Add options for built-in SSH server and HTTP bind address

- gitea_ssh_builtin: use Gitea's built-in SSH server (default false)
- gitea_ssh_listen_port: SSH listen port, falls back to ssh_port
- gitea_http_addr: optional HTTP bind address
- grant CAP_NET_BIND_SERVICE when the built-in server uses a port < 1024

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

defaults/main.yml

@@ -23,6 +23,8 @@ gitea_domain: localhost
 gitea_domain_protocol: https
 gitea_port: 3000
 gitea_ssh_domain: localhost
+# use Gitea's built-in SSH server instead of the system sshd
+gitea_ssh_builtin: false
 
 gitea_internal_token: INTERNAL_TOKEN
 gitea_jwt_secret: JWT_SECRET

templates/etc/systemd/system/gitea.service.j2

@@ -20,6 +20,11 @@ Group={{ gitea_grp }}
 WorkingDirectory={{ gitea_data_location }}
 ExecStart={{ gitea_link }}/gitea web --config {{ gitea_home }}/app.ini
 Restart=always
+{% if gitea_ssh_builtin | default(false) | bool and (gitea_ssh_listen_port | default(22) | int) < 1024 %}
+# built-in SSH server binds a privileged port
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+{% endif %}
 Environment=USER={{ gitea_usr }} HOME={{ gitea_home }} GITEA_WORK_DIR={{ gitea_data_location }}
 #Environment=PATH=/path/to/git/bin:/bin:/sbin:/usr/bin:/usr/sbin
 

templates/opt/gitea/home/app.ini.j2

@@ -20,11 +20,15 @@ ROOT = {{ gitea_data_location }}/data/gitea-repositories
 [server]
 SSH_DOMAIN       = {{ gitea_ssh_domain }}
 DOMAIN           = {{ gitea_domain }}
+{% if gitea_http_addr is defined %}
+HTTP_ADDR        = {{ gitea_http_addr }}
+{% endif %}
 HTTP_PORT        ={{ gitea_port | default(3000) }}
 ROOT_URL         = {{ gitea_domain_protocol }}://{{ gitea_ssh_domain }}/
 DISABLE_SSH      = {{ gitea_ssh | default('false') }}
 SSH_PORT         = {{ gitea_ssh_show_port | default(22) }}
-SSH_LISTEN_PORT  = {{ ssh_port | default(22) }}
+SSH_LISTEN_PORT  = {{ gitea_ssh_listen_port | default(ssh_port | default(22)) }}
+START_SSH_SERVER = {{ gitea_ssh_builtin | default(false) | bool | lower }}
 LFS_START_SERVER = {{ gitea_lfs | default('true') }}
 LFS_JWT_SECRET   = """{{ gitea_jwt_secret }}"""
 OFFLINE_MODE     = {{ gitea_is_offline | default('false') }}