Gitea writes WORK_PATH and a generated [oauth2] JWT_SECRET back into app.ini on start, so every Ansible run rewrote the file and restarted Gitea. Template WORK_PATH and, when gitea_oauth2_jwt_secret is set, the oauth2 JWT secret.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- "generate admin user" handler also fires on version upgrades; tolerate
an existing admin and hide the password from logs (no_log)
- remove [picture] DISABLE_GRAVATAR / ENABLE_FEDERATED_AVATAR, which
Gitea >= 1.23 ignores (moved to the admin panel)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- gitea_ssh_builtin: use Gitea's built-in SSH server (default false)
- gitea_ssh_listen_port: SSH listen port, falls back to ssh_port
- gitea_http_addr: optional HTTP bind address
- grant CAP_NET_BIND_SERVICE when the built-in server uses a port < 1024
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
lhahnandClaude Opus 5.5