the organisation.
|
||||
- `ALLOW_ONLY_INTERNAL_REGISTRATION`: **false** Set to true to force registration only via Gitea.
|
||||
- `ALLOW_ONLY_EXTERNAL_REGISTRATION`: **false** Set to true to force registration only using third-party services.
|
||||
- `NO_REPLY_ADDRESS`: **noreply.DOMAIN** Value for the domain part of the user's email address in the Git log if user has set KeepEmailPrivate to true. DOMAIN resolves to the value in server.DOMAIN.
|
||||
The user's email will be replaced with a concatenation of the user name in lower case, "@" and NO_REPLY_ADDRESS.
|
||||
- `NO_REPLY_ADDRESS`: **_empty_**: Value for the domain part of the user's email address in the git log if user has set KeepEmailPrivate to true. The user's email will be replaced with a concatenation of the user name in lower case, "@" and NO_REPLY_ADDRESS. Default value is "noreply." + the domain part of ROOT_URL
|
||||
- `USER_DELETE_WITH_COMMENTS_MAX_TIME`: **0** Minimum amount of time a user must exist before comments are kept when the user is deleted.
|
||||
- `VALID_SITE_URL_SCHEMES`: **http, https**: Valid site url schemes for user profiles
|
||||
|
||||
@@ -808,9 +817,11 @@ Define allowed algorithms and their minimum key length (use -1 to disable a type
|
||||
- `DELIVER_TIMEOUT`: **5**: Delivery timeout (sec) for shooting webhooks.
|
||||
- `SKIP_TLS_VERIFY`: **false**: Allow insecure certification.
|
||||
- `PAGING_NUM`: **10**: Number of webhook history events that are shown in one page.
|
||||
- `PROXY_URL`: **_empty_**: Proxy server URL, support http://, https//, socks://, blank will follow environment http_proxy/https_proxy. If not given, will use global proxy setting.
|
||||
- `PROXY_URL`: **_empty_**: Proxy server URL, support http://, https://, socks5://, blank will follow environment http_proxy/https_proxy. If not given, will use global proxy setting.
|
||||
- `PROXY_HOSTS`: **_empty_`**: Comma separated list of host names requiring proxy. Glob patterns (*) are accepted; use ** to match all hosts. If not given, will use global proxy setting.
|
||||
|
||||
When a proxy is configured, Gitea does not enforce `[security]` `ALLOWED_HOST_LIST` on the proxied target, the proxy server is expected to restrict it.
|
||||
|
||||
## Mailer (`mailer`)
|
||||
|
||||
:::warning
|
||||
@@ -902,7 +913,7 @@ In-Reply-To =
|
||||
|
||||
## Session (`session`)
|
||||
|
||||
- `PROVIDER`: **memory**: Session engine provider \[memory, file, redis, db, mysql, couchbase, memcache, postgres\]. Setting `db` will reuse the configuration in `[database]`
|
||||
- `PROVIDER`: **file**: Session engine provider \[memory, file, redis, db, mysql, couchbase, memcache, postgres\]. Setting `db` will reuse the configuration in `[database]`
|
||||
- `PROVIDER_CONFIG`: **data/sessions**: For file, the root path; for db, empty (database config will be used); for others, the connection string. Relative paths will be made absolute against _`AppWorkPath`_. For the `redis` provider, if left empty it falls back to [redis/CONN_STR](#redis-redis) when that is set.
|
||||
- `COOKIE_SECURE`:**_empty_**: `true` or `false`. Enable this to force using HTTPS for all session access. If not set, it defaults to `true` if the ROOT_URL is an HTTPS URL.
|
||||
- `COOKIE_NAME`: **i\_like\_gitea**: The name of the cookie used for the session ID.
|
||||
@@ -1428,11 +1439,13 @@ in this mapping or the filetype using heuristics.
|
||||
|
||||
- `MAX_ATTEMPTS`: **3**: Max attempts per http/https request on migrations.
|
||||
- `RETRY_BACKOFF`: **3**: Backoff time per http/https request retry (seconds)
|
||||
- `ALLOWED_DOMAINS`: **_empty_**: Domains allowlist for migrating repositories, default is blank. It means external hosts will be allowed. Multiple domains could be separated by commas. Wildcard is supported: `github.com, *.github.com`.
|
||||
- `BLOCKED_DOMAINS`: **_empty_**: Domains blocklist for migrating repositories, default is blank. Multiple domains could be separated by commas. When `ALLOWED_DOMAINS` is not blank, this option has a higher priority to deny domains. Wildcard is supported.
|
||||
- `ALLOW_LOCALNETWORKS`: **false**: Allow private addresses defined by RFC 1918, RFC 1122, RFC 4632 and RFC 4291. If a domain is allowed by `ALLOWED_DOMAINS`, this option will be ignored.
|
||||
- `EGRESS_MODE`: **lax**: Mode toggles between strictness of scanning outgoing requests, same format as `EGRESS_MODE` in [`security`](#security-security).
|
||||
- `ALLOWED_HOST_LIST`: **_empty_**: Hosts migrations and mirrors may call, same format as `ALLOWED_HOST_LIST` in [`security`](#security-security). Private and loopback addresses need a builtin or CIDR entry. When unset, the deprecated `ALLOWED_DOMAINS` entries apply on every port with `strict` as the default mode, and the deprecated `ALLOW_LOCALNETWORKS` adds `private, loopback`.
|
||||
- `BLOCKED_HOST_LIST`: **_empty_**: Hosts migrations and mirrors may never call, portless entries cover all ports.
|
||||
- `SKIP_TLS_VERIFY`: **false**: Allow skip tls verify
|
||||
|
||||
These lists are enforced on direct connections only. When a proxy is configured (`[proxy]`, `[git.config]` `http.proxy` or the environment), restricting the proxied target is the proxy server's responsibility.
|
||||
|
||||
## Federation (`federation`)
|
||||
|
||||
- `ENABLED`: **false**: Enable/Disable federation capabilities
|
||||
@@ -1667,14 +1680,16 @@ is `data/repo-archive` and the default of `MINIO_BASE_PATH` is `repo-archive/`.
|
||||
## Proxy (`proxy`)
|
||||
|
||||
- `PROXY_ENABLED`: **false**: Enable the proxy if true, all requests to external via HTTP will be affected, if false, no proxy will be used even environment http_proxy/https_proxy
|
||||
- `PROXY_URL`: **_empty_**: Proxy server URL, support http://, https//, socks://, blank will follow environment http_proxy/https_proxy
|
||||
- `PROXY_URL`: **_empty_**: Proxy server URL, support http://, https://, socks5://, blank will follow environment http_proxy/https_proxy
|
||||
- `PROXY_HOSTS`: **_empty_**: Comma separated list of host names requiring proxy. Glob patterns (*) are accepted; use ** to match all hosts.
|
||||
|
||||
When a proxy is configured, Gitea does not enforce the egress lists (`[security]`, `[migrations]`) on the proxied target, the proxy server is expected to restrict it.
|
||||
|
||||
i.e.
|
||||
|
||||
```ini
|
||||
PROXY_ENABLED = true
|
||||
PROXY_URL = socks://127.0.0.1:1080
|
||||
PROXY_URL = socks5://127.0.0.1:1080
|
||||
PROXY_HOSTS = *.github.com
|
||||
```
|
||||
|
||||
@@ -1693,6 +1708,7 @@ PROXY_HOSTS = *.github.com
|
||||
- `ARTIFACT_RETENTION_DAYS`: **90**: Days to keep artifacts. Old artifacts will be deleted after this period. 0 means keep forever.
|
||||
Changes only apply to newly uploaded artifacts, existing ones keep the expiry stored when they were uploaded.
|
||||
Artifacts could have their own retention periods by setting the `retention-days` option in `actions/upload-artifact` step.
|
||||
- `ARTIFACT_PREVIEW_MAX_SIZE`: **10485760**: Maximum total artifact size in bytes that can be browsed or previewed in the web UI. Set to `0` to disable artifact previews or `-1` for no limit. Individual files are also limited by [`MAX_DISPLAY_FILE_SIZE`](#ui-ui).
|
||||
- `RUN_RETENTION_DAYS`: **400**: Days to keep completed runs. Old runs and everything under them will be deleted after this period. 0 means keep forever.
|
||||
- `ZOMBIE_TASK_TIMEOUT`: **10m**: Timeout to stop the task which have running status, but haven't been updated for a long time
|
||||
- `ENDLESS_TASK_TIMEOUT`: **3h**: Timeout to stop the tasks which have running status and continuous updates, but don't end for a long time
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
---
|
||||
date: "2026-08-30T00:00:00+02:00"
|
||||
slug: "artifacts"
|
||||
sidebar_position: 70
|
||||
---
|
||||
|
||||
# Artifacts
|
||||
|
||||
Workflow runs can store files such as test results, coverage reports, and build output as artifacts. Artifacts are uploaded by workflows, for example with [`actions/upload-artifact`](https://github.com/actions/upload-artifact), and appear on the run page after the upload completes.
|
||||
|
||||
## Previewing artifacts
|
||||
|
||||
Select an artifact on the run page to open its file browser and preview in the same tab. The preview identifies the originating run and attempt, and provides links back to that run and to download the complete artifact. Selecting files in the browser updates the preview in the same tab.
|
||||
|
||||
Artifact previews:
|
||||
|
||||
- require sign-in and access to the Actions run to open the preview page
|
||||
- render text-based files, images (including SVG), and PDFs
|
||||
- run HTML and JavaScript content in a sandboxed frame
|
||||
|
||||
Preview content is loaded through signed URLs that expire after one hour and do not require a session cookie. Reopen the preview page to obtain a fresh URL after it expires.
|
||||
|
||||
The file browser lists up to 2,000 files per artifact. Larger artifacts show a notice when the list is truncated.
|
||||
|
||||
Unsupported or oversized files can still be downloaded with the complete artifact.
|
||||
|
||||
## Instance configuration
|
||||
|
||||
Site administrators can limit the total artifact size that can be browsed or previewed with `ARTIFACT_PREVIEW_MAX_SIZE` in the `[actions]` section of `app.ini`. The default is 10 MiB. Set it to `0` to disable previews or `-1` to allow artifacts of any size.
|
||||
|
||||
The size of an individual previewed file is also limited by [`MAX_DISPLAY_FILE_SIZE`](../../administration/config-cheat-sheet.md#ui-ui) in the `[ui]` section.
|
||||
Reference in new issue
Block a user