hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: Bonfire FEDERATE + Forgejo rootless (git :9024/:9200)

Browse source
This commit is contained in:
Hernâni Marques 2026-07-10 14:41:46 +02:00
parent b0efda7731
commit 40ec803464
No known key found for this signature in database
13 changed files with 422 additions and 123 deletions
Download patch file Download diff file Expand all files Collapse all files

17
2026/2026-07-10--forgejo-rootless.md
View file

@ -21,6 +21,10 @@ Do **not** switch to the non-rootless `forgejo:11` image under rootless podman:
| SSH (git) | host **9200** → container 2222 (direct; not via Caddy) |
| ROOT_URL | `https://git.hacktivism.ch/` |
| Landing | explore (public browse OK) |
| LE cert | automatic via Caddy (`CN=git.hacktivism.ch`) |
Compose + redacted `app.ini`: `configs/forgejo/`.
Caddy site block: `configs/caddy/git.hacktivism.ch.caddy` (+ full `configs/caddy/Caddyfile`).
## Access policy
@ -34,7 +38,8 @@ Do **not** switch to the non-rootless `forgejo:11` image under rootless podman:
Reserved username `admin` cannot be used; first admin: **`hernani`**.
Passwords: `~/koopa-forgejo/users.env` + DB/secrets in `.env` (mode 600). Mirror: `koopa-admin-secrets/…/koopa-forgejo/`.
Passwords: `~/koopa-forgejo/users.env` + DB/secrets in `.env` (mode 600).
Mirror: `koopa-admin-secrets/koopa/home-hernani/koopa-forgejo/`.
## Start / status
@ -44,13 +49,13 @@ set -a && source .env && set +a
podman-compose up -d
podman ps --filter name=koopa-forgejo
curl -sS http://127.0.0.1:9024/api/healthz
curl -sS https://git.hacktivism.ch/api/healthz
```
## Caddy (host root)
Site block mirror: `configs/caddy/git.hacktivism.ch.caddy`.
Also add `http://git.hacktivism.ch` to the shared ACME/redirect host list, then:
Site block live in `/etc/caddy/Caddyfile` (mirror under `configs/caddy/`).
Prefer including `http://git.hacktivism.ch` in the shared ACME/redirect host list.
```bash
sudo caddy validate --config /etc/caddy/Caddyfile
@ -59,6 +64,6 @@ sudo systemctl reload caddy
## Notes
- DNS already points `git.hacktivism.ch` at koopa (with other hacktivism names).
- DNS: `git.hacktivism.ch` → koopa (same family as other `*.hacktivism.ch`).
- Git over SSH: `ssh://git@git.hacktivism.ch:9200/…` (open **9200**/tcp on firewall/router if WAN access needed).
- Until Caddy is reloaded, only `http://127.0.0.1:9024` works on host.
- Clone URLs advertise `SSH_PORT=9200`; container still listens on internal **2222**.