Refactor Gitea and SSH configurations, update backup scripts, and enhance Nginx settings

- Updated SSH configuration for Gitea to disable banner and TTY, and modified the AuthorizedKeysCommand.
- Simplified gitea-shell script to directly call the k8s_gitea_shell command with required parameters.
- Removed unused gitea-auth script from playbook_gitea.yml.
- Updated systools_version in playbook_systools.yml to 0.4.5.
- Enhanced ssh_locker_helper to copy redirect URL to clipboard based on OS.
- Added a new script test_imaps for IMAP testing.
- Updated Terraform configurations for various applications, including:
  - Added a backup script for MariaDB with retention policy.
  - Changed Gitea version to 1.24-rootless and adjusted SSH settings.
  - Updated Nginx configurations to log errors and access to stderr/stdout.
  - Refactored services to use ClusterIP type and adjusted security contexts for deployments.
  - Added temporary storage for applications using empty_dir.
  - Enhanced backup.sh scripts for better error handling and logging.

terraform/modules/apps/gitea/main.tf

@@ -118,26 +118,29 @@ resource "kubernetes_deployment" "gitea" {
 
           security_context {
             allow_privilege_escalation = false
+            run_as_group               = 1000
+            run_as_user                = 1000
+            read_only_root_filesystem  = true
           }
 
           port {
             container_port = 3000
             name           = "http"
           }
-          port {
-            container_port = 22
-            name           = "ssh"
-          }
 
           volume_mount {
             mount_path = "/data"
             name       = "persistent-storage"
           }
           volume_mount {
-            mount_path = "/data/gitea/conf/app.ini"
+            mount_path = "/etc/gitea/app.ini"
             name       = "gitea-config"
             sub_path   = "app.ini"
           }
+          volume_mount {
+            name       = "tmp"
+            mount_path = "/tmp"
+          }
           dynamic "volume_mount" {
             for_each = var.tls_enabled ? [1] : []
             content {
@@ -163,6 +166,12 @@ resource "kubernetes_deployment" "gitea" {
             }
           }
         }
+        volume {
+          name = "tmp"
+          empty_dir {
+            medium = "Memory"
+          }
+        }
         dynamic "volume" {
           for_each = var.tls_enabled ? [1] : []
           content {

terraform/modules/apps/gitea/resources/app.ini.tpl

@@ -25,12 +25,16 @@ PROTOCOL        = http
 ROOT_URL         = http://${DOMAIN}
 %{ endif ~}
 DISABLE_SSH      = ${DISABLE_SSH}
+START_SSH_SERVER = true
 SSH_PORT         = ${SSH_PORT}
 SSH_LISTEN_PORT  = ${SSH_PORT}
+SSH_ROOT_PATH    = /data/git/.ssh
+SSH_AUTHORIZED_KEYS_BACKUP = true
 LFS_START_SERVER = true
 LFS_JWT_SECRET   = ${LFS_JWT_SECRET}
 DOMAIN           = ${DOMAIN}
 OFFLINE_MODE     = false
+SHELL = /bin/sh
 
 [lfs]
 PATH = /data/git/lfs

terraform/modules/apps/gitea/resources/robots.txt

@@ -0,0 +1,2 @@
+User-agent: *
+Disallow: /

terraform/modules/apps/gitea/variables.tf

@@ -32,7 +32,7 @@ variable "db_root_password" {
 variable "tag" {
   description = "The version of the websites to install"
   type        = string
-  default     = "1.23.4"
+  default     = "latest-rootless"
 }
 
 variable "fqdn" {
@@ -77,7 +77,7 @@ variable "app_config" {
     run_mode                         = optional(string, "prod")
     http_port                        = optional(string, "3000")
     disable_ssh                      = optional(bool, false)
-    ssh_port                         = optional(number, 22)
+    ssh_port                         = optional(number, 2222)
     db_host                          = optional(string, "mariadb")
     db_port                          = optional(string, "3306")
     db_name                          = optional(string, "gitea")