Add Gitea endpoints and credentials

Signed-off-by: Gabriel Adrian Samfira <gsamfira@cloudbasesolutions.com>
2025-05-14 00:34:54 +00:00 · 2025-05-14 00:34:54 +00:00 · 823a9e4b82
commit 823a9e4b82
parent 40e6581a75
100 changed files with 7439 additions and 660 deletions
--- a/database/sql/enterprise.go
+++ b/database/sql/enterprise.go
@ -45,7 +45,6 @@ func (s *sqlDatabase) CreateEnterprise(ctx context.Context, name, credentialsNam
 	newEnterprise := Enterprise{
 		Name:             name,
 		WebhookSecret:    secret,
-		CredentialsName:  credentialsName,
 		PoolBalancerType: poolBalancerType,
 	}
 	err = s.conn.Transaction(func(tx *gorm.DB) error {
@ -57,7 +56,6 @@ func (s *sqlDatabase) CreateEnterprise(ctx context.Context, name, credentialsNam
 			return errors.Wrap(runnerErrors.ErrUnprocessable, "credentials have no endpoint")
 		}
 		newEnterprise.CredentialsID = &creds.ID
-		newEnterprise.CredentialsName = creds.Name
 		newEnterprise.EndpointName = creds.EndpointName

 		q := tx.Create(&newEnterprise)
--- a/database/sql/enterprise_test.go
+++ b/database/sql/enterprise_test.go
@ -53,8 +53,8 @@ type EnterpriseTestSuite struct {
 	adminCtx    context.Context
 	adminUserID string

-	testCreds          params.GithubCredentials
-	secondaryTestCreds params.GithubCredentials
+	testCreds          params.ForgeCredentials
+	secondaryTestCreds params.ForgeCredentials
 	githubEndpoint     params.ForgeEndpoint
 }

--- a/database/sql/gitea.go
+++ b/database/sql/gitea.go
@ -0,0 +1,469 @@
+package sql
+
+import (
+	"context"
+	"log/slog"
+
+	runnerErrors "github.com/cloudbase/garm-provider-common/errors"
+	"github.com/cloudbase/garm/auth"
+	"github.com/cloudbase/garm/database/common"
+	"github.com/cloudbase/garm/params"
+	"github.com/pkg/errors"
+	"gorm.io/gorm"
+)
+
+func (s *sqlDatabase) CreateGiteaEndpoint(_ context.Context, param params.CreateGiteaEndpointParams) (ghEndpoint params.ForgeEndpoint, err error) {
+	defer func() {
+		if err == nil {
+			s.sendNotify(common.GithubEndpointEntityType, common.CreateOperation, ghEndpoint)
+		}
+	}()
+	var endpoint GithubEndpoint
+	err = s.conn.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("name = ?", param.Name).First(&endpoint).Error; err == nil {
+			return errors.Wrap(runnerErrors.ErrDuplicateEntity, "github endpoint already exists")
+		}
+		endpoint = GithubEndpoint{
+			Name:         param.Name,
+			Description:  param.Description,
+			APIBaseURL:   param.APIBaseURL,
+			BaseURL:      param.BaseURL,
+			CACertBundle: param.CACertBundle,
+			EndpointType: params.GiteaEndpointType,
+		}
+
+		if err := tx.Create(&endpoint).Error; err != nil {
+			return errors.Wrap(err, "creating github endpoint")
+		}
+		return nil
+	})
+	if err != nil {
+		return params.ForgeEndpoint{}, errors.Wrap(err, "creating github endpoint")
+	}
+	ghEndpoint, err = s.sqlToCommonGithubEndpoint(endpoint)
+	if err != nil {
+		return params.ForgeEndpoint{}, errors.Wrap(err, "converting github endpoint")
+	}
+	return ghEndpoint, nil
+}
+
+func (s *sqlDatabase) ListGiteaEndpoints(_ context.Context) ([]params.ForgeEndpoint, error) {
+	var endpoints []GithubEndpoint
+	err := s.conn.Where("endpoint_type = ?", params.GiteaEndpointType).Find(&endpoints).Error
+	if err != nil {
+		return nil, errors.Wrap(err, "fetching github endpoints")
+	}
+
+	var ret []params.ForgeEndpoint
+	for _, ep := range endpoints {
+		commonEp, err := s.sqlToCommonGithubEndpoint(ep)
+		if err != nil {
+			return nil, errors.Wrap(err, "converting github endpoint")
+		}
+		ret = append(ret, commonEp)
+	}
+	return ret, nil
+}
+
+func (s *sqlDatabase) UpdateGiteaEndpoint(_ context.Context, name string, param params.UpdateGiteaEndpointParams) (ghEndpoint params.ForgeEndpoint, err error) {
+	if name == defaultGithubEndpoint {
+		return params.ForgeEndpoint{}, runnerErrors.NewBadRequestError("cannot update default endpoint %s", defaultGithubEndpoint)
+	}
+
+	defer func() {
+		if err == nil {
+			s.sendNotify(common.GithubEndpointEntityType, common.UpdateOperation, ghEndpoint)
+		}
+	}()
+	var endpoint GithubEndpoint
+	err = s.conn.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("name = ? and endpoint_type = ?", name, params.GiteaEndpointType).First(&endpoint).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.Wrap(runnerErrors.ErrNotFound, "gitea endpoint not found")
+			}
+			return errors.Wrap(err, "fetching gitea endpoint")
+		}
+		if param.APIBaseURL != nil {
+			endpoint.APIBaseURL = *param.APIBaseURL
+		}
+
+		if param.BaseURL != nil {
+			endpoint.BaseURL = *param.BaseURL
+		}
+
+		if param.CACertBundle != nil {
+			endpoint.CACertBundle = param.CACertBundle
+		}
+
+		if param.Description != nil {
+			endpoint.Description = *param.Description
+		}
+
+		if err := tx.Save(&endpoint).Error; err != nil {
+			return errors.Wrap(err, "updating gitea endpoint")
+		}
+
+		return nil
+	})
+	if err != nil {
+		return params.ForgeEndpoint{}, errors.Wrap(err, "updating gitea endpoint")
+	}
+	ghEndpoint, err = s.sqlToCommonGithubEndpoint(endpoint)
+	if err != nil {
+		return params.ForgeEndpoint{}, errors.Wrap(err, "converting gitea endpoint")
+	}
+	return ghEndpoint, nil
+}
+
+func (s *sqlDatabase) GetGiteaEndpoint(_ context.Context, name string) (params.ForgeEndpoint, error) {
+	var endpoint GithubEndpoint
+
+	err := s.conn.Where("name = ? and endpoint_type = ?", name, params.GiteaEndpointType).First(&endpoint).Error
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return params.ForgeEndpoint{}, errors.Wrap(runnerErrors.ErrNotFound, "gitea endpoint not found")
+		}
+		return params.ForgeEndpoint{}, errors.Wrap(err, "fetching gitea endpoint")
+	}
+
+	return s.sqlToCommonGithubEndpoint(endpoint)
+}
+
+func (s *sqlDatabase) DeleteGiteaEndpoint(_ context.Context, name string) (err error) {
+	if name == defaultGithubEndpoint {
+		return runnerErrors.NewBadRequestError("cannot delete default endpoint %s", defaultGithubEndpoint)
+	}
+
+	defer func() {
+		if err == nil {
+			s.sendNotify(common.GithubEndpointEntityType, common.DeleteOperation, params.ForgeEndpoint{Name: name})
+		}
+	}()
+	err = s.conn.Transaction(func(tx *gorm.DB) error {
+		var endpoint GithubEndpoint
+		if err := tx.Where("name = ? and endpoint_type = ?", name, params.GiteaEndpointType).First(&endpoint).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return nil
+			}
+			return errors.Wrap(err, "fetching gitea endpoint")
+		}
+
+		var credsCount int64
+		if err := tx.Model(&GithubCredentials{}).Where("endpoint_name = ?", endpoint.Name).Count(&credsCount).Error; err != nil {
+			if !errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.Wrap(err, "fetching gitea credentials")
+			}
+		}
+
+		var repoCnt int64
+		if err := tx.Model(&Repository{}).Where("endpoint_name = ?", endpoint.Name).Count(&repoCnt).Error; err != nil {
+			if !errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.Wrap(err, "fetching gitea repositories")
+			}
+		}
+
+		var orgCnt int64
+		if err := tx.Model(&Organization{}).Where("endpoint_name = ?", endpoint.Name).Count(&orgCnt).Error; err != nil {
+			if !errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.Wrap(err, "fetching gitea organizations")
+			}
+		}
+
+		var entCnt int64
+		if err := tx.Model(&Enterprise{}).Where("endpoint_name = ?", endpoint.Name).Count(&entCnt).Error; err != nil {
+			if !errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.Wrap(err, "fetching gitea enterprises")
+			}
+		}
+
+		if credsCount > 0 || repoCnt > 0 || orgCnt > 0 || entCnt > 0 {
+			return errors.New("cannot delete endpoint with associated entities")
+		}
+
+		if err := tx.Unscoped().Delete(&endpoint).Error; err != nil {
+			return errors.Wrap(err, "deleting gitea endpoint")
+		}
+		return nil
+	})
+	if err != nil {
+		return errors.Wrap(err, "deleting gitea endpoint")
+	}
+	return nil
+}
+
+func (s *sqlDatabase) CreateGiteaCredentials(ctx context.Context, param params.CreateGiteaCredentialsParams) (gtCreds params.ForgeCredentials, err error) {
+	userID, err := getUIDFromContext(ctx)
+	if err != nil {
+		return params.ForgeCredentials{}, errors.Wrap(err, "creating github credentials")
+	}
+	if param.Endpoint == "" {
+		return params.ForgeCredentials{}, errors.Wrap(runnerErrors.ErrBadRequest, "endpoint name is required")
+	}
+
+	defer func() {
+		if err == nil {
+			s.sendNotify(common.GiteaCredentialsEntityType, common.CreateOperation, gtCreds)
+		}
+	}()
+	var creds GiteaCredentials
+	err = s.conn.Transaction(func(tx *gorm.DB) error {
+		var endpoint GithubEndpoint
+		if err := tx.Where("name = ? and endpoint_type = ?", param.Endpoint, params.GiteaEndpointType).First(&endpoint).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.Wrap(runnerErrors.ErrNotFound, "github endpoint not found")
+			}
+			return errors.Wrap(err, "fetching github endpoint")
+		}
+
+		if err := tx.Where("name = ? and user_id = ?", param.Name, userID).First(&creds).Error; err == nil {
+			return errors.Wrap(runnerErrors.ErrDuplicateEntity, "github credentials already exists")
+		}
+
+		var data []byte
+		var err error
+		switch param.AuthType {
+		case params.ForgeAuthTypePAT:
+			data, err = s.marshalAndSeal(param.PAT)
+		case params.ForgeAuthTypeApp:
+			data, err = s.marshalAndSeal(param.App)
+		default:
+			return errors.Wrap(runnerErrors.ErrBadRequest, "invalid auth type")
+		}
+		if err != nil {
+			return errors.Wrap(err, "marshaling and sealing credentials")
+		}
+
+		creds = GiteaCredentials{
+			Name:         param.Name,
+			Description:  param.Description,
+			EndpointName: &endpoint.Name,
+			AuthType:     param.AuthType,
+			Payload:      data,
+			UserID:       &userID,
+		}
+
+		if err := tx.Create(&creds).Error; err != nil {
+			return errors.Wrap(err, "creating github credentials")
+		}
+		// Skip making an extra query.
+		creds.Endpoint = endpoint
+
+		return nil
+	})
+	if err != nil {
+		return params.ForgeCredentials{}, errors.Wrap(err, "creating github credentials")
+	}
+	gtCreds, err = s.sqlGiteaToCommonForgeCredentials(creds)
+	if err != nil {
+		return params.ForgeCredentials{}, errors.Wrap(err, "converting github credentials")
+	}
+	return gtCreds, nil
+}
+
+func (s *sqlDatabase) getGiteaCredentialsByName(ctx context.Context, tx *gorm.DB, name string, detailed bool) (GiteaCredentials, error) {
+	var creds GiteaCredentials
+	q := tx.Preload("Endpoint")
+
+	if detailed {
+		q = q.
+			Preload("Repositories").
+			Preload("Organizations")
+	}
+
+	userID, err := getUIDFromContext(ctx)
+	if err != nil {
+		return GiteaCredentials{}, errors.Wrap(err, "fetching gitea credentials")
+	}
+	q = q.Where("user_id = ?", userID)
+
+	err = q.Where("name = ?", name).First(&creds).Error
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return GiteaCredentials{}, errors.Wrap(runnerErrors.ErrNotFound, "gitea credentials not found")
+		}
+		return GiteaCredentials{}, errors.Wrap(err, "fetching gitea credentials")
+	}
+
+	return creds, nil
+}
+
+func (s *sqlDatabase) GetGiteaCredentialsByName(ctx context.Context, name string, detailed bool) (params.ForgeCredentials, error) {
+	creds, err := s.getGiteaCredentialsByName(ctx, s.conn, name, detailed)
+	if err != nil {
+		return params.ForgeCredentials{}, errors.Wrap(err, "fetching gitea credentials")
+	}
+
+	return s.sqlGiteaToCommonForgeCredentials(creds)
+}
+
+func (s *sqlDatabase) GetGiteaCredentials(ctx context.Context, id uint, detailed bool) (params.ForgeCredentials, error) {
+	var creds GiteaCredentials
+	q := s.conn.Preload("Endpoint")
+
+	if detailed {
+		q = q.
+			Preload("Repositories").
+			Preload("Organizations")
+	}
+
+	if !auth.IsAdmin(ctx) {
+		userID, err := getUIDFromContext(ctx)
+		if err != nil {
+			return params.ForgeCredentials{}, errors.Wrap(err, "fetching gitea credentials")
+		}
+		q = q.Where("user_id = ?", userID)
+	}
+
+	err := q.Where("id = ?", id).First(&creds).Error
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return params.ForgeCredentials{}, errors.Wrap(runnerErrors.ErrNotFound, "gitea credentials not found")
+		}
+		return params.ForgeCredentials{}, errors.Wrap(err, "fetching gitea credentials")
+	}
+
+	return s.sqlGiteaToCommonForgeCredentials(creds)
+}
+
+func (s *sqlDatabase) ListGiteaCredentials(ctx context.Context) ([]params.ForgeCredentials, error) {
+	q := s.conn.Preload("Endpoint")
+	if !auth.IsAdmin(ctx) {
+		userID, err := getUIDFromContext(ctx)
+		if err != nil {
+			return nil, errors.Wrap(err, "fetching gitea credentials")
+		}
+		q = q.Where("user_id = ?", userID)
+	}
+
+	var creds []GiteaCredentials
+	err := q.Preload("Endpoint").Find(&creds).Error
+	if err != nil {
+		return nil, errors.Wrap(err, "fetching gitea credentials")
+	}
+
+	var ret []params.ForgeCredentials
+	for _, c := range creds {
+		commonCreds, err := s.sqlGiteaToCommonForgeCredentials(c)
+		if err != nil {
+			return nil, errors.Wrap(err, "converting gitea credentials")
+		}
+		ret = append(ret, commonCreds)
+	}
+	return ret, nil
+}
+
+func (s *sqlDatabase) UpdateGiteaCredentials(ctx context.Context, id uint, param params.UpdateGiteaCredentialsParams) (gtCreds params.ForgeCredentials, err error) {
+	defer func() {
+		if err == nil {
+			s.sendNotify(common.GiteaCredentialsEntityType, common.UpdateOperation, gtCreds)
+		}
+	}()
+	var creds GiteaCredentials
+	err = s.conn.Transaction(func(tx *gorm.DB) error {
+		q := tx.Preload("Endpoint")
+		if !auth.IsAdmin(ctx) {
+			userID, err := getUIDFromContext(ctx)
+			if err != nil {
+				return errors.Wrap(err, "updating gitea credentials")
+			}
+			q = q.Where("user_id = ?", userID)
+		}
+
+		if err := q.Where("id = ?", id).First(&creds).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.Wrap(runnerErrors.ErrNotFound, "gitea credentials not found")
+			}
+			return errors.Wrap(err, "fetching gitea credentials")
+		}
+
+		if param.Name != nil {
+			creds.Name = *param.Name
+		}
+		if param.Description != nil {
+			creds.Description = *param.Description
+		}
+
+		var data []byte
+		var err error
+		switch creds.AuthType {
+		case params.ForgeAuthTypePAT:
+			if param.PAT != nil {
+				data, err = s.marshalAndSeal(param.PAT)
+			}
+		default:
+			return errors.Wrap(runnerErrors.ErrBadRequest, "invalid auth type")
+		}
+
+		if err != nil {
+			return errors.Wrap(err, "marshaling and sealing credentials")
+		}
+		if len(data) > 0 {
+			creds.Payload = data
+		}
+
+		if err := tx.Save(&creds).Error; err != nil {
+			return errors.Wrap(err, "updating gitea credentials")
+		}
+		return nil
+	})
+	if err != nil {
+		return params.ForgeCredentials{}, errors.Wrap(err, "updating gitea credentials")
+	}
+
+	gtCreds, err = s.sqlGiteaToCommonForgeCredentials(creds)
+	if err != nil {
+		return params.ForgeCredentials{}, errors.Wrap(err, "converting gitea credentials")
+	}
+	return gtCreds, nil
+}
+
+func (s *sqlDatabase) DeleteGiteaCredentials(ctx context.Context, id uint) (err error) {
+	var creds GiteaCredentials
+	defer func() {
+		if err == nil {
+			forgeCreds, innerErr := s.sqlGiteaToCommonForgeCredentials(creds)
+			if innerErr != nil {
+				slog.ErrorContext(ctx, "converting gitea credentials", "error", innerErr)
+			}
+			if creds.ID == 0 || creds.Name == "" {
+				return
+			}
+			s.sendNotify(common.GiteaCredentialsEntityType, common.DeleteOperation, forgeCreds)
+		}
+	}()
+	err = s.conn.Transaction(func(tx *gorm.DB) error {
+		q := tx.Where("id = ?", id).
+			Preload("Repositories").
+			Preload("Organizations")
+		if !auth.IsAdmin(ctx) {
+			userID, err := getUIDFromContext(ctx)
+			if err != nil {
+				return errors.Wrap(err, "deleting gitea credentials")
+			}
+			q = q.Where("user_id = ?", userID)
+		}
+
+		err := q.First(&creds).Error
+		if err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return nil
+			}
+			return errors.Wrap(err, "fetching gitea credentials")
+		}
+
+		if len(creds.Repositories) > 0 {
+			return errors.Wrap(runnerErrors.ErrBadRequest, "cannot delete credentials with repositories")
+		}
+		if len(creds.Organizations) > 0 {
+			return errors.Wrap(runnerErrors.ErrBadRequest, "cannot delete credentials with organizations")
+		}
+		if err := tx.Unscoped().Delete(&creds).Error; err != nil {
+			return errors.Wrap(err, "deleting gitea credentials")
+		}
+		return nil
+	})
+	if err != nil {
+		return errors.Wrap(err, "deleting gitea credentials")
+	}
+	return nil
+}
--- a/database/sql/github.go
+++ b/database/sql/github.go
@ -17,12 +17,10 @@ package sql
 import (
 	"context"

-	"github.com/google/uuid"
 	"github.com/pkg/errors"
 	"gorm.io/gorm"

 	runnerErrors "github.com/cloudbase/garm-provider-common/errors"
-	"github.com/cloudbase/garm-provider-common/util"
 	"github.com/cloudbase/garm/auth"
 	"github.com/cloudbase/garm/database/common"
 	"github.com/cloudbase/garm/params"
@ -32,89 +30,6 @@ const (
 	defaultGithubEndpoint string = "github.com"
 )

-func (s *sqlDatabase) sqlToCommonGithubCredentials(creds GithubCredentials) (params.GithubCredentials, error) {
-	if len(creds.Payload) == 0 {
-		return params.GithubCredentials{}, errors.New("empty credentials payload")
-	}
-	data, err := util.Unseal(creds.Payload, []byte(s.cfg.Passphrase))
-	if err != nil {
-		return params.GithubCredentials{}, errors.Wrap(err, "unsealing credentials")
-	}
-
-	ep, err := s.sqlToCommonGithubEndpoint(creds.Endpoint)
-	if err != nil {
-		return params.GithubCredentials{}, errors.Wrap(err, "converting github endpoint")
-	}
-
-	commonCreds := params.GithubCredentials{
-		ID:                 creds.ID,
-		Name:               creds.Name,
-		Description:        creds.Description,
-		APIBaseURL:         creds.Endpoint.APIBaseURL,
-		BaseURL:            creds.Endpoint.BaseURL,
-		UploadBaseURL:      creds.Endpoint.UploadBaseURL,
-		CABundle:           creds.Endpoint.CACertBundle,
-		AuthType:           creds.AuthType,
-		CreatedAt:          creds.CreatedAt,
-		UpdatedAt:          creds.UpdatedAt,
-		Endpoint:           ep,
-		CredentialsPayload: data,
-	}
-
-	for _, repo := range creds.Repositories {
-		commonRepo, err := s.sqlToCommonRepository(repo, false)
-		if err != nil {
-			return params.GithubCredentials{}, errors.Wrap(err, "converting github repository")
-		}
-		commonCreds.Repositories = append(commonCreds.Repositories, commonRepo)
-	}
-
-	for _, org := range creds.Organizations {
-		commonOrg, err := s.sqlToCommonOrganization(org, false)
-		if err != nil {
-			return params.GithubCredentials{}, errors.Wrap(err, "converting github organization")
-		}
-		commonCreds.Organizations = append(commonCreds.Organizations, commonOrg)
-	}
-
-	for _, ent := range creds.Enterprises {
-		commonEnt, err := s.sqlToCommonEnterprise(ent, false)
-		if err != nil {
-			return params.GithubCredentials{}, errors.Wrapf(err, "converting github enterprise: %s", ent.Name)
-		}
-		commonCreds.Enterprises = append(commonCreds.Enterprises, commonEnt)
-	}
-
-	return commonCreds, nil
-}
-
-func (s *sqlDatabase) sqlToCommonGithubEndpoint(ep GithubEndpoint) (params.ForgeEndpoint, error) {
-	return params.ForgeEndpoint{
-		Name:          ep.Name,
-		Description:   ep.Description,
-		APIBaseURL:    ep.APIBaseURL,
-		BaseURL:       ep.BaseURL,
-		UploadBaseURL: ep.UploadBaseURL,
-		CACertBundle:  ep.CACertBundle,
-		CreatedAt:     ep.CreatedAt,
-		EndpointType:  ep.EndpointType,
-		UpdatedAt:     ep.UpdatedAt,
-	}, nil
-}
-
-func getUIDFromContext(ctx context.Context) (uuid.UUID, error) {
-	userID := auth.UserID(ctx)
-	if userID == "" {
-		return uuid.Nil, errors.Wrap(runnerErrors.ErrUnauthorized, "getting UID from context")
-	}
-
-	asUUID, err := uuid.Parse(userID)
-	if err != nil {
-		return uuid.Nil, errors.Wrap(runnerErrors.ErrUnauthorized, "parsing UID from context")
-	}
-	return asUUID, nil
-}
-
 func (s *sqlDatabase) CreateGithubEndpoint(_ context.Context, param params.CreateGithubEndpointParams) (ghEndpoint params.ForgeEndpoint, err error) {
 	defer func() {
 		if err == nil {
@ -133,6 +48,7 @@ func (s *sqlDatabase) CreateGithubEndpoint(_ context.Context, param params.Creat
 			BaseURL:       param.BaseURL,
 			UploadBaseURL: param.UploadBaseURL,
 			CACertBundle:  param.CACertBundle,
+			EndpointType:  params.GithubEndpointType,
 		}

 		if err := tx.Create(&endpoint).Error; err != nil {
@ -152,7 +68,7 @@ func (s *sqlDatabase) CreateGithubEndpoint(_ context.Context, param params.Creat

 func (s *sqlDatabase) ListGithubEndpoints(_ context.Context) ([]params.ForgeEndpoint, error) {
 	var endpoints []GithubEndpoint
-	err := s.conn.Find(&endpoints).Error
+	err := s.conn.Where("endpoint_type = ?", params.GithubEndpointType).Find(&endpoints).Error
 	if err != nil {
 		return nil, errors.Wrap(err, "fetching github endpoints")
 	}
@ -180,7 +96,7 @@ func (s *sqlDatabase) UpdateGithubEndpoint(_ context.Context, name string, param
 	}()
 	var endpoint GithubEndpoint
 	err = s.conn.Transaction(func(tx *gorm.DB) error {
-		if err := tx.Where("name = ?", name).First(&endpoint).Error; err != nil {
+		if err := tx.Where("name = ? and endpoint_type = ?", name, params.GithubEndpointType).First(&endpoint).Error; err != nil {
 			if errors.Is(err, gorm.ErrRecordNotFound) {
 				return errors.Wrap(runnerErrors.ErrNotFound, "github endpoint not found")
 			}
@ -225,7 +141,7 @@ func (s *sqlDatabase) UpdateGithubEndpoint(_ context.Context, name string, param
 func (s *sqlDatabase) GetGithubEndpoint(_ context.Context, name string) (params.ForgeEndpoint, error) {
 	var endpoint GithubEndpoint

-	err := s.conn.Where("name = ?", name).First(&endpoint).Error
+	err := s.conn.Where("name = ? and endpoint_type = ?", name, params.GithubEndpointType).First(&endpoint).Error
 	if err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
 			return params.ForgeEndpoint{}, errors.Wrap(runnerErrors.ErrNotFound, "github endpoint not found")
@ -248,7 +164,7 @@ func (s *sqlDatabase) DeleteGithubEndpoint(_ context.Context, name string) (err
 	}()
 	err = s.conn.Transaction(func(tx *gorm.DB) error {
 		var endpoint GithubEndpoint
-		if err := tx.Where("name = ?", name).First(&endpoint).Error; err != nil {
+		if err := tx.Where("name = ? and endpoint_type = ?", name, params.GithubEndpointType).First(&endpoint).Error; err != nil {
 			if errors.Is(err, gorm.ErrRecordNotFound) {
 				return nil
 			}
@ -298,13 +214,13 @@ func (s *sqlDatabase) DeleteGithubEndpoint(_ context.Context, name string) (err
 	return nil
 }

-func (s *sqlDatabase) CreateGithubCredentials(ctx context.Context, param params.CreateGithubCredentialsParams) (ghCreds params.GithubCredentials, err error) {
+func (s *sqlDatabase) CreateGithubCredentials(ctx context.Context, param params.CreateGithubCredentialsParams) (ghCreds params.ForgeCredentials, err error) {
 	userID, err := getUIDFromContext(ctx)
 	if err != nil {
-		return params.GithubCredentials{}, errors.Wrap(err, "creating github credentials")
+		return params.ForgeCredentials{}, errors.Wrap(err, "creating github credentials")
 	}
 	if param.Endpoint == "" {
-		return params.GithubCredentials{}, errors.Wrap(runnerErrors.ErrBadRequest, "endpoint name is required")
+		return params.ForgeCredentials{}, errors.Wrap(runnerErrors.ErrBadRequest, "endpoint name is required")
 	}

 	defer func() {
@ -315,7 +231,7 @@ func (s *sqlDatabase) CreateGithubCredentials(ctx context.Context, param params.
 	var creds GithubCredentials
 	err = s.conn.Transaction(func(tx *gorm.DB) error {
 		var endpoint GithubEndpoint
-		if err := tx.Where("name = ?", param.Endpoint).First(&endpoint).Error; err != nil {
+		if err := tx.Where("name = ? and endpoint_type = ?", param.Endpoint, params.GithubEndpointType).First(&endpoint).Error; err != nil {
 			if errors.Is(err, gorm.ErrRecordNotFound) {
 				return errors.Wrap(runnerErrors.ErrNotFound, "github endpoint not found")
 			}
@ -358,11 +274,11 @@ func (s *sqlDatabase) CreateGithubCredentials(ctx context.Context, param params.
 		return nil
 	})
 	if err != nil {
-		return params.GithubCredentials{}, errors.Wrap(err, "creating github credentials")
+		return params.ForgeCredentials{}, errors.Wrap(err, "creating github credentials")
 	}
-	ghCreds, err = s.sqlToCommonGithubCredentials(creds)
+	ghCreds, err = s.sqlToCommonForgeCredentials(creds)
 	if err != nil {
-		return params.GithubCredentials{}, errors.Wrap(err, "converting github credentials")
+		return params.ForgeCredentials{}, errors.Wrap(err, "converting github credentials")
 	}
 	return ghCreds, nil
 }
@ -395,16 +311,16 @@ func (s *sqlDatabase) getGithubCredentialsByName(ctx context.Context, tx *gorm.D
 	return creds, nil
 }

-func (s *sqlDatabase) GetGithubCredentialsByName(ctx context.Context, name string, detailed bool) (params.GithubCredentials, error) {
+func (s *sqlDatabase) GetGithubCredentialsByName(ctx context.Context, name string, detailed bool) (params.ForgeCredentials, error) {
 	creds, err := s.getGithubCredentialsByName(ctx, s.conn, name, detailed)
 	if err != nil {
-		return params.GithubCredentials{}, errors.Wrap(err, "fetching github credentials")
+		return params.ForgeCredentials{}, errors.Wrap(err, "fetching github credentials")
 	}

-	return s.sqlToCommonGithubCredentials(creds)
+	return s.sqlToCommonForgeCredentials(creds)
 }

-func (s *sqlDatabase) GetGithubCredentials(ctx context.Context, id uint, detailed bool) (params.GithubCredentials, error) {
+func (s *sqlDatabase) GetGithubCredentials(ctx context.Context, id uint, detailed bool) (params.ForgeCredentials, error) {
 	var creds GithubCredentials
 	q := s.conn.Preload("Endpoint")

@ -418,7 +334,7 @@ func (s *sqlDatabase) GetGithubCredentials(ctx context.Context, id uint, detaile
 	if !auth.IsAdmin(ctx) {
 		userID, err := getUIDFromContext(ctx)
 		if err != nil {
-			return params.GithubCredentials{}, errors.Wrap(err, "fetching github credentials")
+			return params.ForgeCredentials{}, errors.Wrap(err, "fetching github credentials")
 		}
 		q = q.Where("user_id = ?", userID)
 	}
@ -426,15 +342,15 @@ func (s *sqlDatabase) GetGithubCredentials(ctx context.Context, id uint, detaile
 	err := q.Where("id = ?", id).First(&creds).Error
 	if err != nil {
 		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return params.GithubCredentials{}, errors.Wrap(runnerErrors.ErrNotFound, "github credentials not found")
+			return params.ForgeCredentials{}, errors.Wrap(runnerErrors.ErrNotFound, "github credentials not found")
 		}
-		return params.GithubCredentials{}, errors.Wrap(err, "fetching github credentials")
+		return params.ForgeCredentials{}, errors.Wrap(err, "fetching github credentials")
 	}

-	return s.sqlToCommonGithubCredentials(creds)
+	return s.sqlToCommonForgeCredentials(creds)
 }

-func (s *sqlDatabase) ListGithubCredentials(ctx context.Context) ([]params.GithubCredentials, error) {
+func (s *sqlDatabase) ListGithubCredentials(ctx context.Context) ([]params.ForgeCredentials, error) {
 	q := s.conn.Preload("Endpoint")
 	if !auth.IsAdmin(ctx) {
 		userID, err := getUIDFromContext(ctx)
@ -450,9 +366,9 @@ func (s *sqlDatabase) ListGithubCredentials(ctx context.Context) ([]params.Githu
 		return nil, errors.Wrap(err, "fetching github credentials")
 	}

-	var ret []params.GithubCredentials
+	var ret []params.ForgeCredentials
 	for _, c := range creds {
-		commonCreds, err := s.sqlToCommonGithubCredentials(c)
+		commonCreds, err := s.sqlToCommonForgeCredentials(c)
 		if err != nil {
 			return nil, errors.Wrap(err, "converting github credentials")
 		}
@ -461,7 +377,7 @@ func (s *sqlDatabase) ListGithubCredentials(ctx context.Context) ([]params.Githu
 	return ret, nil
 }

-func (s *sqlDatabase) UpdateGithubCredentials(ctx context.Context, id uint, param params.UpdateGithubCredentialsParams) (ghCreds params.GithubCredentials, err error) {
+func (s *sqlDatabase) UpdateGithubCredentials(ctx context.Context, id uint, param params.UpdateGithubCredentialsParams) (ghCreds params.ForgeCredentials, err error) {
 	defer func() {
 		if err == nil {
 			s.sendNotify(common.GithubCredentialsEntityType, common.UpdateOperation, ghCreds)
@ -530,12 +446,12 @@ func (s *sqlDatabase) UpdateGithubCredentials(ctx context.Context, id uint, para
 		return nil
 	})
 	if err != nil {
-		return params.GithubCredentials{}, errors.Wrap(err, "updating github credentials")
+		return params.ForgeCredentials{}, errors.Wrap(err, "updating github credentials")
 	}

-	ghCreds, err = s.sqlToCommonGithubCredentials(creds)
+	ghCreds, err = s.sqlToCommonForgeCredentials(creds)
 	if err != nil {
-		return params.GithubCredentials{}, errors.Wrap(err, "converting github credentials")
+		return params.ForgeCredentials{}, errors.Wrap(err, "converting github credentials")
 	}
 	return ghCreds, nil
 }
@ -544,7 +460,7 @@ func (s *sqlDatabase) DeleteGithubCredentials(ctx context.Context, id uint) (err
 	var name string
 	defer func() {
 		if err == nil {
-			s.sendNotify(common.GithubCredentialsEntityType, common.DeleteOperation, params.GithubCredentials{ID: id, Name: name})
+			s.sendNotify(common.GithubCredentialsEntityType, common.DeleteOperation, params.ForgeCredentials{ID: id, Name: name})
 		}
 	}()
 	err = s.conn.Transaction(func(tx *gorm.DB) error {
--- a/database/sql/github_test.go
+++ b/database/sql/github_test.go
@ -533,7 +533,7 @@ func (s *GithubTestSuite) TestDeleteCredentialsFailsIfReposOrgsOrEntitiesUseIt()
 	s.Require().NoError(err)
 	s.Require().NotNil(creds)

-	repo, err := s.db.CreateRepository(ctx, "test-owner", "test-repo", creds.Name, "superSecret@123BlaBla", params.PoolBalancerTypeRoundRobin)
+	repo, err := s.db.CreateRepository(ctx, "test-owner", "test-repo", creds, "superSecret@123BlaBla", params.PoolBalancerTypeRoundRobin)
 	s.Require().NoError(err)
 	s.Require().NotNil(repo)

--- a/database/sql/models.go
+++ b/database/sql/models.go
@ -1,17 +1,3 @@
-// Copyright 2022 Cloudbase Solutions SRL
-//
-//    Licensed under the Apache License, Version 2.0 (the "License"); you may
-//    not use this file except in compliance with the License. You may obtain
-//    a copy of the License at
-//
-//         http://www.apache.org/licenses/LICENSE-2.0
-//
-//    Unless required by applicable law or agreed to in writing, software
-//    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-//    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-//    License for the specific language governing permissions and limitations
-//    under the License.
-
 package sql

 import (
@ -46,6 +32,22 @@ func (b *Base) BeforeCreate(_ *gorm.DB) error {
 	return nil
 }

+type ControllerInfo struct {
+	Base
+
+	ControllerID uuid.UUID
+
+	CallbackURL    string
+	MetadataURL    string
+	WebhookBaseURL string
+	// MinimumJobAgeBackoff is the minimum time that a job must be in the queue
+	// before GARM will attempt to allocate a runner to service it. This backoff
+	// is useful if you have idle runners in various pools that could potentially
+	// pick up the job. GARM would allow this amount of time for runners to react
+	// before spinning up a new one and potentially having to scale down later.
+	MinimumJobAgeBackoff uint
+}
+
 type Tag struct {
 	Base

@ -152,11 +154,12 @@ type RepositoryEvent struct {
 type Repository struct {
 	Base

-	CredentialsName string
-
 	CredentialsID *uint             `gorm:"index"`
 	Credentials   GithubCredentials `gorm:"foreignKey:CredentialsID;constraint:OnDelete:SET NULL"`

+	GiteaCredentialsID *uint            `gorm:"index"`
+	GiteaCredentials   GiteaCredentials `gorm:"foreignKey:GiteaCredentialsID;constraint:OnDelete:SET NULL"`
+
 	Owner            string `gorm:"index:idx_owner_nocase,unique,collate:nocase"`
 	Name             string `gorm:"index:idx_owner_nocase,unique,collate:nocase"`
 	WebhookSecret    []byte
@ -184,11 +187,12 @@ type OrganizationEvent struct {
 type Organization struct {
 	Base

-	CredentialsName string
-
 	CredentialsID *uint             `gorm:"index"`
 	Credentials   GithubCredentials `gorm:"foreignKey:CredentialsID;constraint:OnDelete:SET NULL"`

+	GiteaCredentialsID *uint            `gorm:"index"`
+	GiteaCredentials   GiteaCredentials `gorm:"foreignKey:GiteaCredentialsID;constraint:OnDelete:SET NULL"`
+
 	Name             string `gorm:"index:idx_org_name_nocase,collate:nocase"`
 	WebhookSecret    []byte
 	Pools            []Pool                  `gorm:"foreignKey:OrgID"`
@ -216,8 +220,6 @@ type EnterpriseEvent struct {
 type Enterprise struct {
 	Base

-	CredentialsName string
-
 	CredentialsID *uint             `gorm:"index"`
 	Credentials   GithubCredentials `gorm:"foreignKey:CredentialsID;constraint:OnDelete:SET NULL"`

@ -300,22 +302,6 @@ type User struct {
 	Enabled    bool
 }

-type ControllerInfo struct {
-	Base
-
-	ControllerID uuid.UUID
-
-	CallbackURL    string
-	MetadataURL    string
-	WebhookBaseURL string
-	// MinimumJobAgeBackoff is the minimum time that a job must be in the queue
-	// before GARM will attempt to allocate a runner to service it. This backoff
-	// is useful if you have idle runners in various pools that could potentially
-	// pick up the job. GARM would allow this amount of time for runners to react
-	// before spinning up a new one and potentially having to scale down later.
-	MinimumJobAgeBackoff uint
-}
-
 type WorkflowJob struct {
 	// ID is the ID of the job.
 	ID int64 `gorm:"index"`
@ -381,7 +367,7 @@ type GithubEndpoint struct {
 	UpdatedAt time.Time
 	DeletedAt gorm.DeletedAt `gorm:"index"`

-	EndpointType params.EndpointType
+	EndpointType params.EndpointType `gorm:"index:idx_endpoint_type"`

 	Description   string `gorm:"type:text"`
 	APIBaseURL    string `gorm:"type:text collate nocase"`
@ -408,3 +394,21 @@ type GithubCredentials struct {
 	Organizations []Organization `gorm:"foreignKey:CredentialsID"`
 	Enterprises   []Enterprise   `gorm:"foreignKey:CredentialsID"`
 }
+
+type GiteaCredentials struct {
+	gorm.Model
+
+	Name   string     `gorm:"index:idx_gitea_credentials,unique;type:varchar(64) collate nocase"`
+	UserID *uuid.UUID `gorm:"index:idx_gitea_credentials,unique"`
+	User   User       `gorm:"foreignKey:UserID"`
+
+	Description string               `gorm:"type:text"`
+	AuthType    params.ForgeAuthType `gorm:"index"`
+	Payload     []byte               `gorm:"type:longblob"`
+
+	Endpoint     GithubEndpoint `gorm:"foreignKey:EndpointName"`
+	EndpointName *string        `gorm:"index"`
+
+	Repositories  []Repository   `gorm:"foreignKey:GiteaCredentialsID"`
+	Organizations []Organization `gorm:"foreignKey:GiteaCredentialsID"`
+}
--- a/database/sql/organizations.go
+++ b/database/sql/organizations.go
@ -46,7 +46,6 @@ func (s *sqlDatabase) CreateOrganization(ctx context.Context, name, credentialsN
 	newOrg := Organization{
 		Name:             name,
 		WebhookSecret:    secret,
-		CredentialsName:  credentialsName,
 		PoolBalancerType: poolBalancerType,
 	}

@ -59,7 +58,6 @@ func (s *sqlDatabase) CreateOrganization(ctx context.Context, name, credentialsN
 			return errors.Wrap(runnerErrors.ErrUnprocessable, "credentials have no endpoint")
 		}
 		newOrg.CredentialsID = &creds.ID
-		newOrg.CredentialsName = creds.Name
 		newOrg.EndpointName = creds.EndpointName

 		q := tx.Create(&newOrg)
@ -166,7 +164,6 @@ func (s *sqlDatabase) UpdateOrganization(ctx context.Context, orgID string, para
 		}

 		if param.CredentialsName != "" {
-			org.CredentialsName = param.CredentialsName
 			creds, err = s.getGithubCredentialsByName(ctx, tx, param.CredentialsName, false)
 			if err != nil {
 				return errors.Wrap(err, "fetching credentials")
--- a/database/sql/organizations_test.go
+++ b/database/sql/organizations_test.go
@ -53,8 +53,8 @@ type OrgTestSuite struct {
 	adminCtx    context.Context
 	adminUserID string

-	testCreds          params.GithubCredentials
-	secondaryTestCreds params.GithubCredentials
+	testCreds          params.ForgeCredentials
+	secondaryTestCreds params.ForgeCredentials
 	githubEndpoint     params.ForgeEndpoint
 }

--- a/database/sql/pools_test.go
+++ b/database/sql/pools_test.go
@ -211,7 +211,7 @@ func (s *PoolsTestSuite) TestEntityPoolOperations() {
 	ep := garmTesting.CreateDefaultGithubEndpoint(s.ctx, s.Store, s.T())
 	creds := garmTesting.CreateTestGithubCredentials(s.ctx, "test-creds", s.Store, s.T(), ep)
 	s.T().Cleanup(func() { s.Store.DeleteGithubCredentials(s.ctx, creds.ID) })
-	repo, err := s.Store.CreateRepository(s.ctx, "test-owner", "test-repo", creds.Name, "test-secret", params.PoolBalancerTypeRoundRobin)
+	repo, err := s.Store.CreateRepository(s.ctx, "test-owner", "test-repo", creds, "test-secret", params.PoolBalancerTypeRoundRobin)
 	s.Require().NoError(err)
 	s.Require().NotEmpty(repo.ID)
 	s.T().Cleanup(func() { s.Store.DeleteRepository(s.ctx, repo.ID) })
@ -291,7 +291,7 @@ func (s *PoolsTestSuite) TestListEntityInstances() {
 	ep := garmTesting.CreateDefaultGithubEndpoint(s.ctx, s.Store, s.T())
 	creds := garmTesting.CreateTestGithubCredentials(s.ctx, "test-creds", s.Store, s.T(), ep)
 	s.T().Cleanup(func() { s.Store.DeleteGithubCredentials(s.ctx, creds.ID) })
-	repo, err := s.Store.CreateRepository(s.ctx, "test-owner", "test-repo", creds.Name, "test-secret", params.PoolBalancerTypeRoundRobin)
+	repo, err := s.Store.CreateRepository(s.ctx, "test-owner", "test-repo", creds, "test-secret", params.PoolBalancerTypeRoundRobin)
 	s.Require().NoError(err)
 	s.Require().NotEmpty(repo.ID)
 	s.T().Cleanup(func() { s.Store.DeleteRepository(s.ctx, repo.ID) })
--- a/database/sql/repositories.go
+++ b/database/sql/repositories.go
@ -29,7 +29,7 @@ import (
 	"github.com/cloudbase/garm/params"
 )

-func (s *sqlDatabase) CreateRepository(ctx context.Context, owner, name, credentialsName, webhookSecret string, poolBalancerType params.PoolBalancerType) (param params.Repository, err error) {
+func (s *sqlDatabase) CreateRepository(ctx context.Context, owner, name string, credentials params.ForgeCredentials, webhookSecret string, poolBalancerType params.PoolBalancerType) (param params.Repository, err error) {
 	defer func() {
 		if err == nil {
 			s.sendNotify(common.RepositoryEntityType, common.CreateOperation, param)
@ -51,32 +51,32 @@ func (s *sqlDatabase) CreateRepository(ctx context.Context, owner, name, credent
 		PoolBalancerType: poolBalancerType,
 	}
 	err = s.conn.Transaction(func(tx *gorm.DB) error {
-		creds, err := s.getGithubCredentialsByName(ctx, tx, credentialsName, false)
-		if err != nil {
-			return errors.Wrap(err, "creating repository")
+		switch credentials.ForgeType {
+		case params.GithubEndpointType:
+			newRepo.CredentialsID = &credentials.ID
+		case params.GiteaEndpointType:
+			newRepo.GiteaCredentialsID = &credentials.ID
+		default:
+			return errors.Wrap(runnerErrors.ErrBadRequest, "unsupported credentials type")
 		}
-		if creds.EndpointName == nil {
-			return errors.Wrap(runnerErrors.ErrUnprocessable, "credentials have no endpoint")
-		}
-		newRepo.CredentialsID = &creds.ID
-		newRepo.CredentialsName = creds.Name
-		newRepo.EndpointName = creds.EndpointName

+		newRepo.EndpointName = &credentials.Endpoint.Name
 		q := tx.Create(&newRepo)
 		if q.Error != nil {
 			return errors.Wrap(q.Error, "creating repository")
 		}
-
-		newRepo.Credentials = creds
-		newRepo.Endpoint = creds.Endpoint
-
 		return nil
 	})
 	if err != nil {
 		return params.Repository{}, errors.Wrap(err, "creating repository")
 	}

-	param, err = s.sqlToCommonRepository(newRepo, true)
+	repo, err := s.getRepoByID(ctx, s.conn, newRepo.ID.String(), "Endpoint", "Credentials", "GiteaCredentials", "Credentials.Endpoint", "GiteaCredentials.Endpoint")
+	if err != nil {
+		return params.Repository{}, errors.Wrap(err, "creating repository")
+	}
+
+	param, err = s.sqlToCommonRepository(repo, true)
 	if err != nil {
 		return params.Repository{}, errors.Wrap(err, "creating repository")
 	}
@ -102,7 +102,9 @@ func (s *sqlDatabase) ListRepositories(_ context.Context) ([]params.Repository,
 	var repos []Repository
 	q := s.conn.
 		Preload("Credentials").
+		Preload("GiteaCredentials").
 		Preload("Credentials.Endpoint").
+		Preload("GiteaCredentials.Endpoint").
 		Preload("Endpoint").
 		Find(&repos)
 	if q.Error != nil {
@ -122,7 +124,7 @@ func (s *sqlDatabase) ListRepositories(_ context.Context) ([]params.Repository,
 }

 func (s *sqlDatabase) DeleteRepository(ctx context.Context, repoID string) (err error) {
-	repo, err := s.getRepoByID(ctx, s.conn, repoID, "Endpoint", "Credentials", "Credentials.Endpoint")
+	repo, err := s.getRepoByID(ctx, s.conn, repoID, "Endpoint", "Credentials", "Credentials.Endpoint", "GiteaCredentials", "GiteaCredentials.Endpoint")
 	if err != nil {
 		return errors.Wrap(err, "fetching repo")
 	}
@ -165,7 +167,6 @@ func (s *sqlDatabase) UpdateRepository(ctx context.Context, repoID string, param
 		}

 		if param.CredentialsName != "" {
-			repo.CredentialsName = param.CredentialsName
 			creds, err = s.getGithubCredentialsByName(ctx, tx, param.CredentialsName, false)
 			if err != nil {
 				return errors.Wrap(err, "fetching credentials")
@ -203,7 +204,7 @@ func (s *sqlDatabase) UpdateRepository(ctx context.Context, repoID string, param
 		return params.Repository{}, errors.Wrap(err, "saving repo")
 	}

-	repo, err = s.getRepoByID(ctx, s.conn, repoID, "Endpoint", "Credentials", "Credentials.Endpoint")
+	repo, err = s.getRepoByID(ctx, s.conn, repoID, "Endpoint", "Credentials", "Credentials.Endpoint", "GiteaCredentials", "GiteaCredentials.Endpoint")
 	if err != nil {
 		return params.Repository{}, errors.Wrap(err, "updating enterprise")
 	}
@ -216,7 +217,7 @@ func (s *sqlDatabase) UpdateRepository(ctx context.Context, repoID string, param
 }

 func (s *sqlDatabase) GetRepositoryByID(ctx context.Context, repoID string) (params.Repository, error) {
-	repo, err := s.getRepoByID(ctx, s.conn, repoID, "Pools", "Credentials", "Endpoint", "Credentials.Endpoint")
+	repo, err := s.getRepoByID(ctx, s.conn, repoID, "Pools", "Credentials", "Endpoint", "Credentials.Endpoint", "GiteaCredentials", "GiteaCredentials.Endpoint")
 	if err != nil {
 		return params.Repository{}, errors.Wrap(err, "fetching repo")
 	}
@ -234,6 +235,8 @@ func (s *sqlDatabase) getRepo(_ context.Context, owner, name, endpointName strin
 	q := s.conn.Where("name = ? COLLATE NOCASE and owner = ? COLLATE NOCASE and endpoint_name = ? COLLATE NOCASE", name, owner, endpointName).
 		Preload("Credentials").
 		Preload("Credentials.Endpoint").
+		Preload("GiteaCredentials").
+		Preload("GiteaCredentials.Endpoint").
 		Preload("Endpoint").
 		First(&repo)

--- a/database/sql/repositories_test.go
+++ b/database/sql/repositories_test.go
@ -58,8 +58,8 @@ type RepoTestSuite struct {
 	adminCtx    context.Context
 	adminUserID string

-	testCreds          params.GithubCredentials
-	secondaryTestCreds params.GithubCredentials
+	testCreds          params.ForgeCredentials
+	secondaryTestCreds params.ForgeCredentials
 	githubEndpoint     params.ForgeEndpoint
 }

@ -119,7 +119,7 @@ func (s *RepoTestSuite) SetupTest() {
 			adminCtx,
 			fmt.Sprintf("test-owner-%d", i),
 			fmt.Sprintf("test-repo-%d", i),
-			s.testCreds.Name,
+			s.testCreds,
 			fmt.Sprintf("test-webhook-secret-%d", i),
 			params.PoolBalancerTypeRoundRobin,
 		)
@ -204,7 +204,7 @@ func (s *RepoTestSuite) TestCreateRepository() {
 		s.adminCtx,
 		s.Fixtures.CreateRepoParams.Owner,
 		s.Fixtures.CreateRepoParams.Name,
-		s.Fixtures.CreateRepoParams.CredentialsName,
+		s.testCreds,
 		s.Fixtures.CreateRepoParams.WebhookSecret,
 		params.PoolBalancerTypeRoundRobin,
 	)
@ -238,7 +238,7 @@ func (s *RepoTestSuite) TestCreateRepositoryInvalidDBPassphrase() {
 		s.adminCtx,
 		s.Fixtures.CreateRepoParams.Owner,
 		s.Fixtures.CreateRepoParams.Name,
-		s.Fixtures.CreateRepoParams.CredentialsName,
+		s.testCreds,
 		s.Fixtures.CreateRepoParams.WebhookSecret,
 		params.PoolBalancerTypeRoundRobin,
 	)
@ -267,7 +267,7 @@ func (s *RepoTestSuite) TestCreateRepositoryInvalidDBCreateErr() {
 		s.adminCtx,
 		s.Fixtures.CreateRepoParams.Owner,
 		s.Fixtures.CreateRepoParams.Name,
-		s.Fixtures.CreateRepoParams.CredentialsName,
+		s.testCreds,
 		s.Fixtures.CreateRepoParams.WebhookSecret,
 		params.PoolBalancerTypeRoundRobin,
 	)
--- a/database/sql/scalesets_test.go
+++ b/database/sql/scalesets_test.go
@ -19,7 +19,7 @@ type ScaleSetsTestSuite struct {
 	suite.Suite
 	Store    dbCommon.Store
 	adminCtx context.Context
-	creds    params.GithubCredentials
+	creds    params.ForgeCredentials

 	org        params.Organization
 	repo       params.Repository
@ -53,7 +53,7 @@ func (s *ScaleSetsTestSuite) SetupTest() {
 		s.FailNow(fmt.Sprintf("failed to create org: %s", err))
 	}

-	s.repo, err = s.Store.CreateRepository(s.adminCtx, "test-org", "test-repo", s.creds.Name, "test-webhookSecret", params.PoolBalancerTypeRoundRobin)
+	s.repo, err = s.Store.CreateRepository(s.adminCtx, "test-org", "test-repo", s.creds, "test-webhookSecret", params.PoolBalancerTypeRoundRobin)
 	if err != nil {
 		s.FailNow(fmt.Sprintf("failed to create repo: %s", err))
 	}
--- a/database/sql/sql.go
+++ b/database/sql/sql.go
@ -435,6 +435,7 @@ func (s *sqlDatabase) migrateDB() error {
 		&User{},
 		&GithubEndpoint{},
 		&GithubCredentials{},
+		&GiteaCredentials{},
 		&Tag{},
 		&Pool{},
 		&Repository{},
--- a/database/sql/util.go
+++ b/database/sql/util.go
@ -27,6 +27,7 @@ import (
 	runnerErrors "github.com/cloudbase/garm-provider-common/errors"
 	commonParams "github.com/cloudbase/garm-provider-common/params"
 	"github.com/cloudbase/garm-provider-common/util"
+	"github.com/cloudbase/garm/auth"
 	dbCommon "github.com/cloudbase/garm/database/common"
 	"github.com/cloudbase/garm/params"
 )
@ -155,7 +156,7 @@ func (s *sqlDatabase) sqlToCommonOrganization(org Organization, detailed bool) (
 	}

 	if detailed {
-		creds, err := s.sqlToCommonGithubCredentials(org.Credentials)
+		creds, err := s.sqlToCommonForgeCredentials(org.Credentials)
 		if err != nil {
 			return params.Organization{}, errors.Wrap(err, "converting credentials")
 		}
@ -206,7 +207,7 @@ func (s *sqlDatabase) sqlToCommonEnterprise(enterprise Enterprise, detailed bool
 	}

 	if detailed {
-		creds, err := s.sqlToCommonGithubCredentials(enterprise.Credentials)
+		creds, err := s.sqlToCommonForgeCredentials(enterprise.Credentials)
 		if err != nil {
 			return params.Enterprise{}, errors.Wrap(err, "converting credentials")
 		}
@ -371,16 +372,28 @@ func (s *sqlDatabase) sqlToCommonRepository(repo Repository, detailed bool) (par
 		Endpoint:         endpoint,
 	}

+	if repo.CredentialsID != nil && repo.GiteaCredentialsID != nil {
+		return params.Repository{}, runnerErrors.NewConflictError("both gitea and github credentials are set for repo %s", repo.Name)
+	}
+
+	var forgeCreds params.ForgeCredentials
 	if repo.CredentialsID != nil {
 		ret.CredentialsID = *repo.CredentialsID
+		forgeCreds, err = s.sqlToCommonForgeCredentials(repo.Credentials)
+	}
+
+	if repo.GiteaCredentialsID != nil {
+		ret.CredentialsID = *repo.GiteaCredentialsID
+		forgeCreds, err = s.sqlGiteaToCommonForgeCredentials(repo.GiteaCredentials)
+	}
+
+	if err != nil {
+		return params.Repository{}, errors.Wrap(err, "converting credentials")
 	}

 	if detailed {
-		creds, err := s.sqlToCommonGithubCredentials(repo.Credentials)
-		if err != nil {
-			return params.Repository{}, errors.Wrap(err, "converting credentials")
-		}
-		ret.Credentials = creds
+		ret.Credentials = forgeCreds
+		ret.CredentialsName = forgeCreds.Name
 	}

 	if ret.PoolBalancerType == "" {
@ -638,7 +651,7 @@ func (s *sqlDatabase) addRepositoryEvent(ctx context.Context, repoID string, eve
 		return errors.Wrap(err, "updating instance")
 	}

-	msg := InstanceStatusUpdate{
+	msg := RepositoryEvent{
 		Message:    statusMessage,
 		EventType:  event,
 		EventLevel: eventLevel,
@ -653,8 +666,8 @@ func (s *sqlDatabase) addRepositoryEvent(ctx context.Context, repoID string, eve
 		if err != nil {
 			return errors.Wrap(runnerErrors.ErrBadRequest, "parsing id")
 		}
-		var latestEvents []OrganizationEvent
-		q := s.conn.Model(&OrganizationEvent{}).
+		var latestEvents []RepositoryEvent
+		q := s.conn.Model(&RepositoryEvent{}).
 			Limit(maxEvents).Order("id desc").
 			Where("repo_id = ?", repoID).Find(&latestEvents)
 		if q.Error != nil {
@ -662,7 +675,7 @@ func (s *sqlDatabase) addRepositoryEvent(ctx context.Context, repoID string, eve
 		}
 		if len(latestEvents) == maxEvents {
 			lastInList := latestEvents[len(latestEvents)-1]
-			if err := s.conn.Where("repo_id = ? and id < ?", repoID, lastInList.ID).Unscoped().Delete(&OrganizationEvent{}).Error; err != nil {
+			if err := s.conn.Where("repo_id = ? and id < ?", repoID, lastInList.ID).Unscoped().Delete(&RepositoryEvent{}).Error; err != nil {
 				return errors.Wrap(err, "deleting old events")
 			}
 		}
@ -676,7 +689,7 @@ func (s *sqlDatabase) addOrgEvent(ctx context.Context, orgID string, event param
 		return errors.Wrap(err, "updating instance")
 	}

-	msg := InstanceStatusUpdate{
+	msg := OrganizationEvent{
 		Message:    statusMessage,
 		EventType:  event,
 		EventLevel: eventLevel,
@ -714,7 +727,7 @@ func (s *sqlDatabase) addEnterpriseEvent(ctx context.Context, entID string, even
 		return errors.Wrap(err, "updating instance")
 	}

-	msg := InstanceStatusUpdate{
+	msg := EnterpriseEvent{
 		Message:    statusMessage,
 		EventType:  event,
 		EventLevel: eventLevel,
@ -763,3 +776,135 @@ func (s *sqlDatabase) AddEntityEvent(ctx context.Context, entity params.ForgeEnt
 		return errors.Wrap(runnerErrors.ErrBadRequest, "invalid entity type")
 	}
 }
+
+func (s *sqlDatabase) sqlToCommonForgeCredentials(creds GithubCredentials) (params.ForgeCredentials, error) {
+	if len(creds.Payload) == 0 {
+		return params.ForgeCredentials{}, errors.New("empty credentials payload")
+	}
+	data, err := util.Unseal(creds.Payload, []byte(s.cfg.Passphrase))
+	if err != nil {
+		return params.ForgeCredentials{}, errors.Wrap(err, "unsealing credentials")
+	}
+
+	ep, err := s.sqlToCommonGithubEndpoint(creds.Endpoint)
+	if err != nil {
+		return params.ForgeCredentials{}, errors.Wrap(err, "converting github endpoint")
+	}
+
+	commonCreds := params.ForgeCredentials{
+		ID:                 creds.ID,
+		Name:               creds.Name,
+		Description:        creds.Description,
+		APIBaseURL:         creds.Endpoint.APIBaseURL,
+		BaseURL:            creds.Endpoint.BaseURL,
+		UploadBaseURL:      creds.Endpoint.UploadBaseURL,
+		CABundle:           creds.Endpoint.CACertBundle,
+		AuthType:           creds.AuthType,
+		CreatedAt:          creds.CreatedAt,
+		UpdatedAt:          creds.UpdatedAt,
+		ForgeType:          creds.Endpoint.EndpointType,
+		Endpoint:           ep,
+		CredentialsPayload: data,
+	}
+
+	for _, repo := range creds.Repositories {
+		commonRepo, err := s.sqlToCommonRepository(repo, false)
+		if err != nil {
+			return params.ForgeCredentials{}, errors.Wrap(err, "converting github repository")
+		}
+		commonCreds.Repositories = append(commonCreds.Repositories, commonRepo)
+	}
+
+	for _, org := range creds.Organizations {
+		commonOrg, err := s.sqlToCommonOrganization(org, false)
+		if err != nil {
+			return params.ForgeCredentials{}, errors.Wrap(err, "converting github organization")
+		}
+		commonCreds.Organizations = append(commonCreds.Organizations, commonOrg)
+	}
+
+	for _, ent := range creds.Enterprises {
+		commonEnt, err := s.sqlToCommonEnterprise(ent, false)
+		if err != nil {
+			return params.ForgeCredentials{}, errors.Wrapf(err, "converting github enterprise: %s", ent.Name)
+		}
+		commonCreds.Enterprises = append(commonCreds.Enterprises, commonEnt)
+	}
+
+	return commonCreds, nil
+}
+
+func (s *sqlDatabase) sqlGiteaToCommonForgeCredentials(creds GiteaCredentials) (params.ForgeCredentials, error) {
+	if len(creds.Payload) == 0 {
+		return params.ForgeCredentials{}, errors.New("empty credentials payload")
+	}
+	data, err := util.Unseal(creds.Payload, []byte(s.cfg.Passphrase))
+	if err != nil {
+		return params.ForgeCredentials{}, errors.Wrap(err, "unsealing credentials")
+	}
+
+	ep, err := s.sqlToCommonGithubEndpoint(creds.Endpoint)
+	if err != nil {
+		return params.ForgeCredentials{}, errors.Wrap(err, "converting github endpoint")
+	}
+
+	commonCreds := params.ForgeCredentials{
+		ID:                 creds.ID,
+		Name:               creds.Name,
+		Description:        creds.Description,
+		APIBaseURL:         creds.Endpoint.APIBaseURL,
+		BaseURL:            creds.Endpoint.BaseURL,
+		CABundle:           creds.Endpoint.CACertBundle,
+		AuthType:           creds.AuthType,
+		CreatedAt:          creds.CreatedAt,
+		UpdatedAt:          creds.UpdatedAt,
+		ForgeType:          creds.Endpoint.EndpointType,
+		Endpoint:           ep,
+		CredentialsPayload: data,
+	}
+
+	for _, repo := range creds.Repositories {
+		commonRepo, err := s.sqlToCommonRepository(repo, false)
+		if err != nil {
+			return params.ForgeCredentials{}, errors.Wrap(err, "converting github repository")
+		}
+		commonCreds.Repositories = append(commonCreds.Repositories, commonRepo)
+	}
+
+	for _, org := range creds.Organizations {
+		commonOrg, err := s.sqlToCommonOrganization(org, false)
+		if err != nil {
+			return params.ForgeCredentials{}, errors.Wrap(err, "converting github organization")
+		}
+		commonCreds.Organizations = append(commonCreds.Organizations, commonOrg)
+	}
+
+	return commonCreds, nil
+}
+
+func (s *sqlDatabase) sqlToCommonGithubEndpoint(ep GithubEndpoint) (params.ForgeEndpoint, error) {
+	return params.ForgeEndpoint{
+		Name:          ep.Name,
+		Description:   ep.Description,
+		APIBaseURL:    ep.APIBaseURL,
+		BaseURL:       ep.BaseURL,
+		UploadBaseURL: ep.UploadBaseURL,
+		CACertBundle:  ep.CACertBundle,
+		CreatedAt:     ep.CreatedAt,
+		EndpointType:  ep.EndpointType,
+		UpdatedAt:     ep.UpdatedAt,
+	}, nil
+}
+
+func getUIDFromContext(ctx context.Context) (uuid.UUID, error) {
+	userID := auth.UserID(ctx)
+	if userID == "" {
+		return uuid.Nil, errors.Wrap(runnerErrors.ErrUnauthorized, "getting UID from context")
+	}
+
+	asUUID, err := uuid.Parse(userID)
+	if err != nil {
+		return uuid.Nil, errors.Wrap(runnerErrors.ErrUnauthorized, "parsing UID from context")
+	}
+	return asUUID, nil
+}