docs: Bonfire FEDERATE + Forgejo rootless (git :9024/:9200)

2026/2026-07-10--bonfire-federate.md

@@ -0,0 +1,61 @@
+# Bonfire — FEDERATE + public guest access (2026-07-10)
+
+Follow-up to ground zero: `2026-07-09--bonfire-ground-zero.md`.
+
+## Change
+
+| Item | Before | After |
+|------|--------|--------|
+| `.env` `FEDERATE` | unset | **`true`** |
+| Container | recreated | `podman-compose up -d --force-recreate web` |
+| `printenv FEDERATE` (web) | — | `true` |
+| `HOSTNAME` / compose | `bonfire.hacktivism.ch` | unchanged |
+| Port | **9021** → Caddy | unchanged |
+
+Only new env key vs ground-zero `.env`: **`FEDERATE`**.
+
+Live: `/home/hernani/koopa-bonfire/.env` (mode 600).  
+Mirror: `koopa-admin-secrets/koopa/home-hernani/koopa-bonfire/.env`.  
+Compose mirror: `configs/bonfire/compose.yml`.
+
+## Intent
+
+- Allow federation-related runtime paths (`FEDERATE` consumed in Bonfire `runtime.exs` as `true|yes|1`).
+- Keep **guest-readable** public surfaces (no login required for explore / profiles that are already public).
+- Operator stance: **federation enablement is accepted as OK** even if the UI banner lags.
+
+## Observed behaviour (after recreate)
+
+| Check | Result |
+|-------|--------|
+| Local `http://127.0.0.1:9021/` | 200; guest UI (Explore / Log in) |
+| Guest UI banner | still may show **“Federation disabled”** |
+| App RPC (earlier probe) | `activity_pub` instance sometimes still `federating: false`, `hostname: "localhost"` despite env |
+| Public profile `@foss` | public posts still visible (gitbot / FOSS content) |
+| Front / local feed | can be sparse (“That’s all for the last 30 days…”) depending on boundaries / feed window |
+
+So: **env is set and container healthy**; full ActivityPub “federating=true” in Application config may still need admin UI / deeper config if outbound federation is required later. Not blocking public profile timelines for guests.
+
+## Ops
+
+```bash
+cd ~/koopa-bonfire
+grep ^FEDERATE= .env
+podman exec koopa-bonfire printenv FEDERATE HOSTNAME
+podman ps --filter name=koopa-bonfire
+curl -sS -o /dev/null -w "%{http_code}\n" http://127.0.0.1:9021/
+curl -sS -o /dev/null -w "%{http_code}\n" http://127.0.0.1:9021/@foss
+```
+
+Recreate web after env change:
+
+```bash
+cd ~/koopa-bonfire
+set -a && source .env && set +a
+podman-compose up -d --force-recreate web
+```
+
+## Secrets / log rules
+
+- Values only in **`koopa-admin-secrets`**, not in this repo.
+- Daylog major bullet only (see `2026-07-10.md`).

2026/2026-07-10--forgejo-rootless.md

@@ -21,6 +21,10 @@ Do **not** switch to the non-rootless `forgejo:11` image under rootless podman:
 | SSH (git) | host **9200** → container 2222 (direct; not via Caddy) |
 | ROOT_URL | `https://git.hacktivism.ch/` |
 | Landing | explore (public browse OK) |
+| LE cert | automatic via Caddy (`CN=git.hacktivism.ch`) |
+
+Compose + redacted `app.ini`: `configs/forgejo/`.  
+Caddy site block: `configs/caddy/git.hacktivism.ch.caddy` (+ full `configs/caddy/Caddyfile`).
 
 ## Access policy
 
@@ -34,7 +38,8 @@ Do **not** switch to the non-rootless `forgejo:11` image under rootless podman:
 
 Reserved username `admin` cannot be used; first admin: **`hernani`**.
 
-Passwords: `~/koopa-forgejo/users.env` + DB/secrets in `.env` (mode 600). Mirror: `koopa-admin-secrets/…/koopa-forgejo/`.
+Passwords: `~/koopa-forgejo/users.env` + DB/secrets in `.env` (mode 600).  
+Mirror: `koopa-admin-secrets/koopa/home-hernani/koopa-forgejo/`.
 
 ## Start / status
 
@@ -44,13 +49,13 @@ set -a && source .env && set +a
 podman-compose up -d
 podman ps --filter name=koopa-forgejo
 curl -sS http://127.0.0.1:9024/api/healthz
+curl -sS https://git.hacktivism.ch/api/healthz
 ```
 
 ## Caddy (host root)
 
-Site block mirror: `configs/caddy/git.hacktivism.ch.caddy`.
-
-Also add `http://git.hacktivism.ch` to the shared ACME/redirect host list, then:
+Site block live in `/etc/caddy/Caddyfile` (mirror under `configs/caddy/`).  
+Prefer including `http://git.hacktivism.ch` in the shared ACME/redirect host list.
 
 ```bash
 sudo caddy validate --config /etc/caddy/Caddyfile
@@ -59,6 +64,6 @@ sudo systemctl reload caddy
 
 ## Notes
 
-- DNS already points `git.hacktivism.ch` at koopa (with other hacktivism names).
+- DNS: `git.hacktivism.ch` → koopa (same family as other `*.hacktivism.ch`).
 - Git over SSH: `ssh://git@git.hacktivism.ch:9200/…` (open **9200**/tcp on firewall/router if WAN access needed).
-- Until Caddy is reloaded, only `http://127.0.0.1:9024` works on host.
+- Clone URLs advertise `SSH_PORT=9200`; container still listens on internal **2222**.

2026/2026-07-10.md

@@ -3,4 +3,7 @@
 - landing mem snapshot fix (pipeline → 0 B)
 - Caddy redir / → /intro/ (three sites)
 - SECRETS.md paths only; no secret material in admin-log
-- **Forgejo rootless** on `git.hacktivism.ch` (:9024 / SSH :9200); no free registration
+- **Bonfire** `FEDERATE=true` (+ web recreate); guest public profiles OK; UI may still say federation disabled
+  → topic: `2026-07-10--bonfire-federate.md`; secrets: `koopa-admin-secrets/…/koopa-bonfire/`
+- **Forgejo rootless** on `git.hacktivism.ch` (HTTP **9024**, git-SSH **9200**); no free registration; admin `hernani`
+  → topic: `2026-07-10--forgejo-rootless.md`; secrets: `koopa-admin-secrets/…/koopa-forgejo/`