Gitea

Overview

The Gitea integration connects your Gitea instance (Gitea Cloud or self-hosted) to Oneleet, syncing every user on the instance as a user account asset. This lets Oneleet monitor who has access to your source code and whether they’re protected by two-factor authentication.

What does Oneleet monitor?

• Gitea users (user accounts), including each user’s role (site administrator, restricted or regular user), whether they can sign in, and whether they have two-factor authentication enabled

Setup

To set up the Gitea integration, navigate to Integrations > Add integration > Gitea.

Oneleet connects with a Gitea access token that has read-only admin and user permissions. Create it with a site administrator account, since only site administrators can list every user on the instance.

On Gitea Cloud, create the token on your instance itself, at the domain listed for it under Instances on cloud.gitea.com. The cloud.gitea.com console only manages instances and billing, so it has no Applications settings.

1. In Gitea, open your avatar menu, select Settings, and then Applications.
2. Under Manage Access Tokens, enter a Token Name and leave Repository and Organization Access on All.
3. Under Select permissions, set admin and user to Read, and leave every other permission on No Access.
4. Click Generate Token and copy the token. Gitea only shows it once.
5. In Oneleet, enter your instance domain without https:// (e.g. gitea.example.com, or gitea.example.com:3000 if it isn’t served on port 443), paste the token, and click Connect.

Troubleshooting

• Two-factor status shows as not applicable: Gitea only reports which users have two-factor authentication from version 1.26. On older versions Oneleet still lists users, but marks them as not applicable for the two-factor monitor. Upgrade Gitea to 1.26 or later.
• Requiring two-factor authentication for everyone: set TWO_FACTOR_AUTH = enforced in the [security] section of your instance’s app.ini. Gitea doesn’t expose this setting through its API, so Oneleet checks each user instead.
• Connecting fails for a private or internal instance: Oneleet only connects to instances at a public hostname. IP addresses and hostnames that resolve to private or internal addresses are rejected, and redirects aren’t followed. Expose the instance at a public hostname, for example through a reverse proxy.
• The integration disconnects: this happens when the token is deleted or its user loses site administrator rights. Create a new token and reconnect.