# 创建部署根目录与各子目录
mkdir -p /opt/gitproxy-2.3/{config,certs,data/gitea,data/gitproxy,client}
cd /opt/gitproxy-2.3

/opt/gitproxy-2.3/
├── config/proxy.config.json   # GitProxy 主配置（挂载进服务，只读）
├── certs/                     # 自签 CA 与两个服务端证书
├── data/gitea/                # Gitea 持久化数据（仓库、账号、SQLite）
├── data/gitproxy/             # GitProxy 持久化数据（NeDB：pushes/repos/users）
└── client/                    # 演示工作机的工作目录（git 仓库）

# 1) 生成自签 CA（有效期 10 年；genrsa/req 静默成功无输出）
openssl genrsa -out ca.key 2048
openssl req -x509 -new -nodes -key ca.key -sha256 -days 3650 \
  -subj '/CN=GitProxy Demo CA' -out ca.crt

# 2) 签发 gitproxy.local 服务端证书（SAN 必须含域名，否则 git 客户端报证书不匹配）
printf 'subjectAltName = DNS:gitproxy.local\nextendedKeyUsage = serverAuth\n' > san-gitproxy.cnf
openssl genrsa -out gitproxy.key 2048
openssl req -new -key gitproxy.key -subj '/CN=gitproxy.local' -out gitproxy.csr
openssl x509 -req -in gitproxy.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out gitproxy.crt -days 825 -sha256 -extfile san-gitproxy.cnf

Certificate request self-signature ok
subject=CN = gitproxy.local

# 3) 签发 gitea.local 服务端证书
printf 'subjectAltName = DNS:gitea.local\nextendedKeyUsage = serverAuth\n' > san-gitea.cnf
openssl genrsa -out gitea.key 2048
openssl req -new -key gitea.key -subj '/CN=gitea.local' -out gitea.csr
openssl x509 -req -in gitea.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out gitea.crt -days 825 -sha256 -extfile san-gitea.cnf

Certificate request self-signature ok
subject=CN = gitea.local

# 4) 验证证书链
openssl verify -CAfile ca.crt gitproxy.crt gitea.crt

gitproxy.crt: OK
gitea.crt: OK

{
  "cookieSecret": "gitproxy-2.3-demo-cookie-secret-2026",
  "sessionMaxAgeHours": 12,
  "serverPort": 8149,
  "httpsServerPort": 8151,
  "uiHost": "http://gitproxy.local:8150",
  "uiPort": 8150,
  "httpsUiPort": 8152,
  "rateLimit": {
    "windowMs": 60000,
    "limit": 1000
  },
  "tempPassword": {
    "sendEmail": false,
    "emailConfig": {}
  },
  "authorisedList": [
    {
      "project": "admin",
      "name": "hello-gitproxy",
      "url": "https://gitea.local:3000/admin/hello-gitproxy.git",
      "proxyURL": "http://gitproxy.local:8149"
    }
  ],
  "scmProviders": [
    { "name": "github", "type": "github", "host": "github.com" },
    { "name": "gitlab", "type": "gitlab", "host": "gitlab.com" },
    { "name": "codeberg", "type": "forgejo", "host": "codeberg.org" },
    { "name": "gitea", "type": "forgejo", "host": "gitea.com" },
    {
      "name": "local-gitea",
      "type": "forgejo",
      "host": "gitea.local",
      "apiUrl": "https://gitea.local:3000/api/v1"
    }
  ],
  "sink": [
    { "type": "fs", "enabled": true },
    {
      "type": "mongo",
      "connectionString": "mongodb://localhost:27017/gitproxy",
      "options": { "tlsAllowInvalidCertificates": false },
      "enabled": false
    },
    {
      "type": "postgres",
      "connectionString": "postgresql://localhost:5432/gitproxy",
      "enabled": false
    }
  ],
  "authentication": [
    { "type": "local", "enabled": true },
    {
      "type": "ActiveDirectory",
      "enabled": false,
      "adminGroup": "",
      "userGroup": "",
      "domain": "",
      "adConfig": { "url": "", "baseDN": "", "searchBase": "", "username": "", "password": "" }
    },
    {
      "type": "openidconnect",
      "enabled": false,
      "oidcConfig": { "issuer": "", "clientID": "", "clientSecret": "", "callbackURL": "", "scope": "" }
    }
  ],
  "api": {},
  "commitConfig": {
    "author": {
      "email": {
        "local": { "block": "" },
        "domain": { "allow": ".*" }
      }
    },
    "message": { "block": { "literals": [], "patterns": [] } },
    "diff": { "block": { "literals": [], "patterns": [], "providers": {} } }
  },
  "attestationConfig": {
    "questions": [
      {
        "label": "I have checked every commit in this push",
        "tooltip": {
          "text": "Please confirm you have checked every commit in this push",
          "links": []
        }
      },
      {
        "label": "I am authorised to make this push",
        "tooltip": {
          "text": "Please confirm you are authorised to make this push",
          "links": []
        }
      }
    ]
  },
  "domains": {
    "proxy": "http://gitproxy.local:8149",
    "service": "http://gitproxy.local:8150"
  },
  "privateOrganizations": [],
  "urlShortener": "",
  "contactEmail": "admin@example.com",
  "csrfProtection": true,
  "sidebandProgress": true,
  "plugins": [],
  "apiAuthentication": [
    {
      "type": "jwt",
      "enabled": false,
      "jwtConfig": {
        "authorityURL": "",
        "clientID": "",
        "expectedAudience": "",
        "roleMapping": { "admin": { "": "" } }
      }
    }
  ],
  "upstreamProxy": { "enabled": false, "url": "http://localhost:8081", "noProxy": [] },
  "tls": {
    "enabled": true,
    "key": "/app/certs/gitproxy.key",
    "cert": "/app/certs/gitproxy.crt"
  },
  "uiRouteAuth": {
    "enabled": false,
    "rules": [
      { "pattern": "/dashboard/*", "adminOnly": false, "loginRequired": true },
      { "pattern": "/admin/*", "adminOnly": true, "loginRequired": true }
    ]
  },
  "ssh": {
    "enabled": false,
    "port": 2222,
    "knownHosts": {
      "github.com": "SHA256:+DiY3wvvV6TuJJhbpZisF/zLDA0zPMSvHdkr4UvCOqU",
      "gitlab.com": "SHA256:eUXGGm1YGsMAS7vkcx6JOJdOGHPem5gQp4taiCfCLB8"
    }
  }
}

name: gitproxy-2.3-deploy

services:
  gitea:
    image: gitea/gitea:1.23.8
    container_name: gitproxy-2.3-gitea
    hostname: gitea.local
    restart: unless-stopped
    environment:
      USER_UID: "1000"
      USER_GID: "1000"
      GITEA__server__PROTOCOL: https
      GITEA__server__CERT_FILE: /data/certs/gitea.crt
      GITEA__server__KEY_FILE: /data/certs/gitea.key
      GITEA__server__DOMAIN: gitea.local
      GITEA__server__ROOT_URL: https://gitea.local:3000/
      GITEA__database__DB_TYPE: sqlite3
      GITEA__security__INSTALL_LOCK: "true"
      GITEA__service__DISABLE_REGISTRATION: "true"
    ports:
      - "8147:3000"
    volumes:
      - ./data/gitea:/data
      - ./certs:/data/certs:ro
    networks:
      default:
        aliases:
          - gitea.local

  gitproxy:
    image: finos/git-proxy:v2.3.0
    container_name: gitproxy-2.3-server
    hostname: gitproxy.local
    restart: unless-stopped
    command: ["node", "--enable-source-maps", "dist/index.js", "--config", "/app/proxy.config.json"]
    depends_on:
      - gitea
    environment:
      ALLOWED_ORIGINS: "*"
      NODE_EXTRA_CA_CERTS: /app/certs/ca.crt
      GIT_SSL_CAINFO: /app/certs/ca.crt
      CONFIG_FILE: /app/proxy.config.json
    ports:
      - "8149:8149"
      - "8150:8150"
      - "8151:8151"
      - "8152:8152"
    volumes:
      - ./config/proxy.config.json:/app/proxy.config.json:ro
      - ./certs:/app/certs:ro
      - ./data/gitproxy:/app/.data
    networks:
      default:
        aliases:
          - gitproxy.local

  client:
    image: ubuntu:22.04
    container_name: gitproxy-2.3-client
    hostname: client.local
    restart: unless-stopped
    command: ["sleep", "infinity"]
    volumes:
      - ./certs/ca.crt:/usr/local/share/ca-certificates/gitproxy-ca.crt:ro
      - ./client:/root/work

networks:
  default:
    name: gitproxy-stack-net
    ipam:
      config:
        - subnet: 10.89.67.0/24

# 服务器本机解析两个演示域名
echo "10.89.67.2 gitproxy.local gitea.local" >> /etc/hosts

# 启动整套栈（首次启动自动拉取镜像）
docker compose up -d

docker compose ps

NAME                  IMAGE                    COMMAND                  SERVICE    CREATED             STATUS             PORTS
gitproxy-2.3-client   ubuntu:22.04             "sleep infinity"         client     About an hour ago   Up About an hour   
gitproxy-2.3-gitea    gitea/gitea:1.23.8       "/usr/bin/entrypoint…"   gitea      About an hour ago   Up About an hour   22/tcp, 0.0.0.0:8147->3000/tcp, [::]:8147->3000/tcp
gitproxy-2.3-server   finos/git-proxy:v2.3.0   "tini -- /docker-ent…"   gitproxy   About an hour ago   Up 3 minutes       8000/tcp, 8080/tcp, 8444/tcp, 0.0.0.0:8149-8152->8149-8152/tcp, [::]:8149-8152->8149-8152/tcp

Created runtime configuration with:
  API URL: auto-detect
  Allowed Origins: *
  Environment: production
Configuration sources are disabled
Configuration loaded successfully
Setting config file to: /app/proxy.config.json
Validating config
Setting up the proxy and Service
Cleaning up the existing .remote dir...
Creating the .remote dir...
Loading neDB database adaptor
No plugins configured
Found 0 plugin modules
Service Listening on 8150
HTTPS Service Listening on 8152
Initializing proxy router for origins: '["gitea.local:3000"]'
	setting up origin: 'gitea.local:3000'
	setting up catch-all route (github.com) for backwards compatibility
proxy keys registered:  ["/gitea.local:3000/"]
HTTP Proxy Listening on 8149
HTTPS Proxy Listening on 8151

# 1) GitProxy 管理台健康检查（HTTP 8150）
curl -s http://localhost:8150/api/v1/healthcheck

{"message":"ok"}

# 2) 管理台 HTTPS（8152）与 Gitea HTTPS（8147）状态码
curl -sk -o /dev/null -w '%{http_code}\n' https://localhost:8152/
curl -sk -o /dev/null -w '%{http_code}\n' https://localhost:8147/

200
200

# 在 Gitea 服务内创建管理员（实测命令）
docker exec gitproxy-2.3-gitea gitea admin user create \
  --username admin --password q1w2e3r4 \
  --email admin@example.com --admin

New user 'admin' has been successfully created!

# 1) 取 CSRF Token 并用默认账号登录（csrfProtection: true 时所有写请求都要带 Token；
#    Token 每次写操作前重新获取，会话 Cookie 存入 admin.jar 贯穿后续命令）
CT=$(curl -s -c admin.jar http://localhost:8150/api/auth/csrf-token | python3 -c 'import json,sys;print(json.load(sys.stdin)["csrfToken"])')
curl -s -b admin.jar -c admin.jar -X POST http://localhost:8150/api/auth/login \
  -H 'Content-Type: application/json' -H "X-CSRF-Token: $CT" \
  -d '{"username":"admin","password":"admin"}'

{"message":"success","user":{"username":"admin","displayName":"","email":"admin@place.com","title":"","scmIdentities":{},"admin":true}}

# 2) 修改 admin 密码为演示口令 q1w2e3r4（POST /api/auth/change-password）
CT=$(curl -s -b admin.jar -c admin.jar http://localhost:8150/api/auth/csrf-token | python3 -c 'import json,sys;print(json.load(sys.stdin)["csrfToken"])')
curl -s -b admin.jar -X POST http://localhost:8150/api/auth/change-password \
  -H 'Content-Type: application/json' -H "X-CSRF-Token: $CT" \
  -d '{"currentPassword":"admin","newPassword":"q1w2e3r4"}'

{"message":"Password updated successfully"}

# 3) 创建审批人 reviewer
CT=$(curl -s -b admin.jar -c admin.jar http://localhost:8150/api/auth/csrf-token | python3 -c 'import json,sys;print(json.load(sys.stdin)["csrfToken"])')
curl -s -b admin.jar -X POST http://localhost:8150/api/auth/create-user \
  -H 'Content-Type: application/json' -H "X-CSRF-Token: $CT" \
  -d '{"username":"reviewer","password":"q1w2e3r4","email":"reviewer@example.com"}'

{"message":"User created successfully","username":"reviewer"}

# 4) 查询 hello-gitproxy 的仓库记录（拿到 _id，Cookie 沿用 admin.jar）
curl -s -b admin.jar http://localhost:8150/api/v1/repo/

{"project":"admin","name":"hello-gitproxy","url":"https://gitea.local:3000/admin/hello-gitproxy.git","users":{"canPush":["admin"],"canAuthorise":["reviewer"]},"dateCreated":"2026-10-26T01:31:36.372Z","lastModified":"2026-10-26T01:36:39.921Z","_id":"JgcqA5axqbi0LcWa","proxyURL":"http://gitproxy.local:8149"}

# 5) 配置授权矩阵（_id 用上一步返回值；两步各带一个新取的 CSRF Token）
CT=$(curl -s -b admin.jar -c admin.jar http://localhost:8150/api/auth/csrf-token | python3 -c 'import json,sys;print(json.load(sys.stdin)["csrfToken"])')
curl -s -b admin.jar -X PATCH http://localhost:8150/api/v1/repo/JgcqA5axqbi0LcWa/user/push \
  -H 'Content-Type: application/json' -H "X-CSRF-Token: $CT" -d '{"username":"admin"}'
CT=$(curl -s -b admin.jar -c admin.jar http://localhost:8150/api/auth/csrf-token | python3 -c 'import json,sys;print(json.load(sys.stdin)["csrfToken"])')
curl -s -b admin.jar -X PATCH http://localhost:8150/api/v1/repo/JgcqA5axqbi0LcWa/user/authorise \
  -H 'Content-Type: application/json' -H "X-CSRF-Token: $CT" -d '{"username":"reviewer"}'

{"message":"created"}
{"message":"created"}

# 1) 工作台内信任自签 CA 并配置 git
update-ca-certificates
git config --global user.name  admin
git config --global user.email admin@example.com

# 2) 导出 Gitea Personal Access Token（网页生成后交互式写入变量，避免明文留在命令历史）
read -s -p "Gitea Token: " GITEA_TOKEN && echo

# 3) 克隆上游仓库（走 Gitea HTTPS 8147）
cd /root/work
git clone "https://admin:q1w2e3r4@gitea.local:3000/admin/hello-gitproxy.git"
cd hello-gitproxy

# 4) 提交并推送（推送地址指向 GitProxy 网关 8149，凭据为 GitProxy 账号 + Gitea Token）
echo "deployment verification" > verify.txt
git add verify.txt && git commit -m "docs: deployment verification"
git push "http://admin:${GITEA_TOKEN}@gitproxy.local:8149/gitea.local:3000/admin/hello-gitproxy.git" main

remote: Resolving user from token...        
remote: Checking for empty branch...        
remote: Checking repository is authorised...        
remote: Checking commit messages...        
remote: Checking author emails...        
remote: Checking push permissions...        
remote: Fetching remote repository...        
remote: Writing pack data...        
remote: Checking for hidden commits...        
remote: Checking approval status...        
remote: Running pre-receive hook...        
remote: Computing diff...        
remote: Scanning for secrets...        
remote: Scanning diff contents...        
remote: Requesting approval...        
remote: 	        
remote: [32mGitProxy has received your push ✅[0m        
remote: 🔗 Shareable Link        
remote: [34mhttp://gitproxy.local:8150/dashboard/push/1918f67cad308399c981a46feeabdc08b17b8121e64e93b213f1d72f190f10b2[0m        
To http://gitproxy.local:8149/gitea.local:3000/admin/hello-gitproxy.git
 ! [remote rejected] main -> main (approval required)
error: failed to push some refs to 'http://gitproxy.local:8149/gitea.local:3000/admin/hello-gitproxy.git'

# 4) reviewer 登录（会话存 reviewer.jar，取 Token 流程同 4.7 节第 1) 步）后调用审批 API
CT=$(curl -s -c reviewer.jar http://localhost:8150/api/auth/csrf-token | python3 -c 'import json,sys;print(json.load(sys.stdin)["csrfToken"])')
curl -s -b reviewer.jar -c reviewer.jar -X POST http://localhost:8150/api/auth/login \
  -H 'Content-Type: application/json' -H "X-CSRF-Token: $CT" \
  -d '{"username":"reviewer","password":"q1w2e3r4"}'
CT=$(curl -s -b reviewer.jar -c reviewer.jar http://localhost:8150/api/auth/csrf-token | python3 -c 'import json,sys;print(json.load(sys.stdin)["csrfToken"])')
curl -s -b reviewer.jar -X POST http://localhost:8150/api/v1/push/1918f67cad308399c981a46feeabdc08b17b8121e64e93b213f1d72f190f10b2/authorise \
  -H 'Content-Type: application/json' -H "X-CSRF-Token: $CT" \
  -d '{"params":{"attestation":[{"label":"I have checked every commit in this push","checked":true},{"label":"I am authorised to make this push","checked":true}]}}'

{"message":"authorised 1918f67cad308399c981a46feeabdc08b17b8121e64e93b213f1d72f190f10b2"}

# 5) 批准后重推同一分支
git push "http://admin:${GITEA_TOKEN}@gitproxy.local:8149/gitea.local:3000/admin/hello-gitproxy.git" main

remote: Checking approval status...        
remote: . Processing 1 references        
remote: Processed 1 references in total        
To http://gitproxy.local:8149/gitea.local:3000/admin/hello-gitproxy.git
   bea3f4f..757f8c7  main -> main

ls -la /opt/gitproxy-2.3/data/gitproxy/db/

total 124
drwxr-xr-x 2 root root   4096 Oct 26 10:52 .
drwxr-xr-x 4 root root   4096 Oct 26 09:29 ..
-rw-r--r-- 1 root root  20480 Oct 26 10:52 migrations.db
-rw-r--r-- 1 root root  36864 Oct 26 10:52 pushes.db
-rw-r--r-- 1 root root  12288 Oct 26 10:52 repos.db
-rw-r--r-- 1 root root  36864 Oct 26 10:52 users.db

# 修改配置后尝试热加载端点（v2.3.0 无此路由）
curl -s -X POST http://localhost:8150/api/v1/admin/reload-config

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Error</title>
</head>
<body>
<pre>Cannot POST /api/v1/admin/reload-config</pre>
</body>
</html>

# 修改配置后重启 gitproxy 服务并验证健康
docker compose restart gitproxy
curl -s http://localhost:8150/api/v1/healthcheck

{"message":"ok"}

# 1) 创建 bridge 网络并注册域名解析
docker network create -d bridge --subnet 10.89.67.0/24 gitproxy-stack-net

# 2) 启动 Gitea 上游（HTTPS + 证书挂载 + 数据持久化）
docker run -d --name gitproxy-2.3-gitea \
  --hostname gitea.local \
  --network gitproxy-stack-net \
  --network-alias gitea.local \
  -p 8147:3000 \
  -e USER_UID=1000 -e USER_GID=1000 \
  -e GITEA__server__PROTOCOL=https \
  -e GITEA__server__CERT_FILE=/data/certs/gitea.crt \
  -e GITEA__server__KEY_FILE=/data/certs/gitea.key \
  -e GITEA__server__DOMAIN=gitea.local \
  -e GITEA__server__ROOT_URL=https://gitea.local:3000/ \
  -e GITEA__database__DB_TYPE=sqlite3 \
  -e GITEA__security__INSTALL_LOCK=true \
  -e GITEA__service__DISABLE_REGISTRATION=true \
  -v /opt/gitproxy-2.3/data/gitea:/data \
  -v /opt/gitproxy-2.3/certs:/data/certs:ro \
  --restart unless-stopped \
  gitea/gitea:1.23.8

# 3) 启动 GitProxy 网关（显式 --config 加载挂载配置 + CA 信任注入）
docker run -d --name gitproxy-2.3-server \
  --hostname gitproxy.local \
  --network gitproxy-stack-net \
  --network-alias gitproxy.local \
  -p 8149:8149 -p 8150:8150 -p 8151:8151 -p 8152:8152 \
  -e ALLOWED_ORIGINS='*' \
  -e NODE_EXTRA_CA_CERTS=/app/certs/ca.crt \
  -e GIT_SSL_CAINFO=/app/certs/ca.crt \
  -v /opt/gitproxy-2.3/config/proxy.config.json:/app/proxy.config.json:ro \
  -v /opt/gitproxy-2.3/certs:/app/certs:ro \
  -v /opt/gitproxy-2.3/data/gitproxy:/app/.data \
  --restart unless-stopped \
  finos/git-proxy:v2.3.0 node --enable-source-maps dist/index.js --config /app/proxy.config.json

# 查看三个服务状态
docker compose ps

# 跟踪网关实时日志（推送处理链全在这里）
docker compose logs -f gitproxy

# 重启单个服务（改配置后用）
docker compose restart gitproxy

# 停止/启动整套栈（数据保留）
docker compose stop
docker compose start

# 彻底销毁栈（数据目录仍在磁盘上）
docker compose down

# 连数据一起清空（⚠️ 会删除推送审批记录与账号，慎用）
docker compose down -v

fatal: http://gitproxy.local:8149/gitea.local:3000/admin/second-repo.git/info/refs not valid: is this a git repository?

Parse action calculated repo URL: https://gitea.local:3000/admin/second-repo.git for inbound URL path: /gitea.local:3000/admin/second-repo.git/info/refs?service=git-receive-pack
Parse action fallback calculated repo URL: https://github.com/gitea.local:3000/admin/second-repo.git for inbound URL path: /gitea.local:3000/admin/second-repo.git/info/refs?service=git-receive-pack
checkRepoInAuthorisedList - repo https://github.com/gitea.local:3000/admin/second-repo.git is not in the authorised whitelist, ending
checkRepoInAuthorisedList - Rejecting repo https://github.com/gitea.local:3000/admin/second-repo.git not in the authorised whitelist
Action processed: Error

{"message":"created"}