+9 -3

custom/conf/app.example.ini

reviewed

··· 193 193 ;; Use `ssh-keygen` to parse public SSH keys. The value is passed to the shell. By default, Gitea does the parsing itself. 194 194 ;SSH_KEYGEN_PATH = 195 195 ;; 196 196 - ;; Enable SSH Authorized Key Backup when rewriting all keys, default is true 197 197 - ;SSH_AUTHORIZED_KEYS_BACKUP = true 196 196 + ;; Enable SSH Authorized Key Backup when rewriting all keys, default is false 197 197 + ;SSH_AUTHORIZED_KEYS_BACKUP = false 198 198 ;; 199 199 ;; Determines which principals to allow 200 200 ;; - empty: if SSH_TRUSTED_USER_CA_KEYS is empty this will default to off, otherwise will default to email, username. ··· 303 303 ;; 304 304 ;; 305 305 ;; LFS authentication secret, change this yourself 306 306 - LFS_JWT_SECRET = 306 306 + ;LFS_JWT_SECRET = 307 307 + ;; 308 308 + ;; Alternative location to specify LFS authentication secret. You cannot specify both this and LFS_JWT_SECRET, and must pick one 309 309 + ;LFS_JWT_SECRET_URI = file:/etc/gitea/lfs_jwt_secret 307 310 ;; 308 311 ;; LFS authentication validity period (in time.Duration), pushes taking longer than this may fail. 309 312 ;LFS_HTTP_AUTH_EXPIRY = 24h ··· 526 529 ;; OAuth2 authentication secret for access and refresh tokens, change this yourself to a unique string. CLI generate option is helpful in this case. https://docs.gitea.io/en-us/command-line/#generate 527 530 ;; This setting is only needed if JWT_SIGNING_ALGORITHM is set to HS256, HS384 or HS512. 528 531 ;JWT_SECRET = 532 532 + ;; 533 533 + ;; Alternative location to specify OAuth2 authentication secret. You cannot specify both this and JWT_SECRET, and must pick one 534 534 + ;JWT_SECRET_URI = file:/etc/gitea/oauth2_jwt_secret 529 535 ;; 530 536 ;; Lifetime of an OAuth2 access token in seconds 531 537 ;ACCESS_TOKEN_EXPIRATION_TIME = 3600

+3 -1

docs/content/doc/administration/config-cheat-sheet.en-us.md

reviewed

··· 336 336 - `SSH_LISTEN_PORT`: **%(SSH\_PORT)s**: Port for the built-in SSH server. 337 337 - `SSH_ROOT_PATH`: **~/.ssh**: Root path of SSH directory. 338 338 - `SSH_CREATE_AUTHORIZED_KEYS_FILE`: **true**: Gitea will create a authorized_keys file by default when it is not using the internal ssh server. If you intend to use the AuthorizedKeysCommand functionality then you should turn this off. 339 339 - - `SSH_AUTHORIZED_KEYS_BACKUP`: **true**: Enable SSH Authorized Key Backup when rewriting all keys, default is true. 339 339 + - `SSH_AUTHORIZED_KEYS_BACKUP`: **false**: Enable SSH Authorized Key Backup when rewriting all keys, default is false. 340 340 - `SSH_TRUSTED_USER_CA_KEYS`: **\<empty\>**: Specifies the public keys of certificate authorities that are trusted to sign user certificates for authentication. Multiple keys should be comma separated. E.g.`ssh-<algorithm> <key>` or `ssh-<algorithm> <key1>, ssh-<algorithm> <key2>`. For more information see `TrustedUserCAKeys` in the sshd config man pages. When empty no file will be created and `SSH_AUTHORIZED_PRINCIPALS_ALLOW` will default to `off`. 341 341 - `SSH_TRUSTED_USER_CA_KEYS_FILENAME`: **`RUN_USER`/.ssh/gitea-trusted-user-ca-keys.pem**: Absolute path of the `TrustedUserCaKeys` file Gitea will manage. If you're running your own ssh server and you want to use the Gitea managed file you'll also need to modify your sshd_config to point to this file. The official docker image will automatically work without further configuration. 342 342 - `SSH_AUTHORIZED_PRINCIPALS_ALLOW`: **off** or **username, email**: \[off, username, email, anything\]: Specify the principals values that users are allowed to use as principal. When set to `anything` no checks are done on the principal string. When set to `off` authorized principal are not allowed to be set. ··· 368 368 - `LFS_START_SERVER`: **false**: Enables Git LFS support. 369 369 - `LFS_CONTENT_PATH`: **%(APP_DATA_PATH)s/lfs**: Default LFS content path. (if it is on local storage.) **DEPRECATED** use settings in `[lfs]`. 370 370 - `LFS_JWT_SECRET`: **\<empty\>**: LFS authentication secret, change this a unique string. 371 371 + - `LFS_JWT_SECRET_URI`: **\<empty\>**: Instead of defining LFS_JWT_SECRET in the configuration, this configuration option can be used to give Gitea a path to a file that contains the secret (example value: `file:/etc/gitea/lfs_jwt_secret`) 371 372 - `LFS_HTTP_AUTH_EXPIRY`: **24h**: LFS authentication validity period in time.Duration, pushes taking longer than this may fail. 372 373 - `LFS_MAX_FILE_SIZE`: **0**: Maximum allowed LFS file size in bytes (Set to 0 for no limit). 373 374 - `LFS_LOCKS_PAGING_NUM`: **50**: Maximum number of LFS Locks returned per page. ··· 1097 1098 - `INVALIDATE_REFRESH_TOKENS`: **false**: Check if refresh token has already been used 1098 1099 - `JWT_SIGNING_ALGORITHM`: **RS256**: Algorithm used to sign OAuth2 tokens. Valid values: \[`HS256`, `HS384`, `HS512`, `RS256`, `RS384`, `RS512`, `ES256`, `ES384`, `ES512`\] 1099 1100 - `JWT_SECRET`: **\<empty\>**: OAuth2 authentication secret for access and refresh tokens, change this to a unique string. This setting is only needed if `JWT_SIGNING_ALGORITHM` is set to `HS256`, `HS384` or `HS512`. 1101 1101 + - `JWT_SECRET_URI`: **\<empty\>**: Instead of defining JWT_SECRET in the configuration, this configuration option can be used to give Gitea a path to a file that contains the secret (example value: `file:/etc/gitea/oauth2_jwt_secret`) 1100 1102 - `JWT_SIGNING_PRIVATE_KEY_FILE`: **jwt/private.pem**: Private key file path used to sign OAuth2 tokens. The path is relative to `APP_DATA_PATH`. This setting is only needed if `JWT_SIGNING_ALGORITHM` is set to `RS256`, `RS384`, `RS512`, `ES256`, `ES384` or `ES512`. The file must contain a RSA or ECDSA private key in the PKCS8 format. If no key exists a 4096 bit key will be created for you. 1101 1103 - `MAX_TOKEN_LENGTH`: **32767**: Maximum length of token/cookie to accept from OAuth2 provider 1102 1104

+2 -2

models/git/branch.go

reviewed

··· 101 101 type Branch struct { 102 102 ID int64 103 103 RepoID int64 `xorm:"UNIQUE(s)"` 104 104 - Name string `xorm:"UNIQUE(s) NOT NULL"` 104 104 + Name string `xorm:"UNIQUE(s) NOT NULL"` // git's ref-name is case-sensitive internally, however, in some databases (mssql, mysql, by default), it's case-insensitive at the moment 105 105 CommitID string 106 106 - CommitMessage string `xorm:"TEXT"` 106 106 + CommitMessage string `xorm:"TEXT"` // it only stores the message summary (the first line) 107 107 PusherID int64 108 108 Pusher *user_model.User `xorm:"-"` 109 109 IsDeleted bool `xorm:"index"`