update dns setup

.env.example

@@ -1,16 +1,16 @@
 # stalwart
-STALWART_PUBLIC_URL=https://m.example.org
+STALWART_PUBLIC_URL=https://post.example.org
 OIDC_KEY=GENERATE_STRING # openssl rand -hex 32
-OIDC_SIGNATURE_KEY=GENERATE_PEM # openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -pkeyopt ec_param_enc:named_curve
+OIDC_SIGNATURE_KEY=GENERATE_PEM # openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -pkeyopt ec_param_enc:named_curve # ONE LINE, IN QUOTES, SEPARATED BY \n
 
 # bulwark
-JMAP_SERVER_URL=https://m.example.org
+JMAP_SERVER_URL=https://post.example.org
 SESSION_SECRET=GENERATE_STRING # openssl rand -hex 32
 SETTINGS_SYNC_ENABLED=true
 ADMIN_PASSWORD=GENERATE_PASSWORD # tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20; echo
 
 # vykar
 VYKAR_LABEL=borgbase
-VYKAR_URL=https://myrepo.repo.borgbase.com
+VYKAR_URL=https://REPO.repo.borgbase.com
 VYKAR_ACCESS_TOKEN=ACCESS_TOKEN
 VYKAR_ENCRYPTION_SECRET=GENERATE_STRING # openssl rand -hex 32

.gitignore

@@ -1 +1 @@
-.env
+*.env

Caddyfile

@@ -3,14 +3,14 @@
 #     acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
 # }
 
-mail.yaoi.dog {
+post.atom.town {
     reverse_proxy stalwart:8080
 }
 
-post.yaoi.dog {
+mail.atom.town {
     reverse_proxy bulwark:3000
 }
 
-git.yaoi.dog {
+git.atom.town {
-    reverse_proxy forgejo:3000
+    reverse_proxy gitea:3000
 }

README.md

@@ -1,4 +1,4 @@
-# thingy!
+# atom.town!
 
 some kind of hosting setup
 
@@ -11,11 +11,11 @@ some kind of hosting setup
     - `sudo su - admin`
 3. use the system setup script, and log out
     - `sudo dnf install git -y`
-    - `git clone https://gitlab.com/futile/thingy`
+    - `git clone https://gitlab.com/futile/atom.town`
-    - `./thingy/scripts/system-setup.sh`
+    - `./atom.town/scripts/system-setup.sh`
     - `exit`
 4. log in again, populate the `.env` and start everything up
-    - `cd thingy`
+    - `cd atom.town`
     - `micro .env`
     - `docker compose up`
 5. continue with service-specific setups .....
@@ -30,31 +30,36 @@ specifics for everything
   - **caddy** – http server & reverse proxy
   - **stalwart** – mailserver
   - **bulwark** – webmail
+  - **gitea** – git server
 - via caddy
-  - `mail.yaoi.dog` – mail (server & admin dash)
+  - `post.atom.town` – mailserver, mail admin, and oidc
-  - `post.yaoi.dog` – mail (webmail)
+  - `mail.atom.town` – webmail
+  - `git.atom.town` – git
 
 **dns setup**
 
 | type  | host      | value                       | notes                      |
 |-------|-----------|---------------------------- |----------------------------|
 | `A`   | `@`       | `<ip>`                      | apex domain                |
-| `A`   | `mail`    | `<ip>`                      | mailserver                 |
+| `A`   | `post`    | `<ip>`                      | mailserver                 |
-| `A`   | `post`    | `<ip>`                      | webmail                    |
+| `A`   | `mail`    | `<ip>`                      | webmail                    |
-| `A`   | `git`     | `<ip>`                      | forgejo                    |
+| `A`   | `git`     | `<ip>`                      | gitea                      |
 | `CAA` | `@`       | `0 issue "letsencrypt.org"` | allow caddy to issue certs |
+| `MX`  | `@`       | `post.atom.town` / `10`     | mail record                |
 
 ### caddy
 
-todo
+> [!NOTE]
+> **todo** // detail setup
 
 ### stalwart
 
-**first setup**
+<details>
+    <summary>initial setup</summary>
 
 1. server identity
-    - server hostname: `mail.yaoi.dog`
+    - server hostname: `post.atom.town`
-    - default email domain: `yaoi.dog`
+    - default email domain: `atom.town`
     - automatically obtain tls certificate: `true`
     - generate email signing keys: `true`
 2. storage
@@ -67,11 +72,13 @@ todo
 5. automatic dns management
     - dns server type: `porkbun`
     - description: `porkbun`
+</details>
 
-**further setup**
+<details>
+    <summary>further setup</summary>
 
 - settings -> security -> allowed ips
-  - added `172.18.0.0/24`; reason: `internal`
+  - added `172.18.0.0/16`; reason: `docker internal`
 - settings -> network -> http -> security
   - permissive cors policy: `true`   **[restart needed]**
 - settings -> authentication -> oidc provider
@@ -82,24 +89,75 @@ todo
     - signature algorithm: `ECDSA using P-384 and SHA-384`
     - signature key: `secret read from environment variable`
     - variable name: `OIDC_SIGNATURE_KEY`
+- management -> directory -> oauth clients
+  - create oauth client
+    - client id: `gitea`
+    - description: `Gitea`
+    - client secret: `<generate_secret>`
+    - redirect uris: `https://git.atom.town/user/oauth2/Stalwart/callback`
+</details>
 
-**useful links**
+<details>
+    <summary>useful links</summary>
 
 - https://stalw.art/docs
 - https://testconnectivity.microsoft.com/tests/Imap/input
 - https://mail-tester.com
+</details>
 
 ### bulwark
 
-todo
+> [!NOTE]
+> **todo** // detail setup
 
-**useful links**
+<details>
+    <summary>useful links</summary>
 
 - https://bulwarkmail.org/docs
+</details>
 
-### forgejo
+### gitea
 
-todo
+<details>
+    <summary>initial setup</summary>
+
+- database settings
+  - database type: `sqlite3`
+  - path: `/data/gitea/gitea.db`
+- general settings
+  - site title: `We cock. Dick. BALLING.`
+  - server domain: `git.atom.town`
+  - ssh server port: `22`
+  - gitea base url: `https://git.atom.town/`
+  - enable update checker: `true`
+- email settings
+  - smtp host: `post.atom.town`
+  - smtp port: `465`
+  - send email as: `"Gitea" <system@atom.town>`
+  - smtp username: `system@atom.town`
+  - smtp password: `<password>`
+  - enable email notifications: `true`
+- server and third-party service settings
+  - enable openid sign-in: `false`
+  - disable self-registration: `false`
+  - allow registration only through external services: `true`
+  - enable openid self-registration: `true`
+  - hidden email domain: `git.atom.town`
+  - password hash algorithm: `argon2`
+</details>
+
+<details>
+    <summary>further setup</summary>
+
+- admin settings -> identity & access -> authentication sources
+  - add authentication source
+    - authentication type: `OAuth2`
+    - authentication name: `Stalwart`
+    - oauth2 provider: `OpenID Connect`
+    - client id (key): `gitea`
+    - client secret: `<secret_from_stalwart>`
+    - openid connect auto discovery url: `https://post.atom.town/.well-known/openid-configuration`
+</details>
 
 ## backups
 
@@ -114,7 +172,7 @@ always remember to `docker compose stop` before doing any of this!
 - to back up automatically, run `sudo EDITOR=micro crontab -e` and add the following:
   ```
   TZ=UTC
-  0 * * * * /home/admin/thingy/scripts/volume-backup.sh
+  0 6 * * * /home/admin/atom.town/scripts/volume-backup.sh
   ```
 
 **restoring**
@@ -133,8 +191,9 @@ the restore process is kind of fucked up but doable
 ## todo
 
 - further secure the server (ratelimiting, hardening...)
+- figure out best way to store .env, other credentials, and various secrets
 - more services
-  - ~~forgejo (need to change host ssh port)~~
+  - ~~gitea (need to change host ssh port)~~
   - vaultwarden
 - ~~tie all services together with an sso~~
 - use postgres for everything

docker-compose.yml

@@ -54,9 +54,9 @@ services:
     depends_on:
       - stalwart
 
-  forgejo:
+  gitea:
-    image: codeberg.org/forgejo/forgejo:16
+    image: docker.gitea.com/gitea:1.27.0
-    container_name: forgejo
+    container_name: gitea
     restart: unless-stopped
     environment:
       - USER_UID=1000
@@ -64,7 +64,7 @@ services:
     ports:
       - "22:22"
     volumes:
-      - forgejo-data:/data
+      - gitea-data:/data
     networks:
       - services
 
@@ -77,7 +77,7 @@ volumes:
   bulwark-config:
   bulwark-state:
   bulwark-telemetry:
-  forgejo-data:
+  gitea-data:
 
 networks:
   services:

scripts/system-setup.sh

@@ -19,14 +19,12 @@ function banner() {
     fi
 }
 
-# https://patorjk.com/software/taag/#p=display&f=Small+Slant
 cat << 'EOF'
-  __  __   _
+       __              __
- / /_/ /  (_)__  ___ ___ __
+ ___ _/ /____  __ _   / /____ _    _____
-/ __/ _ \/ / _ \/ _ `/ // /
+/ _ `/ __/ _ \/  ' \_/ __/ _ \ |/|/ / _ \
-\__/_//_/_/_//_/\_, /\_, /
+\_,_/\__/\___/_/_/_(_)__/\___/__,__/_//_/
-               /___//___/
+        ..... brought to you by futile
-   ..... brought to you by futile
 
 
 EOF

scripts/volume-backup.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-WORKING_DIR="/home/admin/thingy" # todo: better
+WORKING_DIR="/home/admin/atom.town" # todo: better
 LOG_FILE="/var/log/volume-backup.log"
 
 function log() {