meissa/c4k-forgejo
6
0
Fork 0
Code Issues Pull requests Projects Releases 27 Packages Wiki Activity
c4k-forgejo/doc/Upgrading.md

6.7 KiB
Raw Permalink Blame History

Upgrading process

adhoc (on kubernetes cluster)

Ssh into your kubernetes cluster running the forgejo instance.

kubectl edit configmap forgejo-env
# make sure INSTALL_LOCK under security is set to true to disable the installation screen
# save and exit
kubectl edit deployments forgejo
# search for your current forgejo version, e.g. 1.19
# replace with new version
# save and exit
kubectl scale deployment forgejo --replicas=0
kubectl scale deployment forgejo --replicas=1

Logging into the admin account should now show the new version. You may want to update your c4k-forgejo resources to reflect the changes made on the cluster.

Upgrading from 1.19

Config related issues with c4k-forgejo v3.2.2

These errors show in the log, when just upgrading to forgejo v7.0.4 from 1.19 without changing the config. The related config options are listed below the errors.

  • Oauth2: ENABLED instead of ENABLE
    • FORGEJO__oauth2__ENABLED: "true"
  • [E] Deprecated config option [log] ROUTER present. Use [log] logger.router.MODE instead.
    • FORGEJO__log_0x2E_logger_0x2E_router__MODE: console, file
  • [E] Deprecated config option [service] EMAIL_DOMAIN_WHITELIST present. Use [service] EMAIL_DOMAIN_ALLOWLIST instead.
    • FORGEJO__service__EMAIL_DOMAIN_ALLOWLIST: YOUR_ALLOW_LIST
  • [E] Deprecated config option [mailer] MAILER_TYPE present. Use [mailer] PROTOCOL instead.
  • [E] Deprecated fallback [mailer] PROTOCOL = smtp+startls present. Use [mailer] `PROTOCOL = smtp+starttls`` instead.
    • FORGEJO__mailer__PROTOCOL: smtp+starttls

Breaking Changes since 1.19

1.19.3 & 1.19.4: Version installed by c4k-forgejo v3.2.2

1.20.1-0: Breaking https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-20-1-0

app.ini
  • Check [queue] section - n/e
  • Check [repository.editor] - n/e
  • Check [storage] - n/e
  • Check ssh_keygen_path in app.ini - n/e
  • Is WORK_PATH set? Or app.ini writeable by forgejo server user?
      1. No
      1. Yes
      • If not, it shows in the logs starting with: Unable to update WORK_PATH
      • Also ssh pushing will likely fail
        • test ssh
  • Set logger.router.mode as described in environment-to-ini
  • Check [git.reflog] and maybe move to [git.config] - n/e
  • Check [indexer], [mailer], [repository] - n/e
tokens
  • Scoped and personal access tokens were refactored
    • Scope may change, if we have tokens they should be rotated

1.21.1-0: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#1-21-1-0

custom themes
  • Move to custom/public/assets/
git branches
  • /admin page and click run Sync missed branches from git data to databases.
db - mysql
  • c4k uses postgres
ssh server
  • We don't use host cert used for auth
ssh keys
  • All users need to check their key length, now 3072
tokens
  • Finer restrictions might now return 404 errors on users tokens in certain teams with certain restrictions

7.0.0: https://codeberg.org/forgejo/forgejo/src/branch/forgejo/RELEASE-NOTES.md#7-0-0

webhooks
  • Do we use webhooks?
db
  • Psql min ver is 12, c4k-common uses 14+
api
repos
app.ini
  • Check [ui] - n/e

Vor dem Upgrade

  • Host cert used for auth? - no
  • Do we use webhooks? - no
  • Do we use:
  • Do we have repo descriptions? - yes
    • There is now a sanitizer that only allows links, emphasis, code and emojis
    • Our repository descriptions are mostly plaintext and links

Upgrade plan

TEST indicates actions that only apply to the test server and are ignored in PROD. PROD indicates actions that only apply to the prod server and are ignored in TEST. See also the overview for upgrading: https://forgejo.org/docs/latest/admin/upgrade/

  • Set up Forgejo server with c4k-forgejo v3.2.2
    • Has Forgejo v1.19
  • TEST
    • Delete old remote ids
      • ssh-keygen -f "/home/${USER}/.ssh/known_hosts" -R "repo.test.meissa.de"
  • Ssh to server
  • Forgejo pod downscale
    • k scale deployment forgejo --replicas=0
  • Install lock off
    • k edit cm forgejo-env
    • Set to FORGEJO__security__INSTALL_LOCK: "false"
  • Forgejo pod upscale
    • k scale deployment forgejo --replicas=1
  • Create admin test or prod admin and install forgejo
    • gopass show server/meissa/forgejo-test bzw -prod
  • Forgejo pod downscale
  • Install lock on
    • Set to FORGEJO__security__INSTALL_LOCK: "true"
  • TEST
    • Forgejo pod upscale
    • Log in
    • Make Ssh keys
      • ed_xyz
      • rsa mit 2048
      • rsa mit 4096
    • Create repos
    • Forgejo pod downscale
  • PROD
    • Backup pod upscale
      • k scale deployment backup-restore --replicas=1
    • Restore backups
    • Delete or rename app.ini's in the pod
    • Backup pod downscale
      • k scale deployment backup-restore --replicas=0
  • Set image version to 7.0.4 in forgejo deployment
    • k edit deployment.apps forgejo
  • Update configmap:
    • Double check install lock enabled
    • FORGEJO__oauth2__ENABLED: "true"
    • FORGEJO__log_0x2E_logger_0x2E_router__MODE: console, file
    • FORGEJO__service__EMAIL_DOMAIN_ALLOWLIST:
    • FORGEJO__mailer__PROTOCOL: smtp+starttls
    • FORGEJO__federation__ENABLED: true
  • TEST
    • Backup pod upscale
    • Delete or rename app.ini's in the pod
    • Backup pod downscale
  • Forgejo pod upscale
  • Migrations happen automatically
  • /admin page and click run Sync missed branches from git data to databases
    • and *Sync missed tags ...
  • Rsa keys with size 2048 can not be added anymore. However, it seems they still can be used if they are on the server
  • Team members having app tokens need to recreate them with proper scopes
  • Add analytics: https://forgejo.org/docs/latest/admin/customization/