212 lines
7.5 KiB
Text
212 lines
7.5 KiB
Text
---
|
|
title: "Website"
|
|
date: 2025-04-07
|
|
description: "An overview of what I am using to host my digital content."
|
|
image:
|
|
url: "showcase.avif"
|
|
alt: "Website showcase"
|
|
categories: ["personal"]
|
|
tags: ["self-host", "forgejo", "docker", "vps"]
|
|
draft: true
|
|
---
|
|
|
|
This post will outline my workflow of using a self-hosted Forgejo instance and Actions runner to automatically deploy my personal site and any software releases, all without having to rely on another provider.
|
|
|
|
|
|
|
|
## Steps
|
|
|
|
### Private image access login?
|
|
|
|
```sh
|
|
echo '<token>' | docker login code.troylusty.com -u troy --password-stdin
|
|
```
|
|
|
|
```sh
|
|
echo $(htpasswd -nB user) | sed -e s/\\$/\\$\\$/g
|
|
```
|
|
|
|
### Aliases for updating VPS and pruning Docker
|
|
|
|
```sh
|
|
echo 'alias dockerclean="docker system prune -a --volumes"' >> .bashrc
|
|
echo 'alias updateall="sudo apt update && sudo apt upgrade && sudo apt autoremove"' >> .bashrc
|
|
```
|
|
|
|
Thanks to [Tech Tales](https://tech-tales.blog/posts/2025/01-forgejo-runner-update) for the clean instructions on how to setup an Actions runner with Forgejo.
|
|
|
|
```sh
|
|
docker compose run --rm forgejo-runner 'forgejo-runner' 'generate-config' > forgejo-runner/config.yml
|
|
```
|
|
|
|
Setup `container.docker_host: "unix:///var/run/docker.sock"` and `container.network: "forgejo"` and any labels such as `runner.labels: ["ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"]`
|
|
|
|
```
|
|
docker compose run --rm -it forgejo-runner 'forgejo-runner' 'register'
|
|
```
|
|
|
|
Input `http://forgejo:3000` as the domain since forgejo is the container name in Docker and port 3000 is its relevant port.
|
|
|
|
## Docker compose
|
|
|
|
```yaml
|
|
services:
|
|
traefik:
|
|
image: traefik:latest
|
|
container_name: traefik
|
|
command:
|
|
- "--providers.docker"
|
|
- "--providers.docker.exposedbydefault=false"
|
|
- "--entryPoints.websecure.address=:443"
|
|
- "--certificatesresolvers.myresolver.acme.tlschallenge=true"
|
|
- "--certificatesresolvers.myresolver.acme.email=traefik@troylusty.com"
|
|
- "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
|
|
- "--entrypoints.web.address=:80"
|
|
- "--entrypoints.web.http.redirections.entrypoint.to=websecure"
|
|
- "--entrypoints.web.http.redirections.entrypoint.scheme=https"
|
|
- "--ping=true"
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "com.centurylinklabs.watchtower.enable=true"
|
|
- "traefik.http.middlewares.securityHeaders.headers.stsSeconds=31536000"
|
|
- "traefik.http.middlewares.securityHeaders.headers.stsIncludeSubdomains=true"
|
|
- "traefik.http.middlewares.securityHeaders.headers.frameDeny=true"
|
|
- "traefik.http.middlewares.securityHeaders.headers.contentTypeNosniff=true"
|
|
- "traefik.http.middlewares.securityHeaders.headers.contentSecurityPolicy=default-src 'self'; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'none'; form-action 'self'; object-src 'none'; frame-ancestors 'none'; upgrade-insecure-requests"
|
|
- "traefik.http.middlewares.securityHeaders.headers.referrerPolicy=no-referrer"
|
|
- "traefik.http.middlewares.securityHeaders.headers.permissionsPolicy=accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(self), usb=(), web-share=(), xr-spatial-tracking=(), clipboard-read=(), clipboard-write=(), gamepad=(), hid=(), idle-detection=(), interest-cohort=(), serial=(), unload=()"
|
|
ports:
|
|
- "80:80"
|
|
- "443:443"
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- letsencrypt:/letsencrypt
|
|
restart: unless-stopped
|
|
networks:
|
|
- traefik
|
|
healthcheck:
|
|
test: ["CMD", "traefik", "healthcheck", "--ping"]
|
|
depends_on:
|
|
watchtower:
|
|
condition: service_healthy
|
|
|
|
watchtower:
|
|
image: containrrr/watchtower:latest
|
|
command: --label-enable --interval 1800 --rolling-restart --cleanup --remove-volumes
|
|
container_name: watchtower
|
|
networks:
|
|
- traefik
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- /home/troy/.docker/config.json:/config.json
|
|
restart: unless-stopped
|
|
healthcheck:
|
|
test: ["CMD", "/watchtower", "--health-check"]
|
|
|
|
personalsite:
|
|
image: code.troylusty.com/troy/troylusty.com:latest
|
|
container_name: personalsite
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.personalsite.rule=Host(`troylusty.com`)"
|
|
- "traefik.http.routers.personalsite.entrypoints=websecure"
|
|
- "traefik.http.routers.personalsite.tls.certresolver=myresolver"
|
|
- "com.centurylinklabs.watchtower.enable=true"
|
|
- "traefik.http.routers.personalsite.middlewares=securityHeaders"
|
|
restart: unless-stopped
|
|
networks:
|
|
- traefik
|
|
depends_on:
|
|
traefik:
|
|
condition: service_healthy
|
|
|
|
zolapress:
|
|
image: code.troylusty.com/troy/zolapress:latest
|
|
container_name: zolapress
|
|
profiles:
|
|
- donotstart
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.zolapress.rule=Host(`edu.troylusty.com`)"
|
|
- "traefik.http.routers.zolapress.entrypoints=websecure"
|
|
- "traefik.http.routers.zolapress.tls.certresolver=myresolver"
|
|
- "com.centurylinklabs.watchtower.enable=true"
|
|
- "traefik.http.middlewares.auth.basicauth.users=troy:$$2y$$05$$fgVNzDsxXDq4co3aTh/OMOKZdLzUiM9XPEU5DXCivc9sYUZy/oq1W"
|
|
- "traefik.http.routers.zolapress.middlewares=securityHeaders, auth"
|
|
restart: unless-stopped
|
|
networks:
|
|
- traefik
|
|
depends_on:
|
|
traefik:
|
|
condition: service_healthy
|
|
|
|
unduck:
|
|
image: code.troylusty.com/troy/unduck:latest
|
|
container_name: unduck
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.unduck.rule=Host(`unduck.troylusty.com`)"
|
|
- "traefik.http.routers.unduck.entrypoints=websecure"
|
|
- "traefik.http.routers.unduck.tls.certresolver=myresolver"
|
|
- "com.centurylinklabs.watchtower.enable=true"
|
|
- "traefik.http.routers.unduck.middlewares=securityHeaders"
|
|
restart: unless-stopped
|
|
networks:
|
|
- traefik
|
|
depends_on:
|
|
traefik:
|
|
condition: service_healthy
|
|
|
|
forgejo:
|
|
image: codeberg.org/forgejo/forgejo:10
|
|
container_name: forgejo
|
|
restart: unless-stopped
|
|
networks:
|
|
- traefik
|
|
- forgejo
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.forgejo.rule=Host(`code.troylusty.com`)"
|
|
- "traefik.http.routers.forgejo.entrypoints=websecure"
|
|
- "traefik.http.routers.forgejo.tls.certresolver=myresolver"
|
|
- "com.centurylinklabs.watchtower.enable=true"
|
|
- "traefik.http.routers.forgejo.middlewares=securityHeaders"
|
|
- "traefik.http.services.forgejo.loadbalancer.server.port=3000"
|
|
- "traefik.docker.network=traefik"
|
|
volumes:
|
|
- ./forgejo:/data
|
|
ports:
|
|
- "2222:22"
|
|
depends_on:
|
|
traefik:
|
|
condition: service_healthy
|
|
|
|
forgejo-runner:
|
|
image: code.forgejo.org/forgejo/runner:6.0.1
|
|
container_name: forgejo-runner
|
|
user: 0:0
|
|
depends_on:
|
|
forgejo:
|
|
condition: service_started
|
|
networks:
|
|
- forgejo
|
|
labels:
|
|
- "com.centurylinklabs.watchtower.enable=true"
|
|
volumes:
|
|
- ./forgejo-runner:/data
|
|
- ./forgejo-runner/config.yml:/data/config.yml
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
restart: unless-stopped
|
|
command: forgejo-runner -c /data/config.yml daemon
|
|
|
|
networks:
|
|
traefik:
|
|
external: false
|
|
name: traefik
|
|
forgejo:
|
|
external: false
|
|
name: forgejo
|
|
|
|
volumes:
|
|
letsencrypt:
|
|
```
|