Configuration Cheat Sheet

This is a cheat sheet for the Gitea configuration file. It contains most of the settings that can be configured as well as their default values.

Any changes to the Gitea configuration file should be made in custom/conf/app.ini or any corresponding location. When installing from a distribution, this will typically be found at /etc/gitea/conf/app.ini .

The defaults provided here are best-effort (not built automatically). They are accurately recorded in app.example.ini (s/main/<tag|release>). Any string in the format %(X)s is a feature powered by ini , for reading values recursively.

In the default values below, a value in the form $XYZ refers to an environment variable. (However, see environment-to-ini .) Values in the form XxYyZz refer to values listed as part of the default configuration. These notation forms will not work in your own app.ini file and are only listed here as documentation.

Values containing # or ; must be quoted using ` or """ .

Note: A full restart is required for Gitea configuration changes to take effect.

Default Configuration (non- app.ini configuration) ​

These values are environment-dependent but form the basis of a lot of values. They will be reported as part of the default configuration when running gitea --help or on start-up. The order they are emitted there is slightly different but we will list them here in the order they are set-up.

In addition, there is StaticRootPath which can be set as a built-in at build time, but will otherwise default to AppWorkPath

Overall ( DEFAULT ) ​

Repository ( repository ) ​

Repository - Editor ( repository.editor ) ​

Repository - Pull Request ( repository.pull-request ) ​

Repository - Issue ( repository.issue ) ​

Repository - Upload ( repository.upload ) ​

Repository - Release ( repository.release ) ​

Repository - Signing ( repository.signing ) ​

Repository - Local ( repository.local ) ​

Repository - MIME type mapping ( repository.mimetype_mapping ) ​

Configuration for set the expected MIME type based on file extensions of downloadable files. Configuration presents in key-value pairs and file extensions starts with leading . .

The following configuration set Content-Type: application/vnd.android.package-archive header when downloading files with .apk file extension.

.apk=application/vnd.android.package-archive

CORS ( cors ) ​

UI ( ui ) ​

UI - Admin ( ui.admin ) ​

UI - User ( ui.user ) ​

UI - Metadata ( ui.meta ) ​

UI - Notification ( ui.notification ) ​

UI - SVG Images ( ui.svg ) ​

UI - CSV Files ( ui.csv ) ​

Markdown ( markdown ) ​

Server ( server ) ​

APP_DATA_PATH : AppWorkPath /data : This is the default root path for storing data.

PROTOCOL : http : [http, https, fcgi, http+unix, fcgi+unix]

USE_PROXY_PROTOCOL : false : Expect PROXY protocol headers on connections

PROXY_PROTOCOL_TLS_BRIDGING : false : When protocol is https, expect PROXY protocol headers after TLS negotiation.

PROXY_PROTOCOL_HEADER_TIMEOUT : 5s : Timeout to wait for PROXY protocol header (set to 0 to have no timeout)

PROXY_PROTOCOL_ACCEPT_UNKNOWN : false : Accept PROXY protocol headers with Unknown type.

DOMAIN : localhost : Domain name of this server.

ROOT_URL : %(PROTOCOL)s://%(DOMAIN)s:%(HTTP_PORT)s/ : Overwrite the automatically generated public URL. This is useful if the internal and the external URL don't match (e.g. in Docker).

STATIC_URL_PREFIX : empty : Overwrite this option to request static resources from a different URL. This includes CSS files, images, JS files and web fonts. Avatar images are dynamic resources and still served by Gitea. The option can be just a different path, as in /static , or another domain, as in https://cdn.example.com . Requests are then made as %(ROOT_URL)s/static/assets/css/index.css or https://cdn.example.com/assets/css/index.css respectively. The static files are located in the public/ directory of the Gitea source repository. You can proxy the STATIC_URL_PREFIX requests to Gitea server to serve the static assets, or copy the manually built Gitea assets from $GITEA_BUILD/public to the assets location, eg: /var/www/assets , make sure $STATIC_URL_PREFIX/assets/css/index.css points to /var/www/assets/css/index.css .

HTTP_ADDR : 0.0.0.0 : HTTP listen address.

HTTP_PORT : 3000 : HTTP listen port.

UNIX_SOCKET_PERMISSION : 666 : Permissions for the Unix socket.

LOCAL_ROOT_URL : %(PROTOCOL)s://%(HTTP_ADDR)s:%(HTTP_PORT)s/ : Local (DMZ) URL for Gitea workers (such as SSH update) accessing web service. In most cases you do not need to change the default value. Alter it only if your SSH server node is not the same as HTTP node. Do not set this variable if PROTOCOL is set to http+unix .

LOCAL_USE_PROXY_PROTOCOL : %(USE_PROXY_PROTOCOL)s : When making local connections pass the PROXY protocol header. This should be set to false if the local connection will go through the proxy.

PER_WRITE_TIMEOUT : 30s : Timeout for any write to the connection. (Set to -1 to disable all timeouts.)

PER_WRITE_PER_KB_TIMEOUT : 10s : Timeout per Kb written to connections.

DISABLE_SSH : false : Disable SSH feature when it's not available.

START_SSH_SERVER : false : When enabled, use the built-in SSH server.

SSH_SERVER_USE_PROXY_PROTOCOL : false : Expect PROXY protocol header on connections to the built-in SSH Server.

BUILTIN_SSH_SERVER_USER : %(RUN_USER)s : Username to use for the built-in SSH Server.

SSH_USER : %(BUILTIN_SSH_SERVER_USER)s : SSH username displayed in clone URLs. This is only for people who configure the SSH server themselves; in most cases, you want to leave this blank and modify the BUILTIN_SSH_SERVER_USER .

SSH_DOMAIN : %(DOMAIN)s : Domain name of this server, used for displayed clone URL.

SSH_PORT : 22 : SSH port displayed in clone URL.

SSH_LISTEN_HOST : 0.0.0.0 : Listen address for the built-in SSH server.

SSH_LISTEN_PORT : %(SSH_PORT)s : Port for the built-in SSH server.

SSH_ROOT_PATH : ~/.ssh : Root path of SSH directory.

SSH_CREATE_AUTHORIZED_KEYS_FILE : true : Gitea will create a authorized_keys file by default when it is not using the internal ssh server. If you intend to use the AuthorizedKeysCommand functionality then you should turn this off.

SSH_AUTHORIZED_KEYS_BACKUP : true : Enable SSH Authorized Key Backup when rewriting all keys, default is true.

SSH_TRUSTED_USER_CA_KEYS : empty : Specifies the public keys of certificate authorities that are trusted to sign user certificates for authentication. Multiple keys should be comma separated. E.g. ssh-<algorithm> <key> or ssh-<algorithm> <key1>, ssh-<algorithm> <key2> . For more information see TrustedUserCAKeys in the sshd config man pages. When empty no file will be created and SSH_AUTHORIZED_PRINCIPALS_ALLOW will default to off .

SSH_TRUSTED_USER_CA_KEYS_FILENAME : RUN_USER /.ssh/gitea-trusted-user-ca-keys.pem : Absolute path of the TrustedUserCaKeys file Gitea will manage. If you're running your own ssh server and you want to use the Gitea managed file you'll also need to modify your sshd_config to point to this file. The official docker image will automatically work without further configuration.

SSH_AUTHORIZED_PRINCIPALS_ALLOW : off or username, email : [off, username, email, anything]: Specify the principals values that users are allowed to use as principal. When set to anything no checks are done on the principal string. When set to off authorized principal are not allowed to be set.

SSH_CREATE_AUTHORIZED_PRINCIPALS_FILE : false/true : Gitea will create a authorized_principals file by default when it is not using the internal ssh server and SSH_AUTHORIZED_PRINCIPALS_ALLOW is not off .

SSH_AUTHORIZED_PRINCIPALS_BACKUP : false/true : Enable SSH Authorized Principals Backup when rewriting all keys, default is true if SSH_AUTHORIZED_PRINCIPALS_ALLOW is not off .

SSH_AUTHORIZED_KEYS_COMMAND_TEMPLATE : {{.AppPath}} --config={{.CustomConf}} serv key-{{.Key.ID}} : Set the template for the command to passed on authorized keys. Possible keys are: AppPath, AppWorkPath, CustomConf, CustomPath, Key - where Key is a models/asymkey.PublicKey and the others are strings which are shellquoted.

SSH_SERVER_CIPHERS : [email protected] , aes128-ctr, aes192-ctr, aes256-ctr, [email protected] , [email protected] : For the built-in SSH server, choose the ciphers to support for SSH connections, for system SSH this setting has no effect.

SSH_SERVER_KEY_EXCHANGES : curve25519-sha256, ecdh-sha2-nistp256, ecdh-sha2-nistp384, ecdh-sha2-nistp521, diffie-hellman-group14-sha256, diffie-hellman-group14-sha1 : For the built-in SSH server, choose the key exchange algorithms to support for SSH connections, for system SSH this setting has no effect.

SSH_SERVER_MACS : [email protected] , hmac-sha2-256, hmac-sha1 : For the built-in SSH server, choose the MACs to support for SSH connections, for system SSH this setting has no effect

SSH_SERVER_HOST_KEYS : ssh/gitea.rsa, ssh/gogs.rsa : For the built-in SSH server, choose the keypairs to offer as the host key. The private key should be at SSH_SERVER_HOST_KEY and the public SSH_SERVER_HOST_KEY.pub . Relative paths are made absolute relative to the APP_DATA_PATH . If no key exists a 4096 bit RSA key will be created for you.

SSH_KEY_TEST_PATH : /tmp : Directory to create temporary files in when testing public keys using ssh-keygen, default is the system temporary directory.

SSH_KEYGEN_PATH : empty : Use ssh-keygen to parse public SSH keys. The value is passed to the shell. By default, Gitea does the parsing itself.

SSH_EXPOSE_ANONYMOUS : false : Enable exposure of SSH clone URL to anonymous visitors, default is false.

SSH_PER_WRITE_TIMEOUT : 30s : Timeout for any write to the SSH connections. (Set to -1 to disable all timeouts.)

SSH_PER_WRITE_PER_KB_TIMEOUT : 10s : Timeout per Kb written to SSH connections.

MINIMUM_KEY_SIZE_CHECK : true : Indicate whether to check minimum key size with corresponding type.

OFFLINE_MODE : false : Disables use of CDN for static files and Gravatar for profile pictures.

CERT_FILE : https/cert.pem : Cert file path used for HTTPS. When chaining, the server certificate must come first, then intermediate CA certificates (if any). This is ignored if ENABLE_ACME=true . Paths are relative to CUSTOM_PATH .

KEY_FILE : https/key.pem : Key file path used for HTTPS. This is ignored if ENABLE_ACME=true . Paths are relative to CUSTOM_PATH .

STATIC_ROOT_PATH : StaticRootPath : Upper level of template and static files path.

APP_DATA_PATH : data ( /data/gitea on docker): Default path for application data. Relative paths will be made absolute against AppWorkPath .

STATIC_CACHE_TIME : 6h : Web browser cache time for static resources on custom/ , public/ and all uploaded avatars. Note that this cache is disabled when RUN_MODE is "dev".

ENABLE_GZIP : false : Enable gzip compression for runtime-generated content, static resources excluded.

ENABLE_PPROF : false : Application profiling (memory and cpu). For "web" command it listens on localhost:6060 . For "serv" command it dumps to disk at PPROF_DATA_PATH as (cpuprofile|memprofile)_<username>_<temporary id>

PPROF_DATA_PATH : AppWorkPath /data/tmp/pprof : PPROF_DATA_PATH , use an absolute path when you start Gitea as service

LANDING_PAGE : home : Landing page for unauthenticated users [home, explore, organizations, login, custom ]. Where custom would instead be any URL such as "/org/repo" or even https://anotherwebsite.com

LFS_START_SERVER : false : Enables Git LFS support.

LFS_CONTENT_PATH : %(APP_DATA_PATH)s/lfs : Default LFS content path. (if it is on local storage.) DEPRECATED use settings in [lfs] .

LFS_JWT_SECRET : empty : LFS authentication secret, change this a unique string.

LFS_HTTP_AUTH_EXPIRY : 24h : LFS authentication validity period in time.Duration, pushes taking longer than this may fail.

LFS_MAX_FILE_SIZE : 0 : Maximum allowed LFS file size in bytes (Set to 0 for no limit).

LFS_LOCKS_PAGING_NUM : 50 : Maximum number of LFS Locks returned per page.

REDIRECT_OTHER_PORT : false : If true and PROTOCOL is https, allows redirecting http requests on PORT_TO_REDIRECT to the https port Gitea listens on.

REDIRECTOR_USE_PROXY_PROTOCOL : %(USE_PROXY_PROTOCOL)s : expect PROXY protocol header on connections to https redirector.

PORT_TO_REDIRECT : 80 : Port for the http redirection service to listen on. Used when REDIRECT_OTHER_PORT is true.

SSL_MIN_VERSION : TLSv1.2 : Set the minimum version of ssl support.

SSL_MAX_VERSION : empty : Set the maximum version of ssl support.

SSL_CURVE_PREFERENCES : X25519,P256 : Set the preferred curves,

SSL_CIPHER_SUITES : ecdhe_ecdsa_with_aes_256_gcm_sha384,ecdhe_rsa_with_aes_256_gcm_sha384,ecdhe_ecdsa_with_aes_128_gcm_sha256,ecdhe_rsa_with_aes_128_gcm_sha256,ecdhe_ecdsa_with_chacha20_poly1305,ecdhe_rsa_with_chacha20_poly1305 : Set the preferred cipher suites.

ENABLE_ACME : false : Flag to enable automatic certificate management via an ACME capable Certificate Authority (CA) server (default: Lets Encrypt). If enabled, CERT_FILE and KEY_FILE are ignored, and the CA must resolve DOMAIN to this gitea server. Ensure that DNS records are set and either port 80 or port 443 are accessible by the CA server (the public internet by default), and redirected to the appropriate ports PORT_TO_REDIRECT or HTTP_PORT respectively.

ACME_URL : empty : The CA's ACME directory URL, e.g. for a self-hosted smallstep CA server , it can look like https://ca.example.com/acme/acme/directory . If left empty, it defaults to using Let's Encerypt's production CA (check LETSENCRYPT_ACCEPTTOS as well).

ACME_ACCEPTTOS : false : This is an explicit check that you accept the terms of service of the ACME provider. The default is Lets Encrypt terms of service .

ACME_DIRECTORY : https : Directory that the certificate manager will use to cache information such as certs and private keys.

ACME_EMAIL : empty : Email used for the ACME registration. Usually it is to notify about problems with issued certificates.

ACME_CA_ROOT : empty : The CA's root certificate. If left empty, it defaults to using the system's trust chain.

ALLOW_GRACEFUL_RESTARTS : true : Perform a graceful restart on SIGHUP

GRACEFUL_HAMMER_TIME : 60s : After a restart the parent process will stop accepting new connections and will allow requests to finish before stopping. Shutdown will be forced if it takes longer than this time.

STARTUP_TIMEOUT : 0 : Shutsdown the server if startup takes longer than the provided time. On Windows setting this sends a waithint to the SVC host to tell the SVC host startup may take some time. Please note startup is determined by the opening of the listeners - HTTP/HTTPS/SSH. Indexers may take longer to startup and can have their own timeouts.

Database ( database ) ​

Please see #8540 & #8273 for further discussion of the appropriate values for MAX_OPEN_CONNS , MAX_IDLE_CONNS & CONN_MAX_LIFETIME and their relation to port exhaustion.

Indexer ( indexer ) ​

ISSUE_INDEXER_TYPE : bleve : Issue indexer type, currently supported: bleve , db , elasticsearch or meilisearch .

ISSUE_INDEXER_CONN_STR : ****: Issue indexer connection string, available when ISSUE_INDEXER_TYPE is elasticsearch, or meilisearch. i.e. http://elastic:changeme@localhost:9200

ISSUE_INDEXER_NAME : gitea_issues : Issue indexer name, available when ISSUE_INDEXER_TYPE is elasticsearch

ISSUE_INDEXER_PATH : indexers/issues.bleve : Index file used for issue search; available when ISSUE_INDEXER_TYPE is bleve and elasticsearch. Relative paths will be made absolute against AppWorkPath .

REPO_INDEXER_ENABLED : false : Enables code search (uses a lot of disk space, about 6 times more than the repository size).

REPO_INDEXER_REPO_TYPES : sources,forks,mirrors,templates : Repo indexer units. The items to index could be sources , forks , mirrors , templates or any combination of them separated by a comma. If empty then it defaults to sources only, as if you'd like to disable fully please see REPO_INDEXER_ENABLED .

REPO_INDEXER_TYPE : bleve : Code search engine type, could be bleve or elasticsearch .

REPO_INDEXER_PATH : indexers/repos.bleve : Index file used for code search.

REPO_INDEXER_CONN_STR : ****: Code indexer connection string, available when REPO_INDEXER_TYPE is elasticsearch. i.e. http://elastic:changeme@localhost:9200

REPO_INDEXER_NAME : gitea_codes : Code indexer name, available when REPO_INDEXER_TYPE is elasticsearch

REPO_INDEXER_INCLUDE : empty : A comma separated list of glob patterns (see https://github.com/gobwas/glob ) to include in the index. Use **.txt to match any files with .txt extension. An empty list means include all files.

REPO_INDEXER_EXCLUDE : empty : A comma separated list of glob patterns (see https://github.com/gobwas/glob ) to exclude from the index. Files that match this list will not be indexed, even if they match in REPO_INDEXER_INCLUDE .

REPO_INDEXER_EXCLUDE_VENDORED : true : Exclude vendored files from index.

MAX_FILE_SIZE : 1048576 : Maximum size in bytes of files to be indexed.

STARTUP_TIMEOUT : 30s : If the indexer takes longer than this timeout to start - fail. (This timeout will be added to the hammer time above for child processes - as bleve will not start until the previous parent is shutdown.) Set to -1 to never timeout.

Queue ( queue and queue.* ) ​

Configuration at [queue] will set defaults for queues with overrides for individual queues at [queue.*] . (However see below.)

Gitea creates the following non-unique queues:

And the following unique queues:

Admin ( admin ) ​

Security ( security ) ​

Camo ( camo ) ​

OpenID ( openid ) ​

OAuth2 Client ( oauth2_client ) ​

Service ( service ) ​

Service - Explore ( service.explore ) ​

SSH Minimum Key Sizes ( ssh.minimum_key_sizes ) ​

Define allowed algorithms and their minimum key length (use -1 to disable a type):

Webhook ( webhook ) ​

Mailer ( mailer ) ​

⚠️ This section is for Gitea 1.18 and later. If you are using Gitea 1.17 or older, please refer to Gitea 1.17 app.ini example Gitea 1.17 configuration document

Incoming Email ( email.incoming ) ​

Cache ( cache ) ​

Cache - LastCommitCache settings ( cache.last_commit ) ​

Session ( session ) ​

Picture ( picture ) ​

GRAVATAR_SOURCE : gravatar : Can be gravatar , duoshuo or anything like http://cn.gravatar.com/avatar/ .

DISABLE_GRAVATAR : false : Enable this to use local avatars only. DEPRECATED [v1.18+] moved to database. Use admin panel to configure.

ENABLE_FEDERATED_AVATAR : false : Enable support for federated avatars (see http://www.libravatar.org ). DEPRECATED [v1.18+] moved to database. Use admin panel to configure.

AVATAR_STORAGE_TYPE : default : Storage type defined in [storage.xxx] . Default is default which will read [storage] if no section [storage] will be a type local .

AVATAR_UPLOAD_PATH : data/avatars : Path to store user avatar image files.

AVATAR_MAX_WIDTH : 4096 : Maximum avatar image width in pixels.

AVATAR_MAX_HEIGHT : 4096 : Maximum avatar image height in pixels.

AVATAR_MAX_FILE_SIZE : 1048576 (1MiB): Maximum avatar image file size in bytes.

AVATAR_MAX_ORIGIN_SIZE : 262144 (256KiB): If the uploaded file is not larger than this byte size, the image will be used as is, without resizing/converting.

AVATAR_RENDERED_SIZE_FACTOR : 2 : The multiplication factor for rendered avatar images. Larger values result in finer rendering on HiDPI devices.

REPOSITORY_AVATAR_STORAGE_TYPE : default : Storage type defined in [storage.xxx] . Default is default which will read [storage] if no section [storage] will be a type local .

REPOSITORY_AVATAR_UPLOAD_PATH : data/repo-avatars : Path to store repository avatar image files.

REPOSITORY_AVATAR_FALLBACK : none : How Gitea deals with missing repository avatars

REPOSITORY_AVATAR_FALLBACK_IMAGE : /img/repo_default.png : Image used as default repository avatar (if REPOSITORY_AVATAR_FALLBACK is set to image and none was uploaded)

Project ( project ) ​

Default templates for project boards:

Issue and pull request attachments ( attachment ) ​

Log ( log ) ​

Access Log ( log ) ​

Log subsections ( log.<writer-mode-name> ) ​

Console log mode ( log.console , or MODE=console ) ​

File log mode ( log.file , or MODE=file ) ​

Conn log mode ( log.conn , or MODE=conn ) ​

Cron ( cron ) ​

ENABLED : false : Enable to run all cron tasks periodically with default settings.

RUN_AT_START : false : Run cron tasks at application start-up.

NOTICE_ON_SUCCESS : false : Set to true to switch on success notices.

SCHEDULE accept formats

Basic cron tasks - enabled by default ​

Cron - Cleanup old repository archives ( cron.archive_cleanup ) ​

Cron - Update Mirrors ( cron.update_mirrors ) ​

Cron - Repository Health Check ( cron.repo_health_check ) ​

Cron - Repository Statistics Check ( cron.check_repo_stats ) ​

Cron - Cleanup hook_task Table ( cron.cleanup_hook_task_table ) ​

Cron - Cleanup expired packages ( cron.cleanup_packages ) ​

Cron - Update Migration Poster ID ( cron.update_migration_poster_id ) ​

Cron - Sync External Users ( cron.sync_external_users ) ​

Extended cron tasks (not enabled by default) ​

Cron - Garbage collect all repositories ( cron.git_gc_repos ) ​

Cron - Update the '.ssh/authorized_keys' file with Gitea SSH keys ( cron.resync_all_sshkeys ) ​

Cron - Resynchronize pre-receive, update and post-receive hooks of all repositories ( cron.resync_all_hooks ) ​

Cron - Reinitialize all missing Git repositories for which records exist ( cron.reinit_missing_repos ) ​

Cron - Delete all repositories missing their Git files ( cron.delete_missing_repos ) ​

Cron - Delete generated repository avatars ( cron.delete_generated_repository_avatars ) ​

Cron - Delete all old actions from database ( cron.delete_old_actions ) ​

Cron - Check for new Gitea versions ( cron.update_checker ) ​

Cron - Delete all old system notices from database ( cron.delete_old_system_notices ) ​

Cron - Garbage collect LFS pointers in repositories ( cron.gc_lfs ) ​

Git ( git ) ​

Git - Timeout settings ( git.timeout ) ​

Git - Config options ( git.config ) ​

The key/value pairs in this section will be used as git config. This section only does "set" config, a removed config key from this section won't be removed from git config automatically. The format is some.configKey = value .

Metrics ( metrics ) ​

API ( api ) ​

OAuth2 ( oauth2 ) ​

i18n ( i18n ) ​

Markup ( markup ) ​

Gitea can support Markup using external tools. The example below will add a markup named asciidoc .

[markup.asciidoc]
ENABLED = true
NEED_POSTPROCESS = true
FILE_EXTENSIONS = .adoc,.asciidoc
RENDER_COMMAND = "asciidoctor --embedded --safe-mode=secure --out-file=- -"
IS_INPUT_FILE = false

Two special environment variables are passed to the render command:

If RENDER_CONTENT_MODE is sanitized , Gitea supports customizing the sanitization policy for rendered HTML. The example below will support KaTeX output from pandoc.

[markup.sanitizer.TeX]
; Pandoc renders TeX segments as <span>s with the "math" class, optionally
; with "inline" or "display" classes depending on context.
ELEMENT = span
ALLOW_ATTR = class
REGEXP = ^\s*((math(\s+|$)|inline(\s+|$)|display(\s+|$)))+
ALLOW_DATA_URI_IMAGES = true

Multiple sanitisation rules can be defined by adding unique subsections, e.g. [markup.sanitizer.TeX-2] . To apply a sanitisation rules only for a specify external renderer they must use the renderer name, e.g. [markup.sanitizer.asciidoc.rule-1] . If the rule is defined above the renderer ini section or the name does not match a renderer it is applied to every renderer.

Highlight Mappings ( highlight.mapping ) ​

file_extension e.g. .toml : language e.g. ini . File extension to language mapping overrides.

Gitea will highlight files using the linguist-language or gitlab-language attribute from the .gitattributes file if available. If this is not set or the language is unavailable, the file extension will be looked up in this mapping or the filetype using heuristics.

Time ( time ) ​

Task ( task ) ​

Task queue configuration has been moved to queue.task . However, the below configuration values are kept for backwards compatibility:

Migrations ( migrations ) ​

Federation ( federation ) ​

WARNING: Changing the settings below can break federation.

Packages ( packages ) ​

Mirror ( mirror ) ​

LFS ( lfs ) ​

Storage configuration for lfs data. It will be derived from default [storage] or [storage.xxx] when set STORAGE_TYPE to xxx . When derived, the default of PATH is data/lfs and the default of MINIO_BASE_PATH is lfs/ .

Storage ( storage ) ​

Default storage configuration for attachments, lfs, avatars, repo-avatars, repo-archive, packages, actions_log, actions_artifact.

The recommanded storage configuration for minio like below:

[storage]
STORAGE_TYPE = minio
; Minio endpoint to connect only available when STORAGE_TYPE is `minio`
MINIO_ENDPOINT = localhost:9000
; Minio accessKeyID to connect only available when STORAGE_TYPE is `minio`
MINIO_ACCESS_KEY_ID =
; Minio secretAccessKey to connect only available when STORAGE_TYPE is `minio`
MINIO_SECRET_ACCESS_KEY =
; Minio bucket to store the attachments only available when STORAGE_TYPE is `minio`
MINIO_BUCKET = gitea
; Minio location to create bucket only available when STORAGE_TYPE is `minio`
MINIO_LOCATION = us-east-1
; Minio enabled ssl only available when STORAGE_TYPE is `minio`
MINIO_USE_SSL = false
; Minio skip SSL verification available when STORAGE_TYPE is `minio`
MINIO_INSECURE_SKIP_VERIFY = false
SERVE_DIRECT = true

Defaultly every storage has their default base path like below

And bucket, basepath or SERVE_DIRECT could be special or overrided, if you want to use a different you can:

[storage.actions_log]
MINIO_BUCKET = gitea_actions_log
SERVE_DIRECT = true
MINIO_BASE_PATH = my_actions_log/ ; default is actions_log/ if blank

If you want to customerize a different storage for lfs if above default storage defined

[lfs]
STORAGE_TYPE = my_minio

[storage.my_minio]
STORAGE_TYPE = minio
; Minio endpoint to connect only available when STORAGE_TYPE is `minio`
MINIO_ENDPOINT = localhost:9000
; Minio accessKeyID to connect only available when STORAGE_TYPE is `minio`
MINIO_ACCESS_KEY_ID =
; Minio secretAccessKey to connect only available when STORAGE_TYPE is `minio`
MINIO_SECRET_ACCESS_KEY =
; Minio bucket to store the attachments only available when STORAGE_TYPE is `minio`
MINIO_BUCKET = gitea
; Minio location to create bucket only available when STORAGE_TYPE is `minio`
MINIO_LOCATION = us-east-1
; Minio enabled ssl only available when STORAGE_TYPE is `minio`
MINIO_USE_SSL = false
; Minio skip SSL verification available when STORAGE_TYPE is `minio`
MINIO_INSECURE_SKIP_VERIFY = false

Repository Archive Storage ( storage.repo-archive ) ​

Configuration for repository archive storage. It will inherit from default [storage] or [storage.xxx] when set STORAGE_TYPE to xxx . The default of PATH is data/repo-archive and the default of MINIO_BASE_PATH is repo-archive/ .

Repository Archives ( repo-archive ) ​

Proxy ( proxy ) ​

PROXY_ENABLED = true
PROXY_URL = socks://127.0.0.1:1080
PROXY_HOSTS = *.github.com

Actions ( actions ) ​

DEFAULT_ACTIONS_URL indicates where the Gitea Actions runners should find the actions with relative path. For example, uses: actions/checkout@v3 means https://github.com/actions/checkout@v3 since the value of DEFAULT_ACTIONS_URL is github . And it can be changed to self to make it root_url_of_your_gitea/actions/checkout@v3 .

Please note that using self is not recommended for most cases, as it could make names globally ambiguous. Additionally, it requires you to mirror all the actions you need to your Gitea instance, which may not be worth it. Therefore, please use self only if you understand what you are doing.

In earlier versions ( <= 1.19 ), DEFAULT_ACTIONS_URL cound be set to any custom URLs like https://gitea.com or http://your-git-server,https://gitea.com , and the default value was https://gitea.com . However, later updates removed those options, and now the only options are github and self , with the default value being github . However, if you want to use actions from other git server, you can use a complete URL in uses field, it's supported by Gitea (but not GitHub). Like uses: https://gitea.com/actions/checkout@v3 or uses: http://your-git-server/actions/checkout@v3 .

Other ( other ) ​