sloanops.admin/3031023-xyz-public
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Activate Gitea OAuth for CMS pilot

Browse Source
This commit is contained in:
Kevin
2026-09-04 01:01:12 -04:00
parent 7eeb9e1e01
commit 93090ecf87
3 changed files with 26 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/decap-cms-gitea-setup.md
+14 -15
View File
@@ -1,8 +1,8 @@
# Decap CMS pilot: unapplied Gitea settings
# Decap CMS pilot: Gitea settings
Status: repository-side review specification only. Nothing in this document
authorizes a Gitea restart, OAuth application creation, branch-protection
change, branch push, preview deployment, or merge.
Status: applied to the preview-only pilot on 2026-09-04. The stable preview,
narrow CORS policy, public PKCE OAuth application, and both branch-protection
rules are active. Nothing has been merged to `main`.
The repository implementation targets these fixed public values:
@@ -16,18 +16,17 @@ The repository implementation targets these fixed public values:
| Exact OAuth redirect URI | `https://cms-pilot-3031023-xyz-www.ksloan90.workers.dev/admin/` |
| Required status context | `CMS content validation / cms-content-validation (pull_request)` |
The predicted Workers alias must be confirmed after the first explicitly
approved preview deployment. If Cloudflare assigns a different stable origin,
The Workers alias was confirmed after the first approved preview deployment.
If Cloudflare later assigns a different stable origin,
update the repository configuration, CORS origin, and OAuth redirect URI
together through review before enabling login.
## Unapplied CORS change
## Applied CORS policy
The tracked Gitea service in
`/home/sloan/gitRepos/SloanOps/infrastructure/docker-compose.yml` currently has
no `[cors]` environment overrides. After separate approval, add these entries
to the existing `gitea.environment` list and redeploy only through the normal
infrastructure change process:
`/home/sloan/gitRepos/SloanOps/infrastructure/docker-compose.yml` contains
these entries in the existing `gitea.environment` list and was deployed
through the normal infrastructure change process:
```yaml
- GITEA__cors__ENABLED=true
@@ -59,10 +58,10 @@ headers. Repeat with an unrelated origin and confirm that Gitea does not grant
it cross-origin access. Also verify normal Git, web UI, API, and Actions
behavior before continuing.
## OAuth application to create later
## OAuth application
Create one Gitea OAuth2 application only after the stable preview origin and
CORS response have been reviewed:
The Gitea OAuth2 application was created after the stable preview origin and
CORS response were verified:
- Application name: `3031023.xyz Decap CMS pilot`.
- Confidential client: **unchecked**. The browser client must use PKCE.
@@ -80,7 +79,7 @@ The CMS account still needs repository write access; the branch rules below
are the security boundary that reduces that write access to pilot content and
media paths.
## Branch protection rules to apply together
## Applied branch protection rules
Create both rules before granting a CMS/client account write access or testing
login. Gitea uses only the first matching rule, so the order is material.