Update package version to 1.38.0

| datasource      | package        | from   | to     |
| --------------- | -------------- | ------ | ------ |
| github-releases | go-gitea/gitea | 1.25.5 | 1.26.0 |

CHANGELOG

@@ -1,5 +0,0 @@
-[0.1.0]
-* Initial package (forked from Gogs app)
-
-[0.1.1]
-* Removed reference to Gogs

CloudronManifest.json

@@ -4,38 +4,62 @@
   "author": "Gitea developers",
   "description": "file://DESCRIPTION.md",
   "tagline": "A painless self-hosted Git Service",
-  "version": "0.1.1",
+  "version": "1.38.0",
-  "healthCheckPath": "/healthcheck",
+  "upstreamVersion": "1.26.0",
+  "healthCheckPath": "/explore",
   "httpPort": 3000,
+  "memoryLimit": 536870912,
   "addons": {
-    "mysql": { },
+    "mysql": {},
-    "sendmail": { },
+    "sendmail": {
-    "localstorage": { },
+      "supportsDisplayName": true
-    "ldap": { }
+    },
+    "localstorage": {},
+    "oidc": {
+      "loginRedirectUri": "/user/oauth2/cloudron/callback"
+    }
   },
   "tcpPorts": {
     "SSH_PORT": {
       "title": "SSH Port",
       "description": "SSH Port over which repos can be pushed & pulled",
-      "defaultValue": 29418
+      "defaultValue": 29418,
+      "enabledByDefault": true
     }
   },
-  "manifestVersion": 1,
+  "manifestVersion": 2,
   "website": "https://gitea.io",
   "contactEmail": "apps@cloudron.io",
   "icon": "file://logo.png",
+  "optionalSso": true,
   "mediaLinks": [
-    "https://i.imgur.com/3iEQsux.jpg",
+    "https://screenshots.cloudron.io/io.gitea.cloudronapp/1.png",
-    "https://i.imgur.com/glqFnj8.jpg",
+    "https://screenshots.cloudron.io/io.gitea.cloudronapp/2.png",
-    "https://i.imgur.com/ad1FEpi.jpg",
+    "https://screenshots.cloudron.io/io.gitea.cloudronapp/3.png",
-    "https://i.imgur.com/q81EcGa.jpg",
+    "https://screenshots.cloudron.io/io.gitea.cloudronapp/4.png",
-    "https://i.imgur.com/L2CQeN0.jpg",
+    "https://screenshots.cloudron.io/io.gitea.cloudronapp/5.png"
-    "https://i.imgur.com/cNuvMum.jpg",
-    "https://i.imgur.com/xCYRqaF.jpg",
-    "https://i.imgur.com/ILpRBCe.jpg",
-    "https://i.imgur.com/0BHnrcL.jpg"
   ],
-  "tags": [ "version control", "git", "code hosting", "development" ],
+  "tags": [
-  "changelog": "file://CHANGELOG",
+    "version control",
-  "postInstallMessage": "file://POSTINSTALL.md"
+    "git",
+    "code hosting",
+    "development",
+    "github",
+    "bitbucket",
+    "gitlab"
+  ],
+  "changelog": "file://CHANGELOG.md",
+  "postInstallMessage": "file://POSTINSTALL.md",
+  "checklist": {
+    "change-default-password": {
+      "message": "Change the default admin password"
+    },
+    "disable-registration": {
+      "message": "Disable registration, if required, to prevent misuse",
+      "sso": false
+    }
+  },
+  "minBoxVersion": "9.0.0",
+  "forumUrl": "https://forum.cloudron.io/category/19/gitea",
+  "documentationUrl": "https://docs.cloudron.io/packages/gitea/"
 }

DESCRIPTION.md

@@ -1,6 +1,4 @@
-Gitea is a painless self-hosted Git service. It is similar to GitHub, Bitbucket or Gitlab. The initial development have been done on Gogs but we have forked it and named it Gitea. If you want to read more about the reasons why we have done that please read this blog post.
+Gitea is a painless self-hosted Git service. It is similar to GitHub, Bitbucket or Gitlab.
-
-This app packages Gitea <upstream>1.1.1</upstream>
 
 ### Purpose
 
@@ -20,9 +18,7 @@ The goal of this project is to make the easiest, fastest, and most painless way
 - Gravatar and custom source
 - Mail service
 - Administration panel
-- Supports MySQL, PostgreSQL, SQLite3 and [TiDB](https://github.com/pingcap/tidb) (experimental)
-- Multi-language support ([15 languages](https://crowdin.com/project/gogs))
 
 ### Bug reports
 
-Open bugs on [Github](https://git.cloudron.io/dswd/gitea-app/issues)
+Open bugs on [Github](https://git.cloudron.io/cloudron/gitea-app/issues)

Dockerfile

@@ -1,22 +1,27 @@
-FROM cloudron/base:0.10.0
+FROM cloudron/base:5.0.0@sha256:04fd70dbd8ad6149c19de39e35718e024417c3e01dc9c6637eaf4a41ec4e596c
-
-ENV VERSION 1.1.1
 
 RUN apt-get update && \
-    apt-get install -y openssh-server && \
+    apt-get install -y openssh-server git asciidoctor pandoc pipx && \
     rm -rf /etc/ssh_host_* && \
     rm -r /var/cache/apt /var/lib/apt/lists
 
+# pipx --global does not work, not sure why
+RUN PIPX_HOME=/opt/pipx PIPX_BIN_DIR=/usr/local/bin pipx install jupyter docutils --include-deps
+
 ADD supervisor/ /etc/supervisor/conf.d/
 
-RUN adduser --disabled-login --gecos 'Gitea' git
+RUN useradd --comment "Gogs" --create-home --shell /bin/bash git
-# by default, git account is created as inactive which prevents login via openssh
+RUN passwd -d git # by default, git account is created as inactive which prevents login via openssh. this disables password for account
-# https://github.com/gitlabhq/gitlabhq/issues/5304
+WORKDIR /home/git
-RUN passwd -d git
 
-RUN mkdir -p /home/git/gitea
+# for autosign feature
-## TODO: use redis as well
+ENV GNUPGHOME="/app/data/gnupg"
-RUN curl -L https://dl.gitea.io/gitea/${VERSION}/gitea-${VERSION}-linux-amd64 -o /home/git/gitea/gitea \
+
+# renovate: datasource=github-releases depName=go-gitea/gitea versioning=semver extractVersion=^v(?<version>.+)$
+ARG GITEA_VERSION=1.26.0
+
+RUN mkdir -p /home/git/gitea && \
+    curl -L https://github.com/go-gitea/gitea/releases/download/v${GITEA_VERSION}/gitea-${GITEA_VERSION}-linux-amd64 -o /home/git/gitea/gitea \
     && chmod +x /home/git/gitea/gitea
 
 # setup config paths
@@ -26,14 +31,12 @@ ADD app.ini.template /home/git/app.ini.template
 RUN mkdir -p /run/gitea && chown -R git:git /run/gitea
 RUN sed -e 's,^logfile=.*$,logfile=/run/gitea/supervisord.log,' -i /etc/supervisor/supervisord.conf
 
-RUN ln -s /app/data/ssh /home/git/.ssh
+RUN ln -s /app/data/ssh /home/git/.ssh && \
-RUN ln -s /app/data/gitconfig /home/git/.gitconfig
+    ln -s /app/data/gitconfig /home/git/.gitconfig
 
-ADD start.sh /home/git/start.sh
+COPY start.sh /home/git/
 
-# disable pam authentication for sshd
+COPY sshd_config /etc/ssh/sshd_config
-RUN sed -e 's/UsePAM yes/UsePAM no/' -e 's/UsePrivilegeSeparation yes/UsePrivilegeSeparation no/' -i /etc/ssh/sshd_config
-RUN echo "UseDNS no" >> /etc/ssh/sshd_config
 
 CMD [ "/home/git/start.sh" ]
 

POSTINSTALL.md

@@ -1,12 +1,9 @@
-This app integrates with the Cloudron SSO. Admins on Cloudron automatically
+This app is pre-setup with an admin account. The initial credentials are:
-become admins on Gitea.
 
-If you want to disable Cloudron SSO, do the following:
+**Username**: root<br/>
+**Password**: changeme<br/>
 
-* Admin Panel -> Authentication -> 'cloudron' -> Uncheck 'This authentication is activated'
+<sso>
-* Admin Panel -> Users -> Change Authentication Source to 'Local' and also give a password
+Use the `Local` authentication source for logging in as admin.
-
+</sso>
-You can create a `/app/data/app.ini` with any custom configuration. See the 
-[configuration cheat sheet](https://docs.gitea.io/en-us/config-cheat-sheet)
-for more information.
 

app.ini.template

@@ -2,7 +2,9 @@ APP_NAME = Gitea
 RUN_USER = git
 RUN_MODE = prod
 
+
 [database]
+; those settings are protected and can't be modified
 DB_TYPE = mysql
 HOST = ##MYSQL_HOST:##MYSQL_PORT
 NAME = ##MYSQL_DATABASE
@@ -11,7 +13,9 @@ PASSWD = ##MYSQL_PASSWORD
 SSL_MODE = disable
 PATH =
 
+
 [server]
+; those settings are protected and can't be modified
 PROTOCOL = http
 DOMAIN = ##DOMAIN
 ROOT_URL = https://%(DOMAIN)s/
@@ -20,55 +24,109 @@ HTTP_PORT = 3000
 DISABLE_SSH = ##DISABLE_SSH
 SSH_PORT = ##SSH_PORT
 APP_DATA_PATH = /app/data/appdata
+
 ; Landing page for non-logged users, can be "home" or "explore"
 LANDING_PAGE = explore
 
+
 [repository]
+; this setting is protected and can't be modified
 ROOT = /app/data/repository
+
 SCRIPT_TYPE = bash
 
+
 [repository.upload]
 ENABLED = true
+
+; this setting is protected and can't be modified
 TEMP_PATH = /run/gitea/tmp/uploads
 
+
 [release.attachment]
 ENABLED = true
 ; APP_DATA_PATH/attachments
 PATH =
 
+[oauth2_client]
+ENABLE_AUTO_REGISTRATION = true
+USERNAME = sub
+UPDATE_AVATAR = false
+ACCOUNT_LINKING = auto
+
 [mailer]
 ENABLED = true
-HOST = ##MAIL_SERVER:##MAIL_PORT
+
+; those settings are protected and can't be modified
+SMTP_ADDR = ##MAIL_SERVER
+SMTP_PORT = ##MAIL_PORT
 USER = ##MAIL_SMTP_USERNAME
 PASSWD = ##MAIL_SMTP_PASSWORD
 FROM = ##MAIL_FROM
-SKIP_VERIFY = true
+PROTOCOL = smtps
+FORCE_TRUST_SERVER_CERT = true
+
 
 [security]
+; those settings are protected and can't be modified
 INSTALL_LOCK = true
 SECRET_KEY = ##SECRET_KEY
+REVERSE_PROXY_LIMIT = 1
+REVERSE_PROXY_TRUSTED_PROXIES = *
 
 [service]
-DISABLE_REGISTRATION = false
+DISABLE_REGISTRATION = true
 SHOW_REGISTRATION_BUTTON = false
 ENABLE_NOTIFY_MAIL = true
 
+
 [log]
-; Either "console", "file", "conn", "smtp" or "database", default is "console"
+; those settings are protected and can't be modified
 MODE = console
 ; used for xorm.log
 ROOT_PATH = /run/gitea
 
+
 [picture]
 ; APP_DATA_PATH/avatars
 AVATAR_UPLOAD_PATH =
 GRAVATAR_SOURCE = gravatar
-DISABLE_GRAVATAR = false
 
 [attachment]
 ENABLE = true
 ; APP_DATA_PATH/attachments
 PATH =
 
+
 [indexer]
+; this setting is protected and can't be modified
 ISSUE_INDEXER_PATH = /app/data/appdata/indexers/issues.bleve
+
+[session]
+PROVIDER = file
+PROVIDER_CONFIG = /run/gitea/sessions
+COOKIE_SECURE = true
+COOKIE_NAME = cloudron_gitea
+GC_INTERVAL_TIME = 2592000
+
+[markup.asciidoc]
+ENABLED = true
+FILE_EXTENSIONS = .adoc,.asciidoc
+RENDER_COMMAND = "asciidoctor -s -a showtitle --out-file=- -"
+; Input is not a standard input but a file
+IS_INPUT_FILE = false
+
+[markup.restructuredtext]
+ENABLED = true
+FILE_EXTENSIONS = .rst
+RENDER_COMMAND = "timeout 30s pandoc +RTS -M512M -RTS -f rst"
+IS_INPUT_FILE = false
+
+[markup.jupyter]
+ENABLED = true
+FILE_EXTENSIONS = .ipynb
+RENDER_COMMAND = "jupyter nbconvert --stdin --stdout --to html --template basic"
+IS_INPUT_FILE = false
+
+[markup.sanitizer.jupyter.img]
+ALLOW_DATA_URI_IMAGES = true

renovate.json5

@@ -0,0 +1,4 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": ["local>devops/renovator//default.renovate.json5"]
+}

sshd_config

@@ -0,0 +1,37 @@
+Port 29418
+
+AddressFamily any
+ListenAddress 0.0.0.0
+ListenAddress ::
+
+HostKey /app/data/sshd/ssh_host_rsa_key
+HostKey /app/data/sshd/ssh_host_ecdsa_key
+HostKey /app/data/sshd/ssh_host_ed25519_key
+
+LogLevel INFO
+
+# no reverse DNS lookup
+UseDNS no
+UsePAM no
+AllowAgentForwarding no
+AllowTcpForwarding no
+PrintMotd no
+PrintLastLog no
+
+LoginGraceTime 120
+StrictModes yes
+PubkeyAuthentication yes
+PermitUserEnvironment yes
+PermitRootLogin no
+ChallengeResponseAuthentication no
+PasswordAuthentication no
+PermitEmptyPasswords no
+HostbasedAuthentication no
+
+AllowUsers git
+
+Banner none
+Subsystem sftp /usr/lib/ssh/sftp-server
+
+AcceptEnv GIT_PROTOCOL LANG LC_*
+

start.sh

@@ -2,30 +2,45 @@
 
 set -eu -o pipefail
 
-mkdir -p /run/gitea/tmp/uploads
+mkdir -p /run/gitea/tmp/uploads /run/sshd /run/gitea/sessions
 
-setup_ldap_source() {
+# CLOUDRON_OIDC_PROVIDER_NAME not supported as it will be used in rest route!
+setup_oidc_source() {
     set -eu
 
-    # Wait for gitea to finish db setup, before we insert ldap source in db
+    echo "==> Setup OIDC source"
-    while ! curl --fail http://localhost:3000/healthcheck; do
+
-        echo "Waiting for gitea to come up"
+    now=$(date +%s)
+    mysql -u"${CLOUDRON_MYSQL_USERNAME}" -p"${CLOUDRON_MYSQL_PASSWORD}" -h"${CLOUDRON_MYSQL_HOST}" -P"${CLOUDRON_MYSQL_PORT}" --database="${CLOUDRON_MYSQL_DATABASE}" -e \
+        "REPLACE INTO login_source (id, type, name, is_active, cfg, created_unix, updated_unix) VALUES (1,6,'cloudron', 1,'{\"Provider\":\"openidConnect\",\"ClientID\":\"${CLOUDRON_OIDC_CLIENT_ID}\",\"ClientSecret\":\"${CLOUDRON_OIDC_CLIENT_SECRET}\",\"OpenIDConnectAutoDiscoveryURL\":\"${CLOUDRON_OIDC_ISSUER}/.well-known/openid-configuration\",\"CustomURLMapping\":null,\"IconURL\":\"\",\"Scopes\":[\"openid email profile\"],\"RequiredClaimName\":\"\",\"RequiredClaimValue\":\"\",\"GroupClaimName\":\"\",\"AdminGroup\":\"\",\"GroupTeamMap\":\"\",\"GroupTeamMapRemoval\":false,\"RestrictedGroup\":\"\"}','${now}','${now}')"
+}
+
+setup_auth() {
+    set -eu
+
+    # Wait for gitea to finish db setup, before we do any db operations
+    while ! curl --fail http://localhost:3000/explore; do
+        echo "==> Waiting for gitea to come up"
         sleep 1
     done
 
-    now=$(date +%s)
+    echo "==> Gitea is up, setting up auth"
 
-    # Get the existing LDAP source status. This allows the user to disable LDAP
+    if [[ -n "${CLOUDRON_OIDC_ISSUER:-}" ]]; then
-    ldap_status=$(mysql -u"${MYSQL_USERNAME}" -p"${MYSQL_PASSWORD}" -h mysql --database="${MYSQL_DATABASE}" -N -B -e "select is_actived from login_source WHERE name='cloudron';")
+        setup_oidc_source
-    [[ -z "${ldap_status}" ]] && ldap_status="1"
+    fi
 
-    if mysql -u"${MYSQL_USERNAME}" -p"${MYSQL_PASSWORD}" -h mysql --database="${MYSQL_DATABASE}" \
+    user_count=$(mysql -u"${CLOUDRON_MYSQL_USERNAME}" -p"${CLOUDRON_MYSQL_PASSWORD}" -h"${CLOUDRON_MYSQL_HOST}" -P"${CLOUDRON_MYSQL_PORT}" --database="${CLOUDRON_MYSQL_DATABASE}" -N -B -e "SELECT count(*) FROM user")
-        -e "REPLACE INTO login_source (id, type, name, is_actived, cfg, created_unix, updated_unix) VALUES (1,2,'cloudron',${ldap_status},'{\"Name\":\"cloudron\",\"Host\":\"${LDAP_SERVER}\",\"Port\":${LDAP_PORT},\"UseSSL\":false,\"SkipVerify\":true,\"BindDN\":\"${LDAP_BIND_DN}\",\"BindPassword\":\"${LDAP_BIND_PASSWORD}\",\"UserBase\":\"${LDAP_USERS_BASE_DN}\",\"AttributeUsername\":\"username\",\"AttributeName\":\"displayname\",\"AttributeSurname\":\"\",\"AttributeMail\":\"mail\",\"Filter\":\"(\\\\u007C(mail=%[1]s)(username=%[1]s))\",\"AdminFilter\":\"(memberof=cn=admins,${LDAP_GROUPS_BASE_DN})\"}','${now}','${now}');"; then
+    # be careful, not to create root user for existing LDAP based installs
-        echo "LDAP Authentication was setup with status ${ldap_status}"
+    if [[ "${user_count}" == "0" ]]; then
+        echo "==> Setting up root user for first run"
+        if sudo -H -u git /home/git/gitea/gitea admin user create --username root --password changeme --email admin@cloudron.local --admin -c /run/gitea/app.ini; then
+            echo "==> root user added"
         else
-        echo "Failed to setup LDAP authentication"
+            echo "==> Failed to add root user"
             exit 1
         fi
+    fi
 }
 
 # SSH_PORT can be unset to disable SSH
@@ -50,35 +65,65 @@ fi
 chmod 0600 /app/data/sshd/*_key
 chmod 0644 /app/data/sshd/*.pub
 
-sed -e "s/^Port .*/Port ${SSH_PORT}/" \
+sed -e "s/^Port .*/Port ${SSH_PORT}/" /etc/ssh/sshd_config > /run/gitea/sshd_config
-    -e "s/^#ListenAddress .*/ListenAddress 0.0.0.0/" \
-    -e "s,^HostKey /etc/ssh/,HostKey /app/data/sshd/," \
-    /etc/ssh/sshd_config > /run/gitea/sshd_config
 
-sed -e "s/##DOMAIN/${APP_DOMAIN}/g" \
+if [[ ! -f /app/data/app.ini ]]; then
-    -e "s/##SSH_PORT/${SSH_PORT}/g" \
+    echo -e "; Add customizations here - https://docs.gitea.io/en-us/config-cheat-sheet/" > /app/data/app.ini
-    -e "s/##DISABLE_SSH/${disable_ssh}/g" \
-    -e "s/##MYSQL_HOST/${MYSQL_HOST}/g" \
-    -e "s/##MYSQL_PORT/${MYSQL_PORT}/g" \
-    -e "s/##MYSQL_USERNAME/${MYSQL_USERNAME}/g" \
-    -e "s/##MYSQL_PASSWORD/${MYSQL_PASSWORD}/g" \
-    -e "s/##MYSQL_DATABASE/${MYSQL_DATABASE}/g" \
-    -e "s/##MAIL_SERVER/${MAIL_SMTP_SERVER}/g" \
-    -e "s/##MAIL_PORT/${MAIL_SMTP_PORT}/g" \
-    -e "s/##MAIL_FROM/${MAIL_FROM}/g" \
-    -e "s/##MAIL_SMTP_USERNAME/${MAIL_SMTP_USERNAME}/g" \
-    -e "s/##MAIL_SMTP_PASSWORD/${MAIL_SMTP_PASSWORD}/g" \
-    -e "s/##SECRET_KEY/$(pwgen -1 -s)/g" \
-    /home/git/app.ini.template > "/run/gitea/app.ini"
 
-# merge any user config file
+    echo "==> Generating new SECRET_KEY"
-[[ -f /app/data/app.ini ]] && cat "/app/data/app.ini" >> "/run/gitea/app.ini"
+    crudini --set "/app/data/app.ini" security SECRET_KEY $(pwgen -1 -s)
 
-mkdir -p /app/data/repository /app/data/ssh
+    if [[ -z "${CLOUDRON_OIDC_ISSUER:-}" ]]; then
+        crudini --set "/app/data/app.ini" service DISABLE_REGISTRATION false
+        crudini --set "/app/data/app.ini" service SHOW_REGISTRATION_BUTTON true
+    fi
+fi
 
+# merge user config file
+cp /home/git/app.ini.template "/run/gitea/app.ini"
+crudini --merge "/run/gitea/app.ini" < "/app/data/app.ini"
+
+# override important values
+crudini --set "/run/gitea/app.ini" database DB_TYPE mysql
+crudini --set "/run/gitea/app.ini" database HOST "${CLOUDRON_MYSQL_HOST}:${CLOUDRON_MYSQL_PORT}"
+crudini --set "/run/gitea/app.ini" database NAME "${CLOUDRON_MYSQL_DATABASE}"
+crudini --set "/run/gitea/app.ini" database USER "${CLOUDRON_MYSQL_USERNAME}"
+crudini --set "/run/gitea/app.ini" database PASSWD "${CLOUDRON_MYSQL_PASSWORD}"
+crudini --set "/run/gitea/app.ini" database SSL_MODE "disable"
+crudini --set "/run/gitea/app.ini" server PROTOCOL "http"
+crudini --set "/run/gitea/app.ini" server DOMAIN "${CLOUDRON_APP_DOMAIN}"
+crudini --set "/run/gitea/app.ini" server ROOT_URL "https://%(DOMAIN)s/"
+crudini --set "/run/gitea/app.ini" server HTTP_ADDR ""
+crudini --set "/run/gitea/app.ini" server HTTP_PORT "3000"
+crudini --set "/run/gitea/app.ini" server DISABLE_SSH "${disable_ssh}"
+crudini --set "/run/gitea/app.ini" server SSH_PORT "${SSH_PORT}"
+crudini --set "/run/gitea/app.ini" server APP_DATA_PATH "/app/data/appdata"
+crudini --set "/run/gitea/app.ini" repository ROOT "/app/data/repository"
+crudini --set "/run/gitea/app.ini" repository.upload TEMP_PATH "/run/gitea/tmp/uploads"
+crudini --set "/run/gitea/app.ini" mailer SMTP_ADDR "${CLOUDRON_MAIL_SMTP_SERVER}"
+crudini --set "/run/gitea/app.ini" mailer SMTP_PORT "${CLOUDRON_MAIL_SMTPS_PORT}"
+crudini --set "/run/gitea/app.ini" mailer PROTOCOL smtps
+crudini --set "/run/gitea/app.ini" mailer USER "${CLOUDRON_MAIL_SMTP_USERNAME}"
+crudini --set "/run/gitea/app.ini" mailer PASSWD "${CLOUDRON_MAIL_SMTP_PASSWORD}"
+crudini --set "/run/gitea/app.ini" mailer FROM "${CLOUDRON_MAIL_FROM_DISPLAY_NAME:-Gitea} <${CLOUDRON_MAIL_FROM}>"
+crudini --set "/run/gitea/app.ini" mailer FORCE_TRUST_SERVER_CERT "true"
+crudini --set "/run/gitea/app.ini" security INSTALL_LOCK "true"
+crudini --set "/run/gitea/app.ini" security REVERSE_PROXY_LIMIT 1
+crudini --set "/run/gitea/app.ini" security REVERSE_PROXY_TRUSTED_PROXIES "*"
+crudini --set "/run/gitea/app.ini" log MODE "console"
+crudini --set "/run/gitea/app.ini" log ROOT_PATH "/run/gitea"
+crudini --set "/run/gitea/app.ini" indexer ISSUE_INDEXER_PATH "/app/data/appdata/indexers/issues.bleve"
+
+echo "==> Creating dirs and changing permissions"
+mkdir -p /app/data/repository /app/data/ssh /app/data/custom /app/data/gnupg
 chown -R git:git /app/data /run/gitea
 
-( setup_ldap_source ) &
+# OIDC creds are read from the db at gitea startup, so if migrations have already
+# run (i.e. the user table exists), refresh the OIDC source synchronously now.
+if mysql -u"${CLOUDRON_MYSQL_USERNAME}" -p"${CLOUDRON_MYSQL_PASSWORD}" -h"${CLOUDRON_MYSQL_HOST}" -P"${CLOUDRON_MYSQL_PORT}" --database="${CLOUDRON_MYSQL_DATABASE}" -N -B -e "SELECT count(*) FROM user" >/dev/null 2>&1; then
+    [[ -n "${CLOUDRON_OIDC_ISSUER:-}" ]] && setup_oidc_source
+else
+    ( setup_auth ) &
+fi
 
 exec /usr/bin/supervisord --configuration /etc/supervisor/supervisord.conf --nodaemon -i Gitea
-

supervisor/gitea.conf

@@ -9,4 +9,4 @@ stdout_logfile=/dev/stdout
 stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
-environment=HOME="/home/git",USER="git"
+environment=HOME="/home/git",USER="git",GITEA_CUSTOM="/app/data/custom"

supervisor/sshd.conf

@@ -8,4 +8,3 @@ stdout_logfile=/dev/stdout
 stdout_logfile_maxbytes=0
 stderr_logfile=/dev/stderr
 stderr_logfile_maxbytes=0
-

test/git_ssh_wrapper.sh

@@ -2,4 +2,4 @@
 
 readonly SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
-ssh -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i ${SCRIPT_DIR}/id_rsa "$@"
+ssh -o IdentitiesOnly=yes -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i ${SCRIPT_DIR}/id_ed25519 "$@"

test/id_ed25519

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACDECyFdxcmgOemNvs0wUhkgzfj9IS2OTG6bU5AXfNkXfgAAAJAoNQg/KDUI
+PwAAAAtzc2gtZWQyNTUxOQAAACDECyFdxcmgOemNvs0wUhkgzfj9IS2OTG6bU5AXfNkXfg
+AAAEC9nIZlzus9hn/b99E/cnSE2Vpycx0invItrrzgOX9qwMQLIV3FyaA56Y2+zTBSGSDN
++P0hLY5MbptTkBd82Rd+AAAADW5lYnVsb25AbHVuYXI=
+-----END OPENSSH PRIVATE KEY-----

test/id_ed25519.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMQLIV3FyaA56Y2+zTBSGSDN+P0hLY5MbptTkBd82Rd+ nebulon@lunar

test/id_rsa

@@ -1,27 +0,0 @@
------BEGIN RSA PRIVATE KEY-----
-MIIEowIBAAKCAQEA14L+HdwPXRHC2A+fyRv1FTsRE/OPl0Z0KnEigzIIdA65CzTy
-l3m3ATNFI1o/Ies7RW6rsr9UHuLLufNVg1NwIBdns8sPE4pSZSjfdPnznifIIs7y
-wL/vn2D3JEhpA8EOasSy0c+z+6X23evsLB3D81y7ICsBc16Q147WZ6D+QMUP+A4b
-wlmEcy0hAoPx/jnnPlRDVOK1ZnBvuAaHBkcBh+sA272BhB6Kv13MBu0wctDjKw5w
-cNmgVWbzBBtK1L8BZVMDKmKWZ2PKP4GkkpnAvkD0+4sdARe148faV8HHigAKKNN7
-vt+njs6nHuS4ksJL1E9cKGHdBJudJc3p24iI7QIDAQABAoIBABm5ojnQPek/KIIA
-A3PPKYc6QMSf60EEgPNcA+GjRE0OQNpsnJSmS8kR5KvepvCWksGr/0Tb/9+b9POi
-b0+40waRpKhakdckSMeYhGwDNihn2UUGbQXDI4hj27xyBE8VaXInPq063OIqInjF
-I7D0cKKJLDEf0RGDdUi13TQLjK4QX78W/9S8d5ClznAVi4wUBb1urs7fAoVetn/i
-PnlEj9KZHio4mCg28djTudAoWzjzUikRqKRYY5QNEJ13abVoLqIRSRHC1DzwpxVv
-Y88l4hmm6IcmWGo0O9lpu5IJFvEmngfpmyaVbeLE0fhLPFWcEHARw37SThTZVQeY
-Tx1816UCgYEA9j5dyNbFcC4YL9i9DQyut658bYziY2vsAvZNMMf249IJGbZOxlZK
-ylB00zlbO/2uNh12Y9z6BN2hO2lER3O3SM75tCnvXR0+qG+xmfjLcRVczEkU10+r
-8UxKBgg7Sf9uvfeONefEYPwiwzFoWgdaFSrR2sCmuoHPwfc9i+PSp+8CgYEA4Azq
-DToKdv6VBWPlNXT6OW3+HUPeHF087Ve03+3orCckZ+d2DImEOvWdt+pDeGQJJcq+
-o+SzZk9FjFOIiQehuA44OFrvcbag9YAlm1JQYYrRTdZEJz3iSucXCzJH/P5TrB84
-BHvzgCklZzZ0IpEFxzMe8oNS6XfJmilh6I98YOMCgYBybOy7xUGeLW1D3p2LENen
-t0dOyObyeFYF0lpwTpulphZgglz8wWCjvttqw/5nVCy+LNa09RyhYjPoHbSC13zW
-MofKdqoqRMq3DqAjAn/XHqwuqc8rdnRZ/q9vOigC7NWTJRRKbFbPEps8xRrOqxfr
-OiimVFul02ito6xP8yAStQKBgQDHbPdPup/h9wzx9U7p3Ct1vt/3cJddK+i1YeIP
-iBYYVebjzXSYCDd4u3MdZxmTKYey6dnyy/ibUmgXVassPWzHBXEpSFflIaf3nY7b
-x9LgX82ZuOSFAWJRRYyPXLwTBtW3WTplU2cUZotyaVfKBMfd3TToq9e7E/KQk9Eg
-Tcdp/QKBgCyKD1gGU/H1bsQOuWHuFR1v7v82V1DLVjyn5kllej0tlfTLO/5uUsEE
-SIjGHfTHxgpww9HN9BPyy8xdQMAc6p7UyvJAIyhg679AQBrMLLvhE5niaGu4jQOa
-ZVY6nZUQNCwgxJwnUkFnOyXDYjzjyxZOCAWPxghYbS+IEl1GzhZU
------END RSA PRIVATE KEY-----

test/id_rsa.pub

@@ -1 +0,0 @@
-ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXgv4d3A9dEcLYD5/JG/UVOxET84+XRnQqcSKDMgh0DrkLNPKXebcBM0UjWj8h6ztFbquyv1Qe4su581WDU3AgF2ezyw8TilJlKN90+fOeJ8gizvLAv++fYPckSGkDwQ5qxLLRz7P7pfbd6+wsHcPzXLsgKwFzXpDXjtZnoP5AxQ/4DhvCWYRzLSECg/H+Oec+VENU4rVmcG+4BocGRwGH6wDbvYGEHoq/XcwG7TBy0OMrDnBw2aBVZvMEG0rUvwFlUwMqYpZnY8o/gaSSmcC+QPT7ix0BF7Xjx9pXwceKAAoo03u+36eOzqce5LiSwkvUT1woYd0Em50lzenbiIjt girish@beast

test/package.json

@@ -1,24 +0,0 @@
-{
-  "name": "test",
-  "version": "1.0.0",
-  "description": "",
-  "main": "test.js",
-  "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
-  },
-  "author": "",
-  "license": "ISC",
-  "devDependencies": {
-    "ejs": "^2.3.4",
-    "expect.js": "^0.3.1",
-    "mkdirp": "^0.5.1",
-    "mocha": "^2.3.4",
-    "rimraf": "^2.4.4",
-    "superagent": "^1.4.0"
-  },
-  "dependencies": {
-    "selenium-server-standalone-jar": "^3.3.1",
-    "selenium-webdriver": "^3.3.0",
-    "superagent": "^1.8.5"
-  }
-}

test/test.js

@@ -1,299 +1,235 @@
 #!/usr/bin/env node
 
-/* jslint node:true */
+import assert from 'node:assert/strict';
-/* global it:false */
+import { execSync } from 'node:child_process';
-/* global xit:false */
+import fs from 'node:fs';
-/* global describe:false */
+import path from 'node:path';
-/* global before:false */
+import superagent from '@cloudron/superagent';
-/* global after:false */
+import {
+    app,
+    clearCache,
+    click,
+    cloudronCli,
+    executeScript,
+    goto,
+    loginOIDC,
+    scrollIntoView,
+    sendKeys,
+    setInputFiles,
+    setupBrowser,
+    takeScreenshot,
+    teardownBrowser,
+    username,
+    waitForElement,
+    waitForPath
+} from '@cloudron/charlie';
 
-'use strict';
+/* global it, describe, before, after, afterEach */
 
-var execSync = require('child_process').execSync,
+const SSH_PORT = 29420;
-    ejs = require('ejs'),
+const INSTALL_TCP_FLAGS = { SSH_PORT };
-    expect = require('expect.js'),
+const repodir = '/tmp/testrepo';
-    fs = require('fs'),
+const reponame = 'testrepo';
-    mkdirp = require('mkdirp'),
-    path = require('path'),
-    rimraf = require('rimraf'),
-    superagent = require('superagent'),
-    webdriver = require('selenium-webdriver');
-
-var by = require('selenium-webdriver').By,
-    until = require('selenium-webdriver').until,
-    Builder = require('selenium-webdriver').Builder;
-
-process.env.NODE_TLS_REJECT_UNAUTHORIZED = '0';
 
 describe('Application life cycle test', function () {
-    this.timeout(0);
+    before(setupBrowser);
-    var server, browser = new Builder().forBrowser('chrome').build();
+    after(async function () {
-    var LOCATION = 'test';
+        await teardownBrowser();
-    var repodir = '/tmp/testrepo';
+        fs.rmSync(repodir, { recursive: true, force: true });
-    var app, reponame = 'testrepo';
-    var username = process.env.USERNAME;
-    var password = process.env.PASSWORD;
-    var TIMEOUT = process.env.TIMEOUT || 5000;
-    var email, token;
-
-    before(function (done) {
-        if (!process.env.USERNAME) return done(new Error('USERNAME env var not set'));
-        if (!process.env.PASSWORD) return done(new Error('PASSWORD env var not set'));
-
-        var seleniumJar= require('selenium-server-standalone-jar');
-        var SeleniumServer = require('selenium-webdriver/remote').SeleniumServer;
-        server = new SeleniumServer(seleniumJar.path, { port: 4444 });
-        server.start();
-
-        done();
     });
 
-    after(function (done) {
+    afterEach(async function () {
-        browser.quit();
+        await takeScreenshot(this.currentTest.title);
-        server.stop();
-        rimraf.sync(repodir);
-        done();
     });
 
-    function waitForUrl(url, done) {
+    async function setAvatar() {
-        browser.wait(function () {
+        await goto(`https://${app.fqdn}/user/settings`, '//label[contains(text(), "Use Custom Avatar")]');
-            return browser.getCurrentUrl().then(function (currentUrl) {
+        await scrollIntoView('//label[contains(text(), "Use Custom Avatar")]');
-                return currentUrl === url;
+        await click('//label[contains(text(), "Use Custom Avatar")]');
-            });
+        await setInputFiles('//input[@type="file" and @name="avatar"]', path.resolve(import.meta.dirname, '../logo.png'));
-        }, TIMEOUT).then(function () { done(); });
+        await click('//button[contains(text(), "Update Avatar")]');
+        await waitForElement('//p[contains(text(),"Your avatar has been updated.")]');
     }
 
-    function setAvatar(done) {
+    async function checkAvatar() {
-        browser.get('https://' + app.fqdn + '/user/settings/avatar');
+        await goto(`https://${app.fqdn}/${username}`, '//div[@id="profile-avatar"]/a/img');
-
+        const avatarSrc = await executeScript(() => {
-        browser.findElement(by.xpath('//input[@type="file" and @name="avatar"]')).sendKeys(path.resolve(__dirname, '../logo.png')).then(function () {
+            const el = document.querySelector('#profile-avatar a img');
-            browser.findElement(by.xpath('//button[contains(text(), "Update Avatar Setting")]')).click();
+            return el ? el.getAttribute('src') : null;
-
-            browser.wait(until.elementLocated(by.xpath('//p[contains(text(),"updated successfully")]')), TIMEOUT).then(function () { done(); });
         });
+        assert.ok(avatarSrc);
+        const avatarUrl = new URL(avatarSrc, `https://${app.fqdn}`).href;
+        const response = await superagent.get(avatarUrl);
+        assert.strictEqual(response.status, 200);
     }
 
-    function checkAvatar(done) {
+    async function login(user, passwd) {
-        superagent.get('https://' + app.fqdn + '/avatars/a3e6f3316fc1738e29d621e6a26e93d3').end(function (error, result) {
+        await goto(`https://${app.fqdn}/user/login`, '#user_name');
-            expect(error).to.be(null);
+        await sendKeys('#user_name', user);
-            expect(result.statusCode).to.be(200);
+        await sendKeys('#password', passwd);
-            done();
+        await click('//form[@action="/user/login"]//button');
-        });
+        await waitForElement('//nav//img[contains(@class, "avatar")]');
     }
 
-    function editFile(done) {
+    async function adminLogin() {
-        browser.get('https://' + app.fqdn + '/' + username + '/' + reponame + '/_edit/master/newfile');
+        await login('root', 'changeme');
-
-        var cm = browser.findElement(by.xpath('//div[contains(@class,"CodeMirror")]'));
-        var text = 'yo';
-        browser.executeScript('arguments[0].CodeMirror.setValue("' + text + '");', cm).then(function () {
-            browser.findElement(by.xpath('//input[@name="commit_summary"]')).sendKeys('Dummy edit');
-            browser.findElement(by.xpath('//button[contains(text(), "Commit Changes")]')).click();
-
-            waitForUrl('https://' + app.fqdn + '/' + username + '/' + reponame + '/src/master/newfile', done);
-        });
     }
 
-    xit('build app', function () {
+    async function loginGiteaOIDC() {
-        execSync('cloudron build', { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+        await clearCache();
-    });
+        await goto(`https://${app.fqdn}/user/login`, '//a[@href="/user/oauth2/cloudron"]');
+        await click('//a[@href="/user/oauth2/cloudron"]');
+        await loginOIDC('//nav//img[contains(@class, "avatar")]');
+    }
 
-    it('can login', function (done) {
+    async function loginGiteaOIDCOld() {
-        var inspect = JSON.parse(execSync('cloudron inspect'));
+        await clearCache();
+        await goto(`https://${app.fqdn}/user/login`, '//a[contains(@class, "openidConnect")]');
+        await click('//a[contains(@class, "openidConnect") and contains(., "Sign in with cloudron")]');
+        await loginOIDC('//nav//img[contains(@class, "avatar")]');
+    }
 
-        superagent.post('https://' + inspect.apiEndpoint + '/api/v1/developer/login').send({
+    async function logout() {
-            username: username,
+        await goto(`https://${app.fqdn}`, '//nav//img[contains(@class, "avatar")]');
-            password: password
+        await click('//nav//img[contains(@class, "avatar")]');
-        }).end(function (error, result) {
+        await waitForElement('//a[@href="/user/logout"]');
-            if (error) return done(error);
+        await click('//a[@href="/user/logout"]');
-            if (result.statusCode !== 200) return done(new Error('Login failed with status ' + result.statusCode));
+    }
 
-            token = result.body.token;
+    async function addPublicKey() {
+        const keyPath = path.join(import.meta.dirname, 'id_ed25519');
+        fs.chmodSync(keyPath, 0o600);
 
-            superagent.get('https://' + inspect.apiEndpoint + '/api/v1/profile')
+        await goto(`https://${app.fqdn}/user/settings/keys`, '#add-ssh-button');
-                .query({ access_token: token }).end(function (error, result) {
+        await click('#add-ssh-button');
-                if (error) return done(error);
+        await sendKeys('#ssh-key-title', 'testkey');
-                if (result.statusCode !== 200) return done(new Error('Get profile failed with status ' + result.statusCode));
+        await sendKeys('#ssh-key-content', fs.readFileSync(`${import.meta.dirname}/id_ed25519.pub`, 'utf8').trim());
+        await scrollIntoView('//button[contains(text(), "Add Key")]');
+        await click('//form//button[contains(text(),"Add Key")]');
+        await waitForElement('//p[contains(text(), "has been added.")]');
+    }
 
-                email = result.body.email;
+    async function createRepo() {
-                done();
+        await goto(`https://${app.fqdn}/repo/create`, '#repo_name');
-            });
+        await sendKeys('#repo_name', reponame);
-        });
+        await scrollIntoView('//button[contains(text(), "Create Repository")]');
-    });
+        await click('#auto-init');
+        await click('//button[contains(text(), "Create Repository")]');
+        await waitForPath(`/${username}/${reponame}`);
+    }
 
+    function cloneRepo() {
+        fs.rmSync(repodir, { recursive: true, force: true });
+        const env = Object.create(process.env);
+        env.GIT_SSH = path.join(import.meta.dirname, 'git_ssh_wrapper.sh');
+        execSync(`git clone ssh://git@${app.fqdn}:${SSH_PORT}/${username}/${reponame}.git ${repodir}`, { env });
+    }
+
+    function pushFile() {
+        const env = Object.create(process.env);
+        env.GIT_SSH = path.join(import.meta.dirname, 'git_ssh_wrapper.sh');
+        execSync(
+            `touch newfile && git add newfile && git commit -a -mx && git push ssh://git@${app.fqdn}:${SSH_PORT}/${username}/${reponame} main`,
+            { env, cwd: repodir }
+        );
+        fs.rmSync(repodir, { recursive: true, force: true });
+    }
+
+    function fileExists() {
+        assert.strictEqual(fs.existsSync(`${repodir}/newfile`), true);
+    }
 
     it('install app', function () {
-        execSync('cloudron install --new --wait --location ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+        cloudronCli.install({ tcpPortFlags: INSTALL_TCP_FLAGS });
     });
 
-    it('can get app information', function () {
+    it('can admin login', adminLogin);
-        var inspect = JSON.parse(execSync('cloudron inspect'));
+    it('can logout', logout);
-
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION; })[0];
-
-        expect(app).to.be.an('object');
-    });
-
-    it('can get the main page', function (done) {
-        superagent.get('https://' + app.fqdn).end(function (error, result) {
-            expect(error).to.be(null);
-            expect(result.status).to.eql(200);
-
-            done();
-        });
-    });
-
-    it('can login', function (done) {
-        browser.get('https://' + app.fqdn + '/user/login');
-        browser.findElement(by.id('user_name')).sendKeys(username);
-        browser.findElement(by.id('password')).sendKeys(password);
-        browser.findElement(by.tagName('form')).submit();
-        browser.wait(until.elementLocated(by.linkText('Dashboard')), TIMEOUT).then(function () { done(); });
-    });
 
+    it('can login', loginGiteaOIDC);
     it('can set avatar', setAvatar);
     it('can get avatar', checkAvatar);
 
-    it('can add public key', function (done) {
+    it('can add public key', addPublicKey);
-        browser.get('https://' + app.fqdn + '/user/settings/ssh');
-        var publicKey = fs.readFileSync(__dirname + '/id_rsa.pub', 'utf8');
 
-        browser.findElement(by.xpath('//div[text()="Add Key"]')).click();
+    it('can create repo', createRepo);
-        browser.findElement(by.id('ssh-key-title')).sendKeys('testkey');
+
-        browser.findElement(by.id('ssh-key-content')).sendKeys(publicKey.trim()); // #3480
+    it('can clone the url', cloneRepo);
-        browser.findElement(by.xpath('//button[contains(text(), "Add Key")]')).click();
+
-        browser.wait(until.elementLocated(by.xpath('//p[contains(text(), "added successfully!")]')), TIMEOUT).then(function () { done(); });
+    it('can add and push a file', pushFile);
+
+    it('can restart app', function () {
+        cloudronCli.restart();
     });
 
-    it('can create repo', function (done) {
+    it('can clone the url', cloneRepo);
-        browser.get('https://' + app.fqdn);
+    it('file exists in repo', fileExists);
-        browser.findElement(by.linkText('New Repository')).click();
+
-        browser.wait(until.elementLocated(by.xpath('//*[contains(text(), "New Repository")]')), TIMEOUT);
+    it('backup app', async function () {
-        browser.findElement(by.id('repo_name')).sendKeys(reponame);
+        await cloudronCli.createBackup();
-        browser.findElement(by.id('auto-init')).click();
-        browser.findElement(by.xpath('//button[contains(text(), "Create Repository")]')).click();
-        browser.wait(function () {
-            return browser.getCurrentUrl().then(function (url) {
-                return url === 'https://' + app.fqdn + '/' + username + '/' + reponame;
     });
-        }, TIMEOUT).then(function () { done(); });
+    it('restore app', async function () {
-    });
+        await cloudronCli.restoreFromLatestBackup();
-
-    it('displays correct clone url', function (done) {
-        browser.get('https://' + app.fqdn + '/' + username + '/' + reponame);
-        browser.findElement(by.id('repo-clone-ssh')).click();
-        browser.findElement(by.id('repo-clone-url')).getAttribute('value').then(function (cloneUrl) {
-            expect(cloneUrl).to.be('ssh://git@' + app.fqdn + ':29418/' + username + '/' + reponame + '.git');
-            done();
-        });
-    });
-
-    it('can clone the url', function (done) {
-        var env = Object.create(process.env);
-        env.GIT_SSH = __dirname + '/git_ssh_wrapper.sh';
-        execSync('git clone ssh://git@' + app.fqdn + ':29418/' + username + '/' + reponame + '.git ' + repodir, { env: env });
-        done();
-    });
-
-    it('can add and push a file', function (done) {
-        var env = Object.create(process.env);
-        env.GIT_SSH = __dirname + '/git_ssh_wrapper.sh';
-        execSync('touch newfile && git add newfile && git commit -a -mx && git push ssh://git@' + app.fqdn + ':29418/' + username + '/' + reponame + ' master',
-                 { env: env, cwd: repodir });
-        rimraf.sync('/tmp/testrepo');
-        done();
-    });
-
-    it('can edit file', editFile);
-
-    it('can restart app', function (done) {
-        execSync('cloudron restart');
-        done();
-    });
-
-    it('can clone the url', function (done) {
-        var env = Object.create(process.env);
-        env.GIT_SSH = __dirname + '/git_ssh_wrapper.sh';
-        execSync('git clone ssh://git@' + app.fqdn + ':29418/' + username + '/' + reponame + '.git ' + repodir, { env: env });
-        expect(fs.existsSync(repodir + '/newfile')).to.be(true);
-        rimraf.sync(repodir);
-        done();
-    });
-
-    it('backup app', function () {
-        execSync('cloudron backup create --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
-    });
-
-    it('restore app', function () {
-        execSync('cloudron restore --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
     });
 
+    it('can login', loginGiteaOIDC);
     it('can get avatar', checkAvatar);
-
+    it('can clone the url', cloneRepo);
-    it('can clone the url', function (done) {
+    it('file exists in repo', function () {
-        var env = Object.create(process.env);
+        assert.strictEqual(fs.existsSync(`${repodir}/newfile`), true);
-        env.GIT_SSH = __dirname + '/git_ssh_wrapper.sh';
-        execSync('git clone ssh://git@' + app.fqdn + ':29418/' + username + '/' + reponame + '.git ' + repodir, { env: env });
-        expect(fs.existsSync(repodir + '/newfile')).to.be(true);
-        rimraf.sync(repodir);
-        done();
     });
 
-    it('move to different location', function () {
+    it('move to different location', async function () {
-        browser.manage().deleteAllCookies();
+        await cloudronCli.changeLocation();
-        execSync('cloudron configure --location ' + LOCATION + '2', { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
-        var inspect = JSON.parse(execSync('cloudron inspect'));
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION + '2'; })[0];
-        expect(app).to.be.an('object');
-    });
-
-    it('can login', function (done) {
-        browser.get('https://' + app.fqdn + '/user/login');
-        browser.findElement(by.id('user_name')).sendKeys(username);
-        browser.findElement(by.id('password')).sendKeys(password);
-        browser.findElement(by.tagName('form')).submit();
-        browser.wait(until.elementLocated(by.linkText('Dashboard')), TIMEOUT).then(function () { done(); });
     });
 
+    it('can login', loginGiteaOIDC);
     it('can get avatar', checkAvatar);
-
+    it('can clone the url', cloneRepo);
-    it('displays correct clone url', function (done) {
+    it('file exists in repo', function () {
-        browser.get('https://' + app.fqdn + '/' + username + '/' + reponame);
+        assert.strictEqual(fs.existsSync(`${repodir}/newfile`), true);
-        browser.findElement(by.id('repo-clone-ssh')).click();
-        browser.findElement(by.id('repo-clone-url')).getAttribute('value').then(function (cloneUrl) {
-            expect(cloneUrl).to.be('ssh://git@' + app.fqdn + ':29418/' + username + '/' + reponame + '.git');
-            done();
-        });
     });
 
-    it('can clone the url', function (done) {
+    it('uninstall app', async function () {
-        var env = Object.create(process.env);
+        await cloudronCli.uninstall();
-        env.GIT_SSH = __dirname + '/git_ssh_wrapper.sh';
-        execSync('git clone ssh://git@' + app.fqdn + ':29418/' + username + '/' + reponame + '.git ' + repodir, { env: env });
-        expect(fs.existsSync(repodir + '/newfile')).to.be(true);
-        rimraf.sync(repodir);
-        done();
     });
 
-    it('uninstall app', function () {
+    it('install app (no sso)', function () {
-        execSync('cloudron uninstall --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
+        cloudronCli.install({ noSso: true, tcpPortFlags: INSTALL_TCP_FLAGS });
     });
 
-    // check if the _first_ login via email succeeds
+    it('can admin login (no sso)', adminLogin);
-    it('can login via email', function (done) {
+    it('can logout', logout);
-        execSync('cloudron install --new --wait --location ' + LOCATION, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
-        var inspect = JSON.parse(execSync('cloudron inspect'));
 
-        app = inspect.apps.filter(function (a) { return a.location === LOCATION; })[0];
+    it('uninstall app (no sso)', async function () {
-        expect(app).to.be.an('object');
+        await cloudronCli.uninstall();
-
-        browser.get('https://' + app.fqdn + '/user/login');
-        browser.findElement(by.id('user_name')).sendKeys(email);
-        browser.findElement(by.id('password')).sendKeys(password);
-        browser.findElement(by.tagName('form')).submit();
-        browser.wait(until.elementLocated(by.linkText('Dashboard')), TIMEOUT).then(function () {
-            execSync('cloudron uninstall --app ' + app.id, { cwd: path.resolve(__dirname, '..'), stdio: 'inherit' });
-            done();
     });
+
+    it('can install app', function () {
+        cloudronCli.appstoreInstall({ tcpPortFlags: INSTALL_TCP_FLAGS });
+    });
+
+    it('can login', loginGiteaOIDCOld);
+    it('can set avatar', setAvatar);
+    it('can get avatar', checkAvatar);
+    it('can add public key', addPublicKey);
+    it('can create repo', createRepo);
+    it('can clone the url', cloneRepo);
+    it('can add and push a file', pushFile);
+
+    it('can update', async function () {
+        await cloudronCli.update();
+    });
+
+    it('can admin login', adminLogin);
+    it('can logout', logout);
+
+    it('can login', loginGiteaOIDC);
+    it('can get avatar', checkAvatar);
+    it('can clone the url', cloneRepo);
+    it('file exists in cloned repo', fileExists);
+
+    it('uninstall app', async function () {
+        await cloudronCli.uninstall();
     });
 });