randy/gogs-install.md

Installing Gogs on a Ganeti VM Running Ubuntu 18.04

For historical reasons, Gogs happens to be our github clone of choice. We run a number of instances, all but one on Ubuntu 18.04. One was debian 9, AKA stretch. The latest, at the time, update to stretch packages gave us a MariaDB/MySQL that had UTF8 character set size problems and the Gogs instance blew chunks. So we decided to move it to Ubuntu, and I thought it wise to log the install. This is that log.

The Ubuntu 18.04 server had 64B of disk, 2G of RAM, and 1 vCPU. The hostname for the build VM was gogs.sjc.arrcus.com.

As with the other installs, we based the install on Packager.io as recommended by gogs.io, specifically this page.

Basic Gogs package Installation

The server was completely up to date

sudo apt update
sudo apt upgrade

So I followed the typical ppa install instructions, getting the PGP key, getting the apt source listing, updating to it, and doing the actual install.

wget -qO- https://dl.packager.io/srv/gogs/gogs/key | sudo apt-key add -
sudo wget -O /etc/apt/sources.list.d/gogs.list https://dl.packager.io/srv/gogs/gogs/master/installer/ubuntu/18.04.repo
sudo apt update
sudo apt install gogs

Gogs did not bring in many dependencies.

MariaDB

We wanted to use the MariaDB clone of MySQL, so did the following:

sudo apt install mariadb-server

Which brought in a lot of libs and other dependencies.

Log in to MariaDB and create database

$ sudo -u root mysql
MariaDB [(none)]> create database if not exists gogs CHARACTER SET utf8 COLLATE utf8_general_ci;
MariaDB [(none)]> quit;
Bye

Install nginx

Install the nginx package. Also become root so cat <<< works.

sudo apt install nginx
sudo -Es

We want to force https, so we force a rewrite. Note this is really for Let's Encrypt, which we can do later.

cat > /etc/nginx/sites-available/default << EOF
server {
    listen          80;
    server_name     gogs.sjc.arrcus.com;
    location /.well-known/acme-challenge/ {
        alias /home/acme/challenges/;
        }
    rewrite ^/$ https://gogs.sjc.arrcus.com/ redirect;
    }
EOF
# link was created by install
# ln -s /etc/nginx/sites-available/default /etc/nginx/sites-enabled/default

Now the actual web service.

cat > /etc/nginx/sites-available/gitweb << EOF
server {
  # Git repos are browsable at http://example.com:4321/
  listen 4430;
  server_name gogs.sjc.arrcus.com;

  location /index.cgi {
    root /usr/share/gitweb/;
    include fastcgi_params;
    gzip off;
    fastcgi_param SCRIPT_NAME '$uri';
    fastcgi_param GITWEB_CONFIG /etc/gitweb.conf;
    fastcgi_pass  unix:/var/run/fcgiwrap.socket;
    }

  location / {
    root /usr/share/gitweb/;
    index index.cgi;
    }
  }
EOF
ln -s /etc/nginx/sites-available/gitweb /etc/nginx/sites-enabled/gitweb

And the ssl config

cat > /etc/nginx/sites-available/ssl << EOF
server {
    listen 443;
    server_name gogs.sjc.arrcus.com;
    ssl on;
    ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
    ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
    ssl_session_timeout 5m;
    ssl_protocols TLSv1.2;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA;
    ssl_session_cache shared:SSL:50m;
    ssl_dhparam /etc/ssl/certs/dhparam.pem;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass      http://localhost:6000;
        }
    }
EOF
ln -s /etc/nginx/sites-available/ssl /etc/nginx/sites-enabled/ssl

For safety sake, drop root and set perms

exit
sudo chmod 644 /etc/nginx/sites-available/*

For ssl, we will need a certificate. Here is how to generate a self-signed cert if you are not ready for Let's Encrypt.

sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/ssl/private/ssl-cert-snakeoil.key -outform pem -out /etc/ssl/certs/ssl-cert-snakeoil.pem

And fill out all the fields. Then generate the Diffie Helman

sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

Now you should be able to start nginx to configure it

sudo service nginx start

And browse to the service at http://gogs.sjc.arrcus.com which should send you to the /install page.

---

2019.08.15