Damien
f71abf9b23
New gitea/install.sh, modeled on openbao/install.sh's single-entrypoint three-mode pattern. Installs via `apk add gitea gitea-openrc` rather than a downloaded release binary: dl.gitea.com ships glibc/CGO-linked binaries, a bad fit for musl. check_gitea_channel() re-verifies on every install that the package is available via community (not edge) rather than trusting that to stay true. app.ini is owned exclusively by ini_set (#18) — never a heredoc overwrite — so a rejoué script adds newly-required keys without clobbering operator changes elsewhere in the file. INSTALL_LOCK is set before the service's first start so the web installer is never exposed. The Prometheus metrics token and admin account are each created once and left alone on reruns. gitea.log is forwarded to the proxy's rsyslog receiver (#20) tagged "gitea", scoped so the LXC's own local syslog traffic is never forwarded — a jail running in this LXC would only ever see the proxy's tailnet IP and end up banning the proxy itself. Root README's script table gets a line for the new script. Refs #19
infra-scripts
Public infrastructure deployment scripts designed to be executed directly via curl | bash.
Philosophy
These scripts automate the deployment of personal infrastructure components. They are:
- Self-contained: No external dependencies beyond standard Debian packages
- Idempotent-ish: Safe to re-run (where possible)
- Curl-friendly: Designed for one-liner deployment from a fresh server
- Multi-OS: Supports Debian and Alpine-based deployments, chosen per-script based on that service's requirements
- Loopback by default: Services bind to
127.0.0.1; Tailscale handles the reverse proxy and TLS termination - Log hygiene: Every long-running service ships with a
logrotateconfig (no unbounded log files) - Console auto-login: Proxmox LXCs are configured for root auto-login on
tty1(fastpct enterand Web UI shell access) - Keep it simple: One script per service, plain bash, no frameworks — readability over cleverness
Available Scripts
| Script | Description | Usage |
|---|---|---|
proxy/install.sh |
Reverse proxy with Tailscale + Nginx Proxy Manager | curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/proxy/install.sh | bash |
netlab/install.sh |
Network lab with ContainerLab | curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/netlab/install.sh | bash |
gitea-runner/install.sh |
Gitea Act Runner on Alpine LXC (Proxmox) | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/gitea-runner/install.sh)" |
gitea/install.sh |
Gitea Git service on Alpine LXC (Proxmox) | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/gitea/install.sh)" |
openbao/install.sh |
OpenBao secrets manager on Alpine LXC (Proxmox) | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/openbao/install.sh)" |
komodo/install.sh |
Komodo (Docker + MongoDB) on Alpine VM | bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/komodo/install.sh)" |
Requirements
- Fresh Debian 12/13 installation (proxy, netlab) or Proxmox VE host (gitea-runner, openbao) or Alpine VM (komodo)
- User with sudo privileges (do not run as root) — except gitea-runner, openbao, and komodo which run as root
- Internet access