[P16] Replace docker exec gitea with Gitea API for password rotation #110

New Issue

kert · 2026-03-22T17:12:53Z

kert commented

2026-03-22 17:12:53 +00:00

Problem

provision_gitea() runs docker exec gitea gitea admin user change-password to change the admin password, then uses the Gitea HTTP API for token management. The docker exec part requires the Docker socket.

Fix

Gitea API supports PATCH /admin/users/{username} to change passwords. Replace the docker exec call with an API call using the current token (before rotation):

client.patch(
    f"/admin/users/{admin_user}",
    json={"password": new_pw, "must_change_password": False},
)

This requires the current admin token to still be valid, which it is — we create the new token before invalidating anything.

Acceptance criteria

provision_gitea() uses only HTTP API, no docker exec
Password change uses PATCH /admin/users/kert
Token rotation still works (delete stale, create fresh)
Existing tests updated
No Docker socket needed for Gitea provisioning

## Problem `provision_gitea()` runs `docker exec gitea gitea admin user change-password` to change the admin password, then uses the Gitea HTTP API for token management. The `docker exec` part requires the Docker socket. ## Fix Gitea API supports `PATCH /admin/users/{username}` to change passwords. Replace the `docker exec` call with an API call using the current token (before rotation): ```python client.patch( f"/admin/users/{admin_user}", json={"password": new_pw, "must_change_password": False}, ) ``` This requires the current admin token to still be valid, which it is — we create the new token before invalidating anything. ## Acceptance criteria - [ ] `provision_gitea()` uses only HTTP API, no `docker exec` - [ ] Password change uses `PATCH /admin/users/kert` - [ ] Token rotation still works (delete stale, create fresh) - [ ] Existing tests updated - [ ] No Docker socket needed for Gitea provisioning

kert added this to the P16: Provision Hardening — resilient credential rotation milestone 2026-03-22 17:12:53 +00:00

kert added the ci label 2026-03-22 17:12:53 +00:00

kert referenced this issue from a commit

2026-03-22 17:32:24 +00:00

harden provision: API-only Gitea, safe SQL, retry, Woodpecker sync

kert closed this issue

2026-03-22 17:32:24 +00:00

Sign in to join this conversation.