Confidentialite¶

curl -X POST "https://gitea.example.com/api/v1/repos/mon-org/mon-repo/branch_protections" \
  -H "Content-Type: application/json" \
  -H "Authorization: token ${GITEA_ADMIN_TOKEN}" \
  -d '{
    "branch_name": "main",
    "enable_push": false,
    "enable_push_whitelist": true,
    "push_whitelist_usernames": [],
    "require_signed_commits": true,
    "required_approvals": 1,
    "enable_status_check": true,
    "status_check_contexts": ["ci/build", "ci/test"],
    "block_on_rejected_reviews": true,
    "block_on_outdated_branch": true,
    "dismiss_stale_approvals": true
  }'

# Generer une cle de signature SSH
ssh-keygen -t ed25519 -C "dev@example.com" -f ~/.ssh/signing_key

# Configurer Git pour signer avec SSH
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/signing_key.pub
git config --global commit.gpgsign true
git config --global tag.gpgsign true

# Generer une cle GPG
gpg --full-generate-key

# Configurer Git
git config --global user.signingkey ABCDEF1234567890
git config --global commit.gpgsign true

#!/bin/bash
# backup-gitea.sh
set -euo pipefail

BACKUP_DIR="/srv/backups/gitea/$(date +%Y-%m-%d)"
ENCRYPTION_KEY="/etc/gitea/backup.key"

mkdir -p "${BACKUP_DIR}"

# 1. Sauvegarde PostgreSQL
podman exec gitea-postgres pg_dump -U gitea gitea | \
  gzip | \
  openssl enc -aes-256-cbc -salt -pbkdf2 -pass file:"${ENCRYPTION_KEY}" \
  > "${BACKUP_DIR}/postgres.sql.gz.enc"

# 2. Sauvegarde Gitea (depots + config)
podman exec gitea gitea dump -c /data/gitea/conf/app.ini -f /tmp/gitea-dump.zip
podman cp gitea:/tmp/gitea-dump.zip "${BACKUP_DIR}/"
openssl enc -aes-256-cbc -salt -pbkdf2 -pass file:"${ENCRYPTION_KEY}" \
  -in "${BACKUP_DIR}/gitea-dump.zip" \
  -out "${BACKUP_DIR}/gitea-dump.zip.enc"
rm "${BACKUP_DIR}/gitea-dump.zip"

# 3. Nettoyage des sauvegardes > 30 jours
find /srv/backups/gitea/ -maxdepth 1 -type d -mtime +30 -exec rm -rf {} +

echo "Sauvegarde terminee : ${BACKUP_DIR}"

#!/bin/bash
# .git/hooks/pre-commit
# Detecter les patterns de secrets courants

PATTERNS=(
  'AKIA[0-9A-Z]{16}'           # AWS Access Key
  'ghp_[a-zA-Z0-9]{36}'        # GitHub Personal Token
  'glpat-[a-zA-Z0-9\-]{20}'    # GitLab Personal Token
  'sk-[a-zA-Z0-9]{48}'         # OpenAI API Key
  'password\s*=\s*["\x27].+'   # Mot de passe en clair
  'PRIVATE KEY'                 # Cle privee
)

for pattern in "${PATTERNS[@]}"; do
  if git diff --cached --diff-filter=ACM | grep -qP "${pattern}"; then
    echo "ERREUR : Secret detecte dans le commit (pattern: ${pattern})"
    echo "Utilisez un gestionnaire de secrets (Vault, .env) au lieu de commiter des secrets."
    exit 1
  fi
done

#!/bin/bash
# hooks/pre-receive
while read oldrev newrev refname; do
  DIFF=$(git diff --diff-filter=ACM "${oldrev}..${newrev}" 2>/dev/null || git diff-tree -r --diff-filter=ACM "${newrev}")
  if echo "${DIFF}" | grep -qP 'AKIA[0-9A-Z]{16}|PRIVATE KEY|password\s*='; then
    echo "REJECTED: Secret detected in push to ${refname}"
    exit 1
  fi
done