From 122246d051201cdbe3e85dfbf5b2d0df8f310ebd Mon Sep 17 00:00:00 2001
From: Lennard Brinkhaus <lennard.brinkhaus@dragse.de>
Date: Sat, 10 Dec 2022 21:12:07 +0100
Subject: [PATCH] first implementation of role-gitea

---
 .idea/modules.xml          |   8 ++
 .idea/role-gitea.iml       |   9 ++
 .idea/vcs.xml              |   6 ++
 .idea/workspace.xml        |  88 +++++++++++++++++
 README.md                  | 119 +++++++++++++++++-----
 ansible.cfg                |   2 +
 defaults/main.yml          | 106 +++++++++++++++++++-
 handlers/main.yml          |  11 ++-
 meta/main.yml              |  53 +++-------
 tasks/backup.yml           |  30 ++++++
 tasks/create_user.yml      |  14 +++
 tasks/install.yml          |  73 ++++++++++++++
 tasks/install_systemd.yml  |  17 ++++
 tasks/jwt_secrets.yml      |  38 ++++++++
 tasks/main.yml             |  71 +++++++++++++-
 templates/gitea.ini.j2     | 195 +++++++++++++++++++++++++++++++++++++
 templates/gitea.service.j2 |  24 +++++
 tests/inventory            |   2 +-
 tests/test.yml             |   7 +-
 vars/debian.yml            |   5 +
 vars/main.yml              |  10 +-
 21 files changed, 819 insertions(+), 69 deletions(-)
 create mode 100644 .idea/modules.xml
 create mode 100644 .idea/role-gitea.iml
 create mode 100644 .idea/vcs.xml
 create mode 100644 .idea/workspace.xml
 create mode 100644 ansible.cfg
 create mode 100644 tasks/backup.yml
 create mode 100644 tasks/create_user.yml
 create mode 100644 tasks/install.yml
 create mode 100644 tasks/install_systemd.yml
 create mode 100644 tasks/jwt_secrets.yml
 create mode 100644 templates/gitea.ini.j2
 create mode 100644 templates/gitea.service.j2
 create mode 100644 vars/debian.yml

diff --git a/.idea/modules.xml b/.idea/modules.xml
new file mode 100644
index 0000000..b056411
--- /dev/null
+++ b/.idea/modules.xml
@@ -0,0 +1,8 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="ProjectModuleManager">
+    <modules>
+      <module fileurl="file://$PROJECT_DIR$/.idea/role-gitea.iml" filepath="$PROJECT_DIR$/.idea/role-gitea.iml" />
+    </modules>
+  </component>
+</project>
\ No newline at end of file
diff --git a/.idea/role-gitea.iml b/.idea/role-gitea.iml
new file mode 100644
index 0000000..d6ebd48
--- /dev/null
+++ b/.idea/role-gitea.iml
@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<module type="JAVA_MODULE" version="4">
+  <component name="NewModuleRootManager" inherit-compiler-output="true">
+    <exclude-output />
+    <content url="file://$MODULE_DIR$" />
+    <orderEntry type="inheritedJdk" />
+    <orderEntry type="sourceFolder" forTests="false" />
+  </component>
+</module>
\ No newline at end of file
diff --git a/.idea/vcs.xml b/.idea/vcs.xml
new file mode 100644
index 0000000..35eb1dd
--- /dev/null
+++ b/.idea/vcs.xml
@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="VcsDirectoryMappings">
+    <mapping directory="" vcs="Git" />
+  </component>
+</project>
\ No newline at end of file
diff --git a/.idea/workspace.xml b/.idea/workspace.xml
new file mode 100644
index 0000000..005a1ba
--- /dev/null
+++ b/.idea/workspace.xml
@@ -0,0 +1,88 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="AutoImportSettings">
+    <option name="autoReloadType" value="SELECTIVE" />
+  </component>
+  <component name="ChangeListManager">
+    <list default="true" id="23a1e320-fe07-40f5-af0e-6625c41eca45" name="Changes" comment="">
+      <change afterPath="$PROJECT_DIR$/.idea/modules.xml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/.idea/role-gitea.iml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/.idea/vcs.xml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/.idea/workspace.xml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/ansible.cfg" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/tasks/backup.yml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/tasks/create_user.yml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/tasks/install.yml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/tasks/install_systemd.yml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/tasks/jwt_secrets.yml" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/templates/gitea.ini.j2" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/templates/gitea.service.j2" afterDir="false" />
+      <change afterPath="$PROJECT_DIR$/vars/debian.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/README.md" beforeDir="false" afterPath="$PROJECT_DIR$/README.md" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/defaults/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/defaults/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/handlers/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/handlers/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/meta/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/meta/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/tasks/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/tasks/main.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/tests/inventory" beforeDir="false" afterPath="$PROJECT_DIR$/tests/inventory" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/tests/test.yml" beforeDir="false" afterPath="$PROJECT_DIR$/tests/test.yml" afterDir="false" />
+      <change beforePath="$PROJECT_DIR$/vars/main.yml" beforeDir="false" afterPath="$PROJECT_DIR$/vars/main.yml" afterDir="false" />
+    </list>
+    <option name="SHOW_DIALOG" value="false" />
+    <option name="HIGHLIGHT_CONFLICTS" value="true" />
+    <option name="HIGHLIGHT_NON_ACTIVE_CHANGELIST" value="false" />
+    <option name="LAST_RESOLUTION" value="IGNORE" />
+  </component>
+  <component name="Git.Settings">
+    <option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$" />
+  </component>
+  <component name="MarkdownSettingsMigration">
+    <option name="stateVersion" value="1" />
+  </component>
+  <component name="ProjectId" id="2Idx3kfzTImb7MWtygmma5agMbP" />
+  <component name="ProjectViewState">
+    <option name="hideEmptyMiddlePackages" value="true" />
+    <option name="showLibraryContents" value="true" />
+  </component>
+  <component name="PropertiesComponent">{
+  &quot;keyToString&quot;: {
+    &quot;RunOnceActivity.OpenProjectViewOnStart&quot;: &quot;true&quot;,
+    &quot;RunOnceActivity.ShowReadmeOnStart&quot;: &quot;true&quot;,
+    &quot;WebServerToolWindowFactoryState&quot;: &quot;false&quot;,
+    &quot;node.js.detected.package.eslint&quot;: &quot;true&quot;,
+    &quot;node.js.detected.package.tslint&quot;: &quot;true&quot;,
+    &quot;node.js.selected.package.eslint&quot;: &quot;(autodetect)&quot;,
+    &quot;node.js.selected.package.tslint&quot;: &quot;(autodetect)&quot;,
+    &quot;nodejs_package_manager_path&quot;: &quot;npm&quot;,
+    &quot;vue.rearranger.settings.migration&quot;: &quot;true&quot;
+  }
+}</component>
+  <component name="SpellCheckerSettings" RuntimeDictionaries="0" Folders="0" CustomDictionaries="0" DefaultDictionary="application-level" UseSingleDictionary="true" transferred="true" />
+  <component name="TaskManager">
+    <task active="true" id="Default" summary="Default task">
+      <changelist id="23a1e320-fe07-40f5-af0e-6625c41eca45" name="Changes" comment="" />
+      <created>1670525068766</created>
+      <option name="number" value="Default" />
+      <option name="presentableId" value="Default" />
+      <updated>1670525068766</updated>
+      <workItem from="1670525071135" duration="19000" />
+      <workItem from="1670525102944" duration="1516000" />
+      <workItem from="1670602382441" duration="47000" />
+      <workItem from="1670602449503" duration="42000" />
+      <workItem from="1670602503692" duration="2863000" />
+      <workItem from="1670678443718" duration="2035000" />
+      <workItem from="1670682945030" duration="472000" />
+      <workItem from="1670683728112" duration="2847000" />
+    </task>
+    <servers />
+  </component>
+  <component name="TypeScriptGeneratedFilesManager">
+    <option name="version" value="3" />
+  </component>
+  <component name="UnknownFeatures">
+    <option featureType="com.intellij.fileTypeFactory" implementationName="*.j2" />
+  </component>
+  <component name="XSLT-Support.FileAssociations.UIState">
+    <expand />
+    <select />
+  </component>
+</project>
\ No newline at end of file
diff --git a/README.md b/README.md
index 225dd44..71c3764 100644
--- a/README.md
+++ b/README.md
@@ -1,38 +1,113 @@
-Role Name
+Gitea Role
 =========
 
 A brief description of the role goes here.
 
-Requirements
-------------
 
-Any pre-requisites that may not be covered by Ansible itself or the role should be mentioned here. For instance, if the role uses the EC2 module, it may be a good idea to mention in this section that the boto package is required.
+## Config
+### General
 
-Role Variables
---------------
+* `gitea_version_check`: Check if installed version != `gitea_version` before initiating binary download
+* `gitea_version`: The Gitea-Version you want to install
+* `gitea_user`: UNIX user used by Gitea
+* `gitea_group`: UNIX group used by Gitea
+* `gitea_home`: Base directory to work
+* `gitea_dl_url`: The URL, the compiled gitea-binary will be downloaded from
+* `gitea_systemd_cap_net_bind_service`: Adds `AmbientCapabilities=CAP_NET_BIND_SERVICE` and `AmbientCapabilities=CAP_NET_BIND_SERVICE` to systemd service file
+* `gitea_extra_config`: Additional configuration
 
-A description of the settable variables for this role should go here, including any variables that are in defaults/main.yml, vars/main.yml, and any variables that can/should be set via parameters to the role. Any variables that are read from other roles and/or the global scope (ie. hostvars, group vars, etc.) should be mentioned here as well.
+### Look and feel
 
-Dependencies
-------------
+* `gitea_app_name`: Displayed application name
+* `gitea_show_user_email`: Do you want to display email addresses ? (true/false)
+* `gitea_disable_gravatar`: Do you want to disable Gravatar ? (privacy and so on) (true/false)
+* `gitea_offline_mode`: Do you want to disabling CDNs for frontend assets (true/false)
+* `gitea_disable_registration`: Do you want to disable user registration ? (true/false)
+* `gitea_only_allow_external_registration`: Do you want to force registration only using third-party services ? (true/false)
+* `gitea_show_registration_button`: Do you want to show the registration button? (true/false)
+* `gitea_require_signin`: Do you require a signin to see repo's (even public ones) ? (true/false)
+* `gitea_enable_captcha`: Do you want to enable captcha's ? (true/false)
+* `gitea_themes`: List of enabled themes
+* `gitea_theme_default`: Default theme
 
-A list of other roles hosted on Galaxy should go here, plus any details in regards to parameters that may need to be set for other roles, or variables that are used from other roles.
+### Security
+* `gitea_secret_key`: Cookie secret key
+* `gitea_internal_token`: Internal API token
+* `gitea_disable_git_hooks`: Do you want to disable the interface to add git hooks? If enabled it could be a security bug as it can be used for RCE. Defaults to true (true/false)
 
-Example Playbook
-----------------
+### Limits
 
-Including an example of how to use your role (for instance, with variables passed in as parameters) is always nice for users too:
+* `gitea_user_repo_limit`: Limit how many repos a user can have (-1 for unlimited)
+* `gitea_force_private`: Force every new repository to be private (true/false)
 
-    - hosts: servers
-      roles:
-         - { role: username.rolename, x: 42 }
+### HTTP configuration
 
-License
--------
+* `gitea_http_domain`: HTTP domain (displayed in your clone URLs, just the domain like git.foo.fr)
+* `gitea_root_url`: Root URL used to access your web app (full URL)
+* `gitea_protocol`: Listening protocol (http/https)
+* `gitea_http_listen`: Bind address
+* `gitea_http_port`: Bind port
+* `gitea_disable_http_git`: Disable the use of Git over HTTP ? (true/false)
 
-BSD
+### SSH configuration
 
-Author Information
-------------------
+* `gitea_ssh_listen`: Bind address for the SSH server
+* `gitea_ssh_domain`: SSH domain (displayed in your clone URLs)
+* `gitea_start_ssh`: Do you want to start a built-in SSH server ? (true/false)
+* `gitea_ssh_port`: SSH bind port
 
-An optional section for the role authors to include contact information, or a website (HTML is not allowed).
+### Database configuration
+
+* `gitea_db_type`: Database type, can be `mysql`, `postgres` or `sqlite3`
+* `gitea_db_host`: Database host string `host:port` or `/run/postgresql/` when connectiong to postgres via local unix socket (peer authentication)
+* `gitea_db_name`: Database name
+* `gitea_db_user`: Database username
+* `gitea_db_password`: Database password
+* `gitea_db_ssl`: Use SSL ? (postgres only!). Can be `require`, `disable`, `verify-ca` or `verify-full`
+* `gitea_db_path`: DB path, if you use `sqlite3`. The default is good enough to work though.
+
+### Mailer configuration
+
+* `gitea_mailer_enabled`: Whether to enable the mailer. Default: `false`
+* `gitea_mailer_type`: Type of Mailer (smtp)
+* `gitea_mailer_skip_verify`: Skip SMTP TLS certificate verification (true/false)
+* `gitea_mailer_tls_enabled`: Enable TLS for SMTP connections (true/false)
+* `gitea_mailer_host`: SMTP server hostname and port
+* `gitea_mailer_user`: SMTP server username
+* `gitea_mailer_password`: SMTP server password
+* `gitea_mailer_from`: Sender mail address
+* `gitea_enable_notify_mail`:  Whether e-mail should be send to watchers of a repository when something happens. Default: `false`
+* `gitea_mail_default`: Default configuration for email notifications for users (user configurable). Options: enabled, onmention, disable  (Default: `onmention` )
+* `gitea_autowatch_new_repo`: Enable this to let all organisation users watch new repos when they are created (Default: `false`)
+* `gitea_autowatch_on_change`: Enable this to make users watch a repository after their first commit to it (Default: `true`)
+* `gitea_show_mailstones_dashboard`: Enable this to show the milestones dashboard page - a view of all the user’s milestones (Default: `true`)
+
+### Oauth2 provider configuration
+
+* `gitea_oauth2_enabled`: Enable the Oauth2 provider (true/false)
+* `gitea_oauth2_jwt_secret`: Oauth2 JWT secret. Can be generated with ``gitea generate secret JWT_SECRET``
+
+### GIT LFS configuration
+* `gitea_lfs_server_enabled`: Enable GIT LFS (large filesystem)
+* `gitea_lfs_secret`: JWT secret for remote LFS usage
+
+### Metrics endpoint configuration
+
+* `gitea_metrics_enabled`: Enable the metrics endpoint
+* `gitea_metrics_token`: Bearer token for the Prometheus scrape job
+
+## Log configuration
+
+* `gitea_log_level`; Log Level. Can be `Trace`, `Debug`, `Info`, `Warn`, `Èrror`, `Critical` (Default: `Info`)
+
+### Repository Indexer configuration
+
+* `gitea_repo_indexer_enabled`: Whether to enable the repository indexer (code search). Default: `false`
+* `gitea_repo_indexer_include`: Glob patterns to include in the index (comma-separated list). Default: `""` (all files)
+* `gitea_repo_indexer_exclude`: Glob patterns to exclude from the index (comma-separated list). Default: `""` (no files)
+* `gitea_repo_exclude_vendored`: Exclude vendored files from the index. Default: `true`
+* `gitea_repo_indexer_max_file_size`: Maximum size of files to be indexed (in bytes). Default: `1048576` (1 MB)
+
+### backup on upgrade
+* `gitea_backup_on_upgrade`: Optionally a backup can be created with every update of gitea. Default: `false`
+* `gitea_backup_location`: Where to store the gitea backup if one is created with this role. Default: `{{ gitea_home }}/backups/`
diff --git a/ansible.cfg b/ansible.cfg
new file mode 100644
index 0000000..79ff805
--- /dev/null
+++ b/ansible.cfg
@@ -0,0 +1,2 @@
+[defaults]
+roles_path: ./../
\ No newline at end of file
diff --git a/defaults/main.yml b/defaults/main.yml
index f2d2824..b2fbaba 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,2 +1,106 @@
 ---
-# defaults file for role-gitea
+# General
+gitea_version_check: true
+gitea_version: "1.17.3"
+gitea_user: "gitea"
+gitea_group: "gitea"
+gitea_home: "/var/lib/gitea"
+gitea_dl_url: "https://github.com/go-gitea/gitea/releases/download/v{{ gitea_version }}/gitea-{{ gitea_version }}-linux-{{ gitea_arch }}"
+gitea_systemd_cap_net_bind_service: false
+gitea_extra_config: ""
+
+# Look and feel
+gitea_app_name: "Gitea"
+gitea_show_user_email: false
+gitea_disable_gravatar: true
+gitea_offline_mode: true
+gitea_disable_registration: false
+gitea_only_allow_external_registration: false
+gitea_show_registration_button: true
+gitea_require_signin: true
+gitea_enable_captcha: true
+gitea_themes: auto,gitea,arc-green #TODO install external themes
+gitea_theme_default: auto
+
+# Security
+gitea_secret_key: T0pS3cr31
+gitea_internal_token: SomethingVeryLong
+gitea_disable_git_hooks: true
+
+# Limits
+gitea_user_repo_limit: -1
+gitea_force_private: false
+
+# HTTP Config
+gitea_http_domain: localhost
+gitea_root_url: http://localhost:3000
+gitea_protocol: http
+gitea_http_listen: 127.0.0.1
+gitea_http_port: 3000
+gitea_disable_http_git: false
+
+# SSH Config
+gitea_ssh_listen: 0.0.0.0
+gitea_ssh_domain: localhost
+gitea_start_ssh: true
+gitea_ssh_port: 2222
+
+# Database
+gitea_db_type: sqlite3
+gitea_db_host: 127.0.0.0:3306
+gitea_db_name: root
+gitea_db_user: gitea
+gitea_db_password: lel
+gitea_db_ssl: disable
+gitea_db_path: "{{ gitea_home }}/data/gitea.db"
+
+# Mail Config
+gitea_mailer_enabled: false
+gitea_mailer_type: smtp
+gitea_mailer_skip_verify: false
+gitea_mailer_tls_enabled: true
+gitea_mailer_host: localhost:25
+gitea_mailer_user: ""
+gitea_mailer_password: ""
+gitea_mailer_from: noreply@your.domain
+gitea_enable_notify_mail: false
+gitea_mail_default: onmention
+gitea_autowatch_new_repo: false
+gitea_autowatch_on_change: true
+gitea_show_mailstones_dashboard: true
+
+# Oauth provider config
+gitea_oauth2_enabled: true
+gitea_oauth2_jwt_secret: ''
+
+# GIT LFS config
+gitea_lfs_server_enabled: false
+gitea_lfs_secret: SomethingVeryLong
+gitea_lfs_content_path: "{{ gitea_home }}/data/lfs"
+
+# Metrics endpoint config
+gitea_metrics_enabled: false
+gitea_metrics_token: ~
+
+# Logs
+gitea_log_level: Info
+
+# Repo indexer config
+gitea_repo_indexer_enabled: false
+gitea_repo_indexer_include: ""
+gitea_repo_indexer_exclude: ""
+gitea_repo_exclude_vendored: true
+gitea_repo_indexer_max_file_size: 1048576
+
+# Backup on upgrade
+gitea_backup_on_upgrade: true
+gitea_backup_location: "{{ gitea_home }}/backups/"
+
+# Other
+gitea_gpg_key: "7C9E68152594688862D62AF62D9AE806EC1592E2"
+gitea_gpg_server: "hkps://keys.openpgp.org"
+gitea_repository_root: "{{ gitea_home }}"
+
+
+
+
diff --git a/handlers/main.yml b/handlers/main.yml
index 061842b..e2a8007 100644
--- a/handlers/main.yml
+++ b/handlers/main.yml
@@ -1,2 +1,11 @@
 ---
-# handlers file for role-gitea
+- name: "Restart gitea"
+  ansible.builtin.service:
+    name: gitea
+    state: restarted
+  when: ansible_service_mgr == "systemd"
+
+- name: "Reload systemd"
+  ansible.builtin.systemd:
+    daemon_reload: true
+  when: ansible_service_mgr == "systemd"
\ No newline at end of file
diff --git a/meta/main.yml b/meta/main.yml
index c572acc..40d83cc 100644
--- a/meta/main.yml
+++ b/meta/main.yml
@@ -1,52 +1,23 @@
 galaxy_info:
-  author: your name
-  description: your role description
-  company: your company (optional)
+  author:  Lennard Brinkhaus
+  description: Install and manage a Gitea instance
+  company: DragSE
 
   # If the issue tracker for your role is not on github, uncomment the
   # next line and provide a value
   # issue_tracker_url: http://example.com/issue/tracker
 
-  # Choose a valid license ID from https://spdx.org - some suggested licenses:
-  # - BSD-3-Clause (default)
-  # - MIT
-  # - GPL-2.0-or-later
-  # - GPL-3.0-only
-  # - Apache-2.0
-  # - CC-BY-4.0
-  license: license (GPL-2.0-or-later, MIT, etc)
-
   min_ansible_version: 2.1
 
-  # If this a Container Enabled role, provide the minimum Ansible Container version.
-  # min_ansible_container_version:
+  platforms:
+    - name: Debian
+      versions:
+        - all
+    - name: Ubuntu
+      versions:
+        - all
 
-  #
-  # Provide a list of supported platforms, and for each platform a list of versions.
-  # If you don't wish to enumerate all versions for a particular platform, use 'all'.
-  # To view available platforms and versions (or releases), visit:
-  # https://galaxy.ansible.com/api/v1/platforms/
-  #
-  # platforms:
-  # - name: Fedora
-  #   versions:
-  #   - all
-  #   - 25
-  # - name: SomePlatform
-  #   versions:
-  #   - all
-  #   - 1.0
-  #   - 7
-  #   - 99.99
-
-  galaxy_tags: []
-    # List tags for your role here, one per line. A tag is a keyword that describes
-    # and categorizes the role. Users find roles by searching for tags. Be sure to
-    # remove the '[]' above, if you add tags to this list.
-    #
-    # NOTE: A tag is limited to a single word comprised of alphanumeric characters.
-    #       Maximum 20 tags per role.
+  galaxy_tags:
+    - gitea
 
 dependencies: []
-  # List your role dependencies here, one per line. Be sure to remove the '[]' above,
-  # if you add dependencies to this list.
diff --git a/tasks/backup.yml b/tasks/backup.yml
new file mode 100644
index 0000000..5a082cb
--- /dev/null
+++ b/tasks/backup.yml
@@ -0,0 +1,30 @@
+---
+- name: Get service facts
+  service_facts:
+
+- block:
+    - name: Stopping gitea before upgrade
+      service:
+        name: gitea
+        state: stopped
+
+    - name: "Create backup directory"
+      file:
+        path: "{{ item }}"
+        state: directory
+        owner: "{{ gitea_user }}"
+        group: "{{ gitea_group }}"
+        mode: 'u=rwx,g=rx,o='
+      with_items:
+        - "{{ gitea_backup_location }}"
+
+    - name: Backing up gitea before upgrade
+      command:
+        cmd: "/usr/local/bin/gitea dump -c /etc/gitea/gitea.ini"
+        chdir: "{{ gitea_backup_location }}"
+      become: true
+      become_user: "{{ gitea_user }}"
+  when:
+    - ansible_facts.services["gitea.service"] is defined
+    - ansible_facts.services["gitea.service"].state == "running"
+    - gitea_active_version.stdout != gitea_version
\ No newline at end of file
diff --git a/tasks/create_user.yml b/tasks/create_user.yml
new file mode 100644
index 0000000..fd68cfa
--- /dev/null
+++ b/tasks/create_user.yml
@@ -0,0 +1,14 @@
+---
+- name: "Create Gitea Group"
+  group:
+    name: "{{ gitea_group }}"
+    system: true
+    state: "present"
+
+- name: "Create Gitea user"
+  ansible.builtin.user:
+    name: "{{ gitea_user }}"
+    comment: "Gitea user"
+    home: "{{ gitea_home }}"
+    shell: "/bin/false"
+    system: true
\ No newline at end of file
diff --git a/tasks/install.yml b/tasks/install.yml
new file mode 100644
index 0000000..f9632a2
--- /dev/null
+++ b/tasks/install.yml
@@ -0,0 +1,73 @@
+---
+- block:
+    - name: Update apt cache
+      apt:
+        cache_valid_time: 3600
+        update_cache: true
+      register: _pre_update_apt_cache
+      until: _pre_update_apt_cache is succeeded
+      when:
+        - ansible_pkg_mgr == "apt"
+
+    - name: Install dependencies
+      package:
+        name: "{{ gitea_dependencies }}"
+        state: present
+      register: _install_dep_packages
+      until: _install_dep_packages is succeeded
+      retries: 5
+      delay: 2
+
+- block:
+    - include_tasks: backup.yml
+
+    - name: Download gitea archive
+      get_url:
+        url: "{{ gitea_dl_url }}.xz"
+        dest: "/tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}.xz"
+        checksum: "sha256:{{ gitea_dl_url }}.xz.sha256"
+      register: _download_archive
+      until: _download_archive is succeeded
+      retries: 5
+      delay: 2
+
+    - name: Download gitea asc file
+      get_url:
+        url: "{{ gitea_dl_url }}.xz.asc"
+        dest: "/tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}.xz.asc"
+      register: _download_asc
+      until: _download_asc is succeeded
+      retries: 5
+      delay: 2
+
+    - name: Check gitea gpg key
+      command: "gpg --list-keys 0x{{ gitea_gpg_key }}"
+      register: _gitea_gpg_key_status
+      changed_when: false
+      failed_when: _gitea_gpg_key_status.rc not in (0, 2)
+
+    - name: Import gitea gpg key
+      command: "gpg --keyserver {{ gitea_gpg_server }} --recv {{ gitea_gpg_key }}"
+      register: _gitea_import_key
+      changed_when: '"imported: 1" in _gitea_import_key.stderr'
+      when: _gitea_gpg_key_status.rc != 0
+
+    - name: Check archive signature
+      command: "gpg --verify /tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}.xz.asc /tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}.xz"
+      changed_when: false
+
+    - name: Unpack gitea binary
+      command:
+        cmd: "xz -k -d /tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}.xz"
+        creates: "/tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}"
+
+    - name: Propagate gitea binary
+      copy:
+        src: "/tmp/gitea-{{ gitea_version }}.linux-{{ gitea_arch }}"
+        remote_src: true
+        dest: "/usr/local/bin/gitea"
+        mode: 0755
+        owner: root
+        group: root
+      notify: "Restart gitea"
+  when: (not gitea_version_check|bool) or (gitea_active_version.stdout != gitea_version)
\ No newline at end of file
diff --git a/tasks/install_systemd.yml b/tasks/install_systemd.yml
new file mode 100644
index 0000000..c73e881
--- /dev/null
+++ b/tasks/install_systemd.yml
@@ -0,0 +1,17 @@
+---
+- name: "Setup systemd service"
+  ansible.builtin.template:
+    src: gitea.service.j2
+    dest: /lib/systemd/system/gitea.service
+    owner: root
+    group: root
+    mode: 0644
+  notify:
+    - "Reload systemd"
+    - "Restart gitea"
+
+# systemd to be reloaded the first time because
+#  it is the only way Systemd is going to be aware of the new unit file.
+- name: "Reload systemd"
+  ansible.builtin.systemd:
+    daemon_reload: true
\ No newline at end of file
diff --git a/tasks/jwt_secrets.yml b/tasks/jwt_secrets.yml
new file mode 100644
index 0000000..3c81184
--- /dev/null
+++ b/tasks/jwt_secrets.yml
@@ -0,0 +1,38 @@
+---
+- name: generate OAuth2 JWT_SECRET if not provided
+  become: true
+  shell: 'umask 077; /usr/local/bin/gitea generate secret JWT_SECRET > /etc/gitea/gitea_oauth_jwt_secret'
+  args:
+    creates: '/etc/gitea/gitea_oauth_jwt_secret'
+  when: gitea_oauth2_jwt_secret | length == 0
+
+- name: read OAuth2 JWT_SECRET from file
+  become: true
+  slurp:
+    src: '/etc/gitea/gitea_oauth_jwt_secret'
+  register: oauth_jwt_secret
+  when: gitea_oauth2_jwt_secret | length == 0
+
+- name: set fact gitea_oauth2_jwt_secret
+  set_fact:
+    gitea_oauth2_jwt_secret: "{{ oauth_jwt_secret['content'] | b64decode }}"
+  when: gitea_oauth2_jwt_secret | length == 0
+
+- name: generate LFS JWT_SECRET if not provided
+  become: true
+  shell: 'umask 077; /usr/local/bin/gitea generate secret JWT_SECRET > /etc/gitea/gitea_lfs_jwt_secret'
+  args:
+    creates: '/etc/gitea/gitea_lfs_jwt_secret'
+  when: gitea_lfs_secret | length == 0
+
+- name: read LFS JWT_SECRET from file
+  become: true
+  slurp:
+    src: '/etc/gitea/gitea_lfs_jwt_secret'
+  register: lfs_jwt_secret
+  when: gitea_lfs_secret | length == 0
+
+- name: set fact gitea_lfs_secret
+  set_fact:
+    gitea_lfs_jwt_secret: "{{ lfs_jwt_secret['content'] | b64decode }}"
+  when: gitea_lfs_secret | length == 0
\ No newline at end of file
diff --git a/tasks/main.yml b/tasks/main.yml
index 9d41f3a..6bfc550 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -1,2 +1,71 @@
 ---
-# tasks file for role-gitea
+- name: Gather variables for each operating system
+  include_vars: "{{ ansible_distribution | lower }}.yml"
+
+- name: "Check gitea version"
+  ansible.builtin.shell: "set -eo pipefail; /usr/local/bin/gitea -v | cut -d' ' -f 3"
+  args:
+    executable: /bin/bash
+  register: gitea_active_version
+  changed_when: false
+  failed_when: false
+  when: gitea_version_check|bool
+
+- include_tasks: create_user.yml
+
+- include_tasks: install.yml
+
+- name: "Create config and data directory"
+  ansible.builtin.file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ gitea_user }}"
+    group: "{{ gitea_group }}"
+    mode: '0755'
+  with_items:
+    - "/etc/gitea"
+
+- name: "Create data directory"
+  file:
+    path: "{{ item }}"
+    state: directory
+    owner: "{{ gitea_user }}"
+    group: "{{ gitea_group }}"
+    mode: 'u=rwX,g=rX,o='
+    recurse: true
+  with_items:
+    - "{{ gitea_home }}"
+    - "{{ gitea_home }}/data"
+    - "{{ gitea_home }}/custom"
+    - "{{ gitea_home }}/custom/https"
+    - "{{ gitea_home }}/custom/mailer"
+    - "{{ gitea_home }}/indexers"
+    - "{{ gitea_home }}/log"
+    - "{{ gitea_repository_root }}"
+
+- include_tasks: install_systemd.yml
+  when: ansible_service_mgr == "systemd"
+
+- include_tasks: jwt_secrets.yml
+
+- name: 'Install git'
+  ansible.builtin.package:
+    name: 'git'
+    state: 'present'
+
+- name: "Configure gitea"
+  ansible.builtin.template:
+    src: gitea.ini.j2
+    dest: /etc/gitea/gitea.ini
+    owner: "{{ gitea_user }}"
+    group: "{{ gitea_group }}"
+    mode: 0600
+  notify: "Restart gitea"
+
+- name: "Service gitea"
+  ansible.builtin.service:
+    name: gitea
+    state: started
+    enabled: true
+  when: ansible_service_mgr == "systemd"
+
diff --git a/templates/gitea.ini.j2 b/templates/gitea.ini.j2
new file mode 100644
index 0000000..a4ac7f6
--- /dev/null
+++ b/templates/gitea.ini.j2
@@ -0,0 +1,195 @@
+; this file is the configuration of your local gitea instance
+; {{ ansible_managed }}
+;
+; This file overwrites the default values from gitea.
+; undefined variables will use the default value from gitea.
+; Cheat Sheet: https://docs.gitea.io/en-us/config-cheat-sheet/
+;
+; App name that shows on every page title
+APP_NAME = {{ gitea_app_name }}
+; Change it if you run locally
+RUN_USER = {{ gitea_user }}
+; Either "dev", "prod" or "test", default is "dev"
+RUN_MODE = prod
+
+[repository]
+ROOT                = {{ gitea_repository_root }}
+; Force every new repository to be private
+FORCE_PRIVATE       = {{ gitea_force_private | ternary('true', 'false') }}
+; Global limit of repositories per user, applied at creation time. -1 means no limit
+MAX_CREATION_LIMIT  = {{ gitea_user_repo_limit }}
+; Mirror sync queue length, increase if mirror syncing starts hanging
+MIRROR_QUEUE_LENGTH = 1000
+; Disable the ability to interact with repositories using the HTTP protocol
+DISABLE_HTTP_GIT    = {{ gitea_disable_http_git | ternary('true', 'false') }}
+
+[ui]
+; Whether the email of the user should be shown in the Explore Users page
+SHOW_USER_EMAIL = {{ gitea_show_user_email | ternary('true', 'false') }}
+THEMES          = {{ gitea_themes }}
+DEFAULT_THEME   = {{ gitea_theme_default }}
+
+[server]
+; The protocol the server listens on. One of 'http', 'https', 'unix' or 'fcgi'.
+PROTOCOL         = {{ gitea_protocol }}
+DOMAIN           = {{ gitea_http_domain }}
+ROOT_URL         = {{ gitea_root_url }}
+; The address to listen on. Either a IPv4/IPv6 address or the path to a unix socket.
+HTTP_ADDR        = {{ gitea_http_listen }}
+HTTP_PORT        = {{ gitea_http_port }}
+; Disable SSH feature when not available
+DISABLE_SSH      = false
+; Whether to use the builtin SSH server or not.
+START_SSH_SERVER = {{ gitea_start_ssh | ternary('true', 'false') }}
+; Domain name to be exposed in clone URL
+SSH_DOMAIN       = {{ gitea_ssh_domain }}
+; The network interface the builtin SSH server should listen on
+SSH_LISTEN_HOST  = {{ gitea_ssh_listen }}
+; Port number to be exposed in clone URL
+SSH_PORT         = {{ gitea_ssh_port }}
+; The port number the builtin SSH server should listen on
+SSH_LISTEN_PORT  = %(SSH_PORT)s
+; Disable CDN even in "prod" mode
+OFFLINE_MODE     = {{ gitea_offline_mode | ternary('true', 'false') }}
+; Default path for App data
+APP_DATA_PATH    = {{ gitea_home }}/data
+{% if gitea_lfs_server_enabled | bool -%}
+;Enables git-lfs support.
+LFS_START_SERVER = true
+; Where to store LFS files.
+LFS_CONTENT_PATH = {{ gitea_lfs_content_path }}
+; LFS authentication secret
+LFS_JWT_SECRET   = {{ gitea_lfs_secret }}
+{% endif %}
+
+[database]
+; Either "mysql", "postgres", "mssql" or "sqlite3", it's your choice
+DB_TYPE  = {{ gitea_db_type }}
+HOST     = {{ gitea_db_host }}
+NAME     = {{ gitea_db_name }}
+USER     = {{ gitea_db_user }}
+; Use PASSWD = `your password` for quoting if you use special characters in the password.
+PASSWD   = {{ gitea_db_password }}
+; For Postgres, either "disable" (default), "require", "verify-ca" or "verify-full"
+; For MySQL, either "false" (default), "true", or "skip-verify"
+SSL_MODE = {{ gitea_db_ssl }}
+; For "sqlite3" and "tidb", use an absolute path when you start gitea as service
+PATH     = {{ gitea_db_path }}
+
+[indexer]
+; Issue indexer storage path, available when ISSUE_INDEXER_TYPE is bleve
+ISSUE_INDEXER_PATH            = {{ gitea_home }}/indexers/issues.bleve
+; Issue indexer queue, currently support: channel or levelqueue, default is levelqueue
+ISSUE_INDEXER_QUEUE_TYPE      = levelqueue
+; When ISSUE_INDEXER_QUEUE_TYPE is levelqueue, this will be the queue will be saved path,
+; default is indexers/issues.queue
+ISSUE_INDEXER_QUEUE_DIR       = {{ gitea_home }}/indexers/issues.queue
+; repo indexer by default disabled, since it uses a lot of disk space
+REPO_INDEXER_ENABLED          = {{ gitea_repo_indexer_enabled }}
+REPO_INDEXER_PATH             = {{ gitea_home }}/indexers/repos.bleve
+REPO_INDEXER_INCLUDE          = {{ gitea_repo_indexer_include }}
+REPO_INDEXER_EXCLUDE          = {{ gitea_repo_indexer_exclude }}
+REPO_INDEXER_EXCLUDE_VENDORED = {{ gitea_repo_exclude_vendored }}
+MAX_FILE_SIZE                 = {{ gitea_repo_indexer_max_file_size }}
+
+[security]
+; Whether the installer is disabled
+INSTALL_LOCK        = true
+; !!CHANGE THIS TO KEEP YOUR USER DATA SAFE!!
+SECRET_KEY          = {{ gitea_secret_key }}
+INTERNAL_TOKEN      = {{ gitea_internal_token }}
+; How long to remember that an user is logged in before requiring relogin (in days)
+LOGIN_REMEMBER_DAYS = 7
+DISABLE_GIT_HOOKS   = {{ gitea_disable_git_hooks | ternary('true', 'false') }}
+
+[service]
+; Disallow registration, only allow admins to create accounts.
+DISABLE_REGISTRATION             = {{ gitea_disable_registration }}
+; User must sign in to view anything.
+REQUIRE_SIGNIN_VIEW              = {{ gitea_require_signin | ternary('true', 'false') }}
+; Enable captcha validation for registration
+ENABLE_CAPTCHA                   = {{ gitea_enable_captcha | ternary('true', 'false') }}
+; Type of captcha you want to use. Options: image, recaptcha
+CAPTCHA_TYPE                     = image
+; Enable recaptcha to use Google's recaptcha service
+; Go to https://www.google.com/recaptcha/admin to sign up for a key
+RECAPTCHA_SECRET                 =
+RECAPTCHA_SITEKEY                =
+; Show Registration button
+SHOW_REGISTRATION_BUTTON = {{ gitea_show_registration_button }}
+ALLOW_ONLY_EXTERNAL_REGISTRATION = {{ gitea_only_allow_external_registration }}
+ENABLE_NOTIFY_MAIL = {{ gitea_enable_notify_mail }}
+DEFAULT_EMAIL_NOTIFICATIONS       = {{ gitea_mail_default }} 
+AUTO_WATCH_NEW_REPOS              = {{ gitea_autowatch_new_repo }} 
+AUTO_WATCH_ON_CHANGES             = {{ gitea_autowatch_on_change }} 
+SHOW_MILESTONES_DASHBOARD_PAGE    = {{ gitea_show_mailstones_dashboard }} 
+
+[mailer]
+ENABLED            = {{ gitea_mailer_enabled | ternary('true', 'false') }}
+; Mail server
+; Gmail: smtp.gmail.com:587
+; QQ: smtp.qq.com:465
+; Note, if the port ends with "465", SMTPS will be used. Using STARTTLS on port 587 is recommended per RFC 6409. If the server supports STARTTLS it will always be used.
+HOST               = {{ gitea_mailer_host }}
+; Do not verify the certificate of the server. Only use this for self-signed certificates
+SKIP_VERIFY        = {{ gitea_mailer_skip_verify }}
+; Use client certificate
+USE_CERTIFICATE    = false
+CERT_FILE          = {{ gitea_home }}/custom/mailer/cert.pem
+KEY_FILE           = {{ gitea_home }}/custom/mailer/key.pem
+; Should SMTP connection use TLS
+IS_TLS_ENABLED     = {{ gitea_mailer_tls_enabled | ternary('true', 'false') }}
+; Mail from address, RFC 5322. This can be just an email address, or the `"Name" <email@example.com>` format
+FROM               = {{ gitea_mailer_from }}
+; Mailer user name and password
+USER               = {{ gitea_mailer_user }}
+; Use PASSWD = `your password` for quoting if you use special characters in the password.
+PASSWD             = {{ gitea_mailer_password }}
+; Send mails as plain text
+SEND_AS_PLAIN_TEXT = false
+; Set Mailer Type (either SMTP, sendmail or dummy to just send to the log)
+MAILER_TYPE        = {{ gitea_mailer_type }}
+; Specify an alternative sendmail binary
+SENDMAIL_PATH      = sendmail
+
+[session]
+; Either "memory", "file", or "redis", default is "memory"
+PROVIDER        = file
+; Provider config options
+; memory: doesn't have any config yet
+; file: session file path, e.g. `data/sessions`
+; redis: network=tcp,addr=:6379,password=macaron,db=0,pool_size=100,idle_timeout=180
+; mysql: go-sql-driver/mysql dsn config string, e.g. `root:password@/session_table`
+PROVIDER_CONFIG = {{ gitea_home }}/data/sessions
+
+[picture]
+AVATAR_UPLOAD_PATH = {{ gitea_home }}/data/avatars
+; This value will always be true in offline mode.
+DISABLE_GRAVATAR   = {{ gitea_disable_gravatar | ternary('true', 'false') }}
+
+[attachment]
+; Whether attachments are enabled. Defaults to `true`
+ENABLED = true
+; Path for attachments. Defaults to `data/attachments`
+PATH    = {{ gitea_home }}/data/attachments
+
+[log]
+ROOT_PATH            = {{ gitea_home }}/log
+; Either "console", "file", "conn", "smtp" or "database", default is "console"
+; Use comma to separate multiple modes, e.g. "console, file"
+MODE                 = file
+; Buffer length of the channel, keep it as it is if you don't know what it is.
+BUFFER_LEN           = 10000
+; Either "Trace", "Debug", "Info", "Warn", "Error", "Critical", default is "Trace"
+LEVEL                = {{ gitea_log_level }}
+REDIRECT_MACARON_LOG = false
+
+[oauth2]
+ENABLE     = {{ gitea_oauth2_enabled }}
+JWT_SECRET = {{ gitea_oauth2_jwt_secret }}
+
+[metrics]
+ENABLED = {{ gitea_metrics_enabled }}
+TOKEN   = {{ gitea_metrics_token }}
+
+{{ gitea_extra_config }}
\ No newline at end of file
diff --git a/templates/gitea.service.j2 b/templates/gitea.service.j2
new file mode 100644
index 0000000..7778653
--- /dev/null
+++ b/templates/gitea.service.j2
@@ -0,0 +1,24 @@
+# Example at https://github.com/go-gitea/gitea/blob/main/contrib/systemd/gitea.service
+[Unit]
+Description=Gitea (Git with a cup of tea)
+After=syslog.target
+After=network.target
+
+[Service]
+LimitNOFILE=524288:524288
+RestartSec=2s
+Type=simple
+User={{ gitea_user }}
+Group={{ gitea_group }}
+WorkingDirectory={{ gitea_home }}
+#
+ExecStart=/usr/local/bin/gitea web -c /etc/gitea/gitea.ini
+Restart=always
+#
+{% if gitea_systemd_cap_net_bind_service %}
+CapabilityBoundingSet=CAP_NET_BIND_SERVICE
+AmbientCapabilities=CAP_NET_BIND_SERVICE
+{% endif %}
+
+[Install]
+WantedBy=multi-user.target
\ No newline at end of file
diff --git a/tests/inventory b/tests/inventory
index 878877b..42e3b81 100644
--- a/tests/inventory
+++ b/tests/inventory
@@ -1,2 +1,2 @@
-localhost
+192.168.1.142
 
diff --git a/tests/test.yml b/tests/test.yml
index 964eaa2..5958ebf 100644
--- a/tests/test.yml
+++ b/tests/test.yml
@@ -1,5 +1,10 @@
 ---
-- hosts: localhost
+- hosts: all
   remote_user: root
   roles:
     - role-gitea
+  vars:
+    gitea_version: "1.18.0-rc1"
+    gitea_root_url: http://192.168.1.142:3000
+    gitea_http_listen: 0.0.0.0
+    gitea_http_domain: 192.168.1.142
\ No newline at end of file
diff --git a/vars/debian.yml b/vars/debian.yml
new file mode 100644
index 0000000..8fc28ff
--- /dev/null
+++ b/vars/debian.yml
@@ -0,0 +1,5 @@
+---
+gitea_dependencies:
+  - git
+  - gnupg2
+  - xz-utils
\ No newline at end of file
diff --git a/vars/main.yml b/vars/main.yml
index b03ab22..00c6617 100644
--- a/vars/main.yml
+++ b/vars/main.yml
@@ -1,2 +1,10 @@
 ---
-# vars file for role-gitea
+gitea_go_arch_map:
+  i386: '386'
+  x86_64: 'amd64'
+  aarch64: 'arm64'
+  armv7l: 'arm-6'
+  armv6l: 'arm-6'
+  armv5l: 'arm-5'
+
+gitea_arch: "{{ gitea_go_arch_map[ansible_architecture] | default(ansible_architecture) }}"
\ No newline at end of file