diff --git a/2026/2026-10-20--forgejo-host-ro-users.md b/2026/2026-10-20--forgejo-host-ro-users.md
new file mode 100644
index 0000000..e602ad3
--- /dev/null
+++ b/2026/2026-10-20--forgejo-host-ro-users.md
@@ -0,0 +1,57 @@
+# Forgejo host RO users (rabbithole-ro, amanita-ro, firecuda-ro)
+
+Created 2026-10-20 on koopa Forgejo for targeted **read-only** clones of selected `hernani/*` repos (replace host-local tree copies via git, no rsync/scp of SoT).
+
+## Users
+
+| Username | ID | Email | Flags |
+|----------|----|-------|-------|
+| `rabbithole-ro` | 182 | `rabbithole-ro@hosts.hacktivism.ch` | active, restricted, not admin |
+| `amanita-ro` | 183 | `amanita-ro@hosts.hacktivism.ch` | active, restricted, not admin |
+| `firecuda-ro` | 184 | `firecuda-ro@hosts.hacktivism.ch` | active, restricted, not admin |
+
+## Repo access
+
+- Collaborator **read** on `hernani/waldpfad` (all three).
+- SSH user keys titled `*-host-ro` (ed25519) uploaded via oneshot admin token.
+
+## Secrets (enc only)
+
+Laptop SoT (git-crypt):
+
+`PATH[koopa-admin-secrets-enc]/koopa/home-hernani/koopa-forgejo/hosts/{rabbithole,amanita,firecuda}-ro/`
+
+Per host: `password.txt` (600), `ssh/id_ed25519` (+ `.pub`), `README.md`. Never commit plaintext; never grant write collab.
+
+## Create recipe (idempotent)
+
+On koopa as `hernani`, Forgejo HTTP **9024**:
+
+```bash
+podman exec koopa-forgejo gitea admin user create \
+  --username USER --email USER@hosts.hacktivism.ch \
+  --random-password --must-change-password=false --restricted
+```
+
+SSH key + read collab via oneshot token (`write:admin,write:repository,write:user`) against `http://127.0.0.1:9024/api/v1`:
+
+- `POST /admin/users/USER/keys` with `{"title","key"}`
+- `PUT /repos/hernani/waldpfad/collaborators/USER` with `{"permission":"read"}`
+
+Purge leftover `oneshot-*` tokens in Forgejo UI (API delete often 403). Wipe `/tmp/*.pub` / oneshot scripts after use.
+
+## Clone pattern (on target host)
+
+```bash
+GIT_SSH_COMMAND='ssh -i /path/to/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes' \
+  git clone --depth 1 --single-branch --branch master \
+  ssh://git@git.hacktivism.ch:9200/hernani/waldpfad.git
+```
+
+Or Host stanza with `IdentityFile` for that RO key and `User git` / Port 9200 (ProxyJump as needed).
+
+## Related
+
+- Forgejo rootless: `2026-07-10--forgejo-rootless.md`
+- Oneshot token pattern: `2026-09-07--git-meta-origin-forgejo.md`
+- Host skill: Forgejo ports 9200 SSH / 9024 HTTP; secrets always `*enc`