SSH Push/Pull Mirroring & Migrations

services/migrations/migrate.go

@@ -71,7 +71,7 @@ func IsMigrateURLAllowed(remoteURL string, doer *user_model.User) error {
 		return &git.ErrInvalidCloneAddr{Host: u.Host, IsURLError: true}
 	}
 
-	if u.Opaque != "" || u.Scheme != "" && u.Scheme != "http" && u.Scheme != "https" && u.Scheme != "git" {
+	if u.Opaque != "" || u.Scheme != "" && u.Scheme != "http" && u.Scheme != "https" && u.Scheme != "git" && u.Scheme != "ssh" {
 		return &git.ErrInvalidCloneAddr{Host: u.Host, IsProtocolInvalid: true, IsPermissionDenied: true, IsURLError: true}
 	}
 

services/mirror/mirror_pull.go

@@ -22,6 +22,7 @@ import (
 	"code.gitea.io/gitea/modules/proxy"
 	repo_module "code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/setting"
+	ssh_module "code.gitea.io/gitea/modules/ssh"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
 	notify_service "code.gitea.io/gitea/services/notify"
@@ -254,6 +255,36 @@ func checkRecoverableSyncError(stderrMessage string) bool {
 }
 
 // runSync returns true if sync finished without error.
+// setupSSHAuth sets up SSH authentication for git operations if needed
+func setupSSHAuth(ctx context.Context, repo *repo_model.Repository, remoteURL string, runOpts *git.RunOpts) (func(), error) {
+	if !IsSSHURL(remoteURL) {
+		return func() {}, nil
+	}
+
+	keypair, err := GetSSHKeypairForURL(ctx, repo, remoteURL)
+	if err != nil {
+		return nil, fmt.Errorf("failed to get SSH keypair: %w", err)
+	}
+	if keypair == nil {
+		return func() {}, nil
+	}
+
+	privateKey, err := keypair.GetDecryptedPrivateKey()
+	if err != nil {
+		return nil, fmt.Errorf("failed to decrypt private key: %w", err)
+	}
+
+	socketPath, cleanup, err := ssh_module.CreateTemporaryAgent(privateKey)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create SSH agent: %w", err)
+	}
+
+	runOpts.SSHAuthSock = socketPath
+
+	log.Debug("SSH agent created for repository %s with socket: %s", repo.FullName(), socketPath)
+	return cleanup, nil
+}
+
 func runSync(ctx context.Context, m *repo_model.Mirror) ([]*mirrorSyncResult, bool) {
 	repoPath := m.Repo.RepoPath()
 	wikiPath := m.Repo.WikiPath()
@@ -278,13 +309,23 @@ func runSync(ctx context.Context, m *repo_model.Mirror) ([]*mirrorSyncResult, bo
 
 	stdoutBuilder := strings.Builder{}
 	stderrBuilder := strings.Builder{}
-	if err := cmd.Run(ctx, &git.RunOpts{
+
+	runOpts := &git.RunOpts{
 		Timeout: timeout,
 		Dir:     repoPath,
 		Env:     envs,
 		Stdout:  &stdoutBuilder,
 		Stderr:  &stderrBuilder,
-	}); err != nil {
+	}
+
+	cleanup, err := setupSSHAuth(ctx, m.Repo, remoteURL.String(), runOpts)
+	if err != nil {
+		log.Error("SyncMirrors [repo: %-v]: SSH setup error %v", m.Repo, err)
+		return nil, false
+	}
+	defer cleanup()
+
+	if err := cmd.Run(ctx, runOpts); err != nil {
 		stdout := stdoutBuilder.String()
 		stderr := stderrBuilder.String()
 
@@ -303,12 +344,21 @@ func runSync(ctx context.Context, m *repo_model.Mirror) ([]*mirrorSyncResult, bo
 				// Successful prune - reattempt mirror
 				stderrBuilder.Reset()
 				stdoutBuilder.Reset()
-				if err = cmd.Run(ctx, &git.RunOpts{
+				retryRunOpts := &git.RunOpts{
 					Timeout: timeout,
 					Dir:     repoPath,
 					Stdout:  &stdoutBuilder,
 					Stderr:  &stderrBuilder,
-				}); err != nil {
+				}
+
+				retryCleanup, sshErr := setupSSHAuth(ctx, m.Repo, remoteURL.String(), retryRunOpts)
+				if sshErr != nil {
+					log.Error("SyncMirrors [repo: %-v]: SSH setup error on retry %v", m.Repo, sshErr)
+					return nil, false
+				}
+				defer retryCleanup()
+
+				if err = cmd.Run(ctx, retryRunOpts); err != nil {
 					stdout := stdoutBuilder.String()
 					stderr := stderrBuilder.String()
 

services/mirror/mirror_push.go

@@ -21,6 +21,7 @@ import (
 	"code.gitea.io/gitea/modules/proxy"
 	"code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/setting"
+	ssh_module "code.gitea.io/gitea/modules/ssh"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
 )
@@ -97,7 +98,10 @@ func SyncPushMirror(ctx context.Context, mirrorID int64) bool {
 		return false
 	}
 
-	_ = m.GetRepository(ctx)
+	if m.GetRepository(ctx) == nil {
+		log.Error("GetRepository [%d]: repository not found", mirrorID)
+		return false
+	}
 
 	m.LastError = ""
 
@@ -138,7 +142,7 @@ func runPushSync(ctx context.Context, m *repo_model.PushMirror) error {
 			return errors.New("Unexpected error")
 		}
 
-		if setting.LFS.StartServer {
+		if setting.LFS.StartServer && !IsSSHURL(remoteURL.String()) {
 			log.Trace("SyncMirrors [repo: %-v]: syncing LFS objects...", m.Repo)
 
 			var gitRepo *git.Repository
@@ -163,13 +167,48 @@ func runPushSync(ctx context.Context, m *repo_model.PushMirror) error {
 		log.Trace("Pushing %s mirror[%d] remote %s", path, m.ID, m.RemoteName)
 
 		envs := proxy.EnvWithProxy(remoteURL.URL)
-		if err := git.Push(ctx, path, git.PushOptions{
+
+		pushOpts := git.PushOptions{
 			Remote:  m.RemoteName,
 			Force:   true,
 			Mirror:  true,
 			Timeout: timeout,
 			Env:     envs,
-		}); err != nil {
+		}
+
+		// Setup SSH authentication
+		if IsSSHURL(remoteURL.String()) {
+			if repo.Owner == nil {
+				if err := repo.LoadOwner(ctx); err != nil {
+					log.Error("Failed to load repository owner for %s: %v", repo.FullName(), err)
+					return util.SanitizeErrorCredentialURLs(err)
+				}
+			}
+			keypair, err := GetSSHKeypairForRepository(ctx, repo)
+			if err != nil {
+				log.Error("Failed to get SSH keypair for repository %s: %v", repo.FullName(), err)
+				return util.SanitizeErrorCredentialURLs(err)
+			}
+			if keypair != nil {
+				privateKey, err := keypair.GetDecryptedPrivateKey()
+				if err != nil {
+					log.Error("Failed to decrypt private key for repository %s: %v", repo.FullName(), err)
+					return util.SanitizeErrorCredentialURLs(err)
+				}
+
+				socketPath, cleanup, err := ssh_module.CreateTemporaryAgent(privateKey)
+				if err != nil {
+					log.Error("Failed to create SSH agent for repository %s: %v", repo.FullName(), err)
+					return util.SanitizeErrorCredentialURLs(err)
+				}
+				defer cleanup()
+
+				pushOpts.SSHAuthSock = socketPath
+				log.Debug("SSH agent created for push mirror %s with socket: %s", repo.FullName(), socketPath)
+			}
+		}
+
+		if err := git.Push(ctx, path, pushOpts); err != nil {
 			log.Error("Error pushing %s mirror[%d] remote %s: %v", path, m.ID, m.RemoteName, err)
 
 			return util.SanitizeErrorCredentialURLs(err)

services/mirror/ssh_keypair.go

@@ -0,0 +1,52 @@
+// Copyright 2025 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package mirror
+
+import (
+	"context"
+
+	repo_model "code.gitea.io/gitea/models/repo"
+	"code.gitea.io/gitea/modules/log"
+	ssh_module "code.gitea.io/gitea/modules/ssh"
+)
+
+// GetOrCreateSSHKeypairForUser gets or creates an SSH keypair for the given user
+func GetOrCreateSSHKeypairForUser(ctx context.Context, userID int64) (*repo_model.MirrorSSHKeypair, error) {
+	return ssh_module.GetOrCreateSSHKeypairForUser(ctx, userID)
+}
+
+// GetOrCreateSSHKeypairForOrg gets or creates an SSH keypair for the given organization
+func GetOrCreateSSHKeypairForOrg(ctx context.Context, orgID int64) (*repo_model.MirrorSSHKeypair, error) {
+	return ssh_module.GetOrCreateSSHKeypairForOrg(ctx, orgID)
+}
+
+// GetSSHKeypairForRepository gets the appropriate SSH keypair for a repository
+// If the repository belongs to an organization, it uses the org's keypair,
+// otherwise it uses the user's keypair
+func GetSSHKeypairForRepository(ctx context.Context, repo *repo_model.Repository) (*repo_model.MirrorSSHKeypair, error) {
+	return ssh_module.GetSSHKeypairForRepository(ctx, repo)
+}
+
+// RegenerateSSHKeypairForUser regenerates the SSH keypair for a user
+func RegenerateSSHKeypairForUser(ctx context.Context, userID int64) (*repo_model.MirrorSSHKeypair, error) {
+	log.Info("Regenerating SSH keypair for user %d", userID)
+	return repo_model.RegenerateMirrorSSHKeypair(ctx, userID)
+}
+
+// RegenerateSSHKeypairForOrg regenerates the SSH keypair for an organization
+func RegenerateSSHKeypairForOrg(ctx context.Context, orgID int64) (*repo_model.MirrorSSHKeypair, error) {
+	log.Info("Regenerating SSH keypair for organization %d", orgID)
+	return repo_model.RegenerateMirrorSSHKeypair(ctx, orgID)
+}
+
+// IsSSHURL checks if a URL is an SSH URL
+func IsSSHURL(url string) bool {
+	return ssh_module.IsSSHURL(url)
+}
+
+// GetSSHKeypairForURL gets the appropriate SSH keypair for a given repository and URL
+// Returns nil if the URL is not an SSH URL
+func GetSSHKeypairForURL(ctx context.Context, repo *repo_model.Repository, url string) (*repo_model.MirrorSSHKeypair, error) {
+	return ssh_module.GetSSHKeypairForURL(ctx, repo, url)
+}

services/repository/migrate.go

@@ -22,6 +22,7 @@ import (
 	"code.gitea.io/gitea/modules/migration"
 	repo_module "code.gitea.io/gitea/modules/repository"
 	"code.gitea.io/gitea/modules/setting"
+	ssh_module "code.gitea.io/gitea/modules/ssh"
 	"code.gitea.io/gitea/modules/timeutil"
 	"code.gitea.io/gitea/modules/util"
 )
@@ -42,12 +43,42 @@ func cloneWiki(ctx context.Context, u *user_model.User, opts migration.MigrateOp
 			log.Error("Failed to remove incomplete wiki dir %q, err: %v", wikiPath, err)
 		}
 	}
-	if err := git.Clone(ctx, wikiRemotePath, wikiPath, git.CloneRepoOptions{
+	cloneOpts := git.CloneRepoOptions{
 		Mirror:        true,
 		Quiet:         true,
 		Timeout:       migrateTimeout,
 		SkipTLSVerify: setting.Migrations.SkipTLSVerify,
-	}); err != nil {
+	}
+
+	if ssh_module.IsSSHURL(wikiRemotePath) {
+		repo, err := repo_model.GetRepositoryByOwnerAndName(ctx, u.Name, opts.RepoName)
+		if err != nil {
+			log.Error("Failed to get repository for wiki clone SSH auth: %v", err)
+		} else {
+			if repo.Owner == nil {
+				repo.Owner = u
+			}
+			keypair, err := ssh_module.GetSSHKeypairForRepository(ctx, repo)
+			if err != nil {
+				log.Error("Failed to get SSH keypair for wiki clone: %v", err)
+			} else if keypair != nil {
+				privateKey, err := keypair.GetDecryptedPrivateKey()
+				if err != nil {
+					log.Error("Failed to decrypt private key for wiki clone: %v", err)
+				} else {
+					socketPath, cleanup, err := ssh_module.CreateTemporaryAgent(privateKey)
+					if err != nil {
+						log.Error("Failed to create SSH agent for wiki clone: %v", err)
+					} else {
+						cloneOpts.SSHAuthSock = socketPath
+						defer cleanup()
+					}
+				}
+			}
+		}
+	}
+
+	if err := git.Clone(ctx, wikiRemotePath, wikiPath, cloneOpts); err != nil {
 		log.Error("Clone wiki failed, err: %v", err)
 		cleanIncompleteWikiPath()
 		return "", err
@@ -90,12 +121,37 @@ func MigrateRepositoryGitData(ctx context.Context, u *user_model.User,
 		return repo, fmt.Errorf("failed to remove existing repo dir %q, err: %w", repoPath, err)
 	}
 
-	if err := git.Clone(ctx, opts.CloneAddr, repoPath, git.CloneRepoOptions{
+	cloneOpts := git.CloneRepoOptions{
 		Mirror:        true,
 		Quiet:         true,
 		Timeout:       migrateTimeout,
 		SkipTLSVerify: setting.Migrations.SkipTLSVerify,
-	}); err != nil {
+	}
+
+	if ssh_module.IsSSHURL(opts.CloneAddr) {
+		if repo.Owner == nil {
+			repo.Owner = u
+		}
+		keypair, err := ssh_module.GetSSHKeypairForRepository(ctx, repo)
+		if err != nil {
+			return repo, fmt.Errorf("failed to get SSH keypair for repository: %w", err)
+		}
+		if keypair != nil {
+			privateKey, err := keypair.GetDecryptedPrivateKey()
+			if err != nil {
+				return repo, fmt.Errorf("failed to decrypt private key: %w", err)
+			}
+
+			socketPath, cleanup, err := ssh_module.CreateTemporaryAgent(privateKey)
+			if err != nil {
+				return repo, fmt.Errorf("failed to create SSH agent: %w", err)
+			}
+			cloneOpts.SSHAuthSock = socketPath
+			defer cleanup()
+		}
+	}
+
+	if err := git.Clone(ctx, opts.CloneAddr, repoPath, cloneOpts); err != nil {
 		if errors.Is(err, context.DeadlineExceeded) {
 			return repo, fmt.Errorf("clone timed out, consider increasing [git.timeout] MIGRATE in app.ini, underlying err: %w", err)
 		}