Prepare gated Gitea HTTPS and SSH cutover

ansible/roles/profile_atlas/defaults/main.yml

@@ -178,6 +178,10 @@ atlas_gitea_dataset: "{{ atlas_zfs_pool }}/services/data/gitea"
 atlas_gitea_mountpoint: "{{ atlas_app_data_mountpoint }}/gitea"
 atlas_gitea_quadlet_dir: "{{ atlas_gitea_home }}/.config/containers/systemd"
 atlas_gitea_image: docker.gitea.com/gitea:1.25.2-rootless
+atlas_gitea_production_enabled: false
+atlas_gitea_bind_address: "{{ ansible_host }}"
+atlas_gitea_http_port: 3000
+atlas_gitea_ssh_port: 2222
 atlas_gitea_staging_bind_address: 127.0.0.1
 atlas_gitea_staging_http_port: 3001
 atlas_gitea_staging_ssh_port: 2223

ansible/roles/profile_atlas/tasks/gitea.yml

@@ -14,10 +14,25 @@
           - atlas_gitea_gid | int != atlas_admin_gid | int
           - atlas_gitea_gid | int != atlas_immich_gid | int
           - atlas_gitea_staging_bind_address == '127.0.0.1'
+          - not (atlas_gitea_production_enabled | bool) or atlas_manage_firewall | bool
+          - not (atlas_gitea_production_enabled | bool) or atlas_gitea_bind_address == ansible_host
         fail_msg: >-
           Rootless Gitea preparation requires Atlas storage, an isolated service
           identity and dataset, and loopback-only staging ports.
 
+    - name: Inspect the final-restore marker before production activation
+      ansible.builtin.stat:
+        path: "{{ atlas_gitea_mountpoint }}/.final-sha256"
+      register: atlas_gitea_final_marker
+      when: atlas_gitea_production_enabled | bool
+
+    - name: Refuse production activation without the final consistent restore
+      ansible.builtin.assert:
+        that:
+          - atlas_gitea_final_marker.stat.isreg | default(false)
+        fail_msg: Restore the final stopped-source Gitea export before enabling production.
+      when: atlas_gitea_production_enabled | bool
+
     - name: Create the dedicated Gitea group
       ansible.builtin.group:
         name: "{{ atlas_gitea_group }}"
@@ -114,7 +129,7 @@
         state: started
       when: not ansible_check_mode
 
-    - name: Render the disabled rootless Gitea Quadlet
+    - name: Render the rootless Gitea Quadlet
       ansible.builtin.template:
         src: atlas-gitea.container.j2
         dest: "{{ atlas_gitea_quadlet_dir }}/atlas-gitea.container"
@@ -122,6 +137,20 @@
         group: "{{ atlas_gitea_group }}"
         mode: "0644"
 
+    - name: Permit only Aegis to reach production Gitea HTTP and SSH
+      ansible.posix.firewalld:
+        rich_rule: >-
+          rule family="ipv4" source address="{{ atlas_aegis_ip }}"
+          port port="{{ item }}" protocol="tcp" accept
+        zone: "{{ atlas_firewalld_zone }}"
+        state: "{{ 'enabled' if atlas_gitea_production_enabled | bool else 'disabled' }}"
+        permanent: true
+        immediate: true
+      loop:
+        - "{{ atlas_gitea_http_port }}"
+        - "{{ atlas_gitea_ssh_port }}"
+      when: atlas_manage_firewall | bool
+
     - name: Reload the rootless Gitea user manager without starting Gitea
       become_user: "{{ atlas_gitea_username }}"
       ansible.builtin.systemd:
@@ -131,3 +160,17 @@
         XDG_RUNTIME_DIR: "/run/user/{{ atlas_gitea_uid }}"
         DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_gitea_uid }}/bus"
       when: not ansible_check_mode
+
+    - name: Start and enable the rootless Gitea user Quadlet after final restore
+      become_user: "{{ atlas_gitea_username }}"
+      ansible.builtin.systemd:
+        name: atlas-gitea.service
+        scope: user
+        state: started
+        enabled: true
+      environment:
+        XDG_RUNTIME_DIR: "/run/user/{{ atlas_gitea_uid }}"
+        DBUS_SESSION_BUS_ADDRESS: "unix:path=/run/user/{{ atlas_gitea_uid }}/bus"
+      when:
+        - atlas_gitea_production_enabled | bool
+        - not ansible_check_mode

ansible/roles/profile_atlas/templates/atlas-gitea.container.j2

@@ -1,14 +1,19 @@
-# Managed by Ansible. Staging only: no [Install], no automatic start.
+# Managed by Ansible. Staging does not start automatically.
 [Unit]
-Description=Atlas rootless Gitea staging target
+Description=Atlas rootless Gitea
 RequiresMountsFor={{ atlas_gitea_mountpoint }}
 
 [Container]
 ContainerName=atlas-gitea
 Image={{ atlas_gitea_image }}
 UserNS=keep-id:uid=1000,gid=1000
+{% if atlas_gitea_production_enabled | bool %}
+PublishPort={{ atlas_gitea_bind_address }}:{{ atlas_gitea_http_port }}:3000
+PublishPort={{ atlas_gitea_bind_address }}:{{ atlas_gitea_ssh_port }}:2222
+{% else %}
 PublishPort={{ atlas_gitea_staging_bind_address }}:{{ atlas_gitea_staging_http_port }}:3000
 PublishPort={{ atlas_gitea_staging_bind_address }}:{{ atlas_gitea_staging_ssh_port }}:2222
+{% endif %}
 Volume={{ atlas_gitea_mountpoint }}/data:/var/lib/gitea:Z
 Volume={{ atlas_gitea_mountpoint }}/config:/etc/gitea:Z
 NoNewPrivileges=true
@@ -18,3 +23,8 @@ DropCapability=all
 Restart=on-failure
 RestartSec=10
 TimeoutStartSec=900
+{% if atlas_gitea_production_enabled | bool %}
+
+[Install]
+WantedBy=default.target
+{% endif %}