Gitea Migrate Database
To run a gitea migrate database task, dump your source data and restore it. Then point the app settings to the new host and run the schema tool. Teams often start on a local file store and later move to Postgres. During this move, operators often grant broad admin roles to speed up the cutover. Leaving those wide permissions in place creates major security risks for your source code. How the gitea migrate database workflow operates Gitea stores user accounts, pull requests, issues, and repo i
Database Access Proxy: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To run a gitea migrate database task, dump your source data and restore it. Then point the app settings to the new host and run the schema tool. Teams often start on a local file store and later move to Postgres. During this move, operators often grant broad admin roles to speed up the cutover. Leaving those wide permissions in place creates major security risks for your source code.
How the gitea migrate database workflow operates
Gitea stores user accounts, pull requests, issues, and repo info in a relational store. Git objects live on disk, while the database holds all the app state. Moving this state between engines requires a clean export and import process. First, you stop the main app service so no new writes occur. This step prevents split data between the disk files and the tables.
Next, you use Gitea's built-in dump process or a native database export tool. This action creates a portable snapshot of your tables and records. When you move between engines like SQLite and MySQL, formats can clash. Using Gitea's internal dump routine helps avoid data type errors across different engines.
After you load the data into the new host, you update the settings file. You enter the new host address, port, database name, and user key. When the app starts, or when you run the migrate subcommand, Gitea checks tables. It compares the current table structure against what the binary expects to find. If it finds an older layout, it runs update scripts to match the release.
Preparing accounts and schema permissions
Every schema transfer or version bump needs strong write privileges on the target server. The database role must create tables, alter columns, and build indexes. Many teams use a single superuser account for both the transfer and daily runs. That approach makes the initial setup fast, especially during a tight maintenance window.
A safer pattern separates the migration role from the daily app role. You use an admin role only when you load data or upgrade versions. Once the tables are ready, you switch the app to a restricted role. This daily role only reads, inserts, updates, and deletes rows in existing tables. It cannot drop tables or read system catalogs outside the Gitea schema.
Database Access Proxy: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What native setup solves and what keeps the session active
Native database roles and app config files handle basic startup security well. They make sure the Gitea service can talk to the right host and schema. Separating the schema owner from the runtime user also limits damage from app bugs.
Still, a static config setup only decides who can log in at the start. It does not inspect or control what individual SQL statements do in flight. During a migration or fix, engineers often log in directly to check broken rows. Static roles cannot stop an engineer from running a destructive query by mistake. They also fail to rewrite sensitive fields like emails or phone numbers in results. If a table holds user emails or card numbers, any query returns raw text. Teams also lack a clear audit log tying each manual query to a person. Shared database keys hide who ran which command during a hectic database move.
Govern statements and responses across databases and APIs
Good config and scoped roles are needed setup. They do not check single queries in flight or mask sensitive fields in returned rows. Across Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, and internal HTTP endpoints, hoop.dev sits inline in the protocol beside each supported service as an open-source proxy, a sidecar for your database or API. For every query or command an AI agent or engineer runs against production, hoop.dev decides to pass, mask, block, or hold it for human approval.
First, hoop.dev guardrails block banned queries before they run or hold risky ones for review, and hoop.dev data masking rewrites matched sensitive values in responses in memory. Furthermore, hoop.dev holds SOC 2 Type II and is open source on GitHub.
Frequently asked questions
Why should I stop the service before a gitea migrate database run?
Stopping the service blocks new code pushes, issue comments, and webhook events. This pause keeps your disk repos and database rows in sync during the copy.
Can I move from SQLite to PostgreSQL or MySQL?
Yes, you can export your metadata into neutral SQL files using Gitea's dump tool. You then import those files into the new engine and update your settings file.
What happens if a schema update fails mid-way?
A failed update leaves tables in a partial state and stops the app from starting. Always take a full backup before you run updates so you can restore fast.