docs: Bonfire FEDERATE + Forgejo rootless (git :9024/:9200)

configs/forgejo/README.md

@@ -0,0 +1,36 @@
+# Forgejo — git.hacktivism.ch
+
+**Rootless** install (image + rootless podman as `hernani`). Details: `2026/2026-07-10--forgejo-rootless.md`.
+
+| Item | Value |
+|------|--------|
+| Live path | `/home/hernani/koopa-forgejo/` |
+| Compose | `compose.yml` (this dir = mirror) |
+| Image | `codeberg.org/forgejo/forgejo:11-rootless` |
+| HTTP | **9024** → Caddy `git.hacktivism.ch` |
+| Git SSH | **9200** → container 2222 (not via Caddy) |
+| DB | `koopa-forgejo-db` postgres:16-alpine |
+| Registration | **disabled** (admin-created users only) |
+| Admin user | `hernani` (not reserved name `admin`) |
+
+## Files here
+
+| File | Notes |
+|------|--------|
+| `compose.yml` | live mirror |
+| `app.ini.example` | redacted live `data/custom/conf/app.ini` (`@inline-secret@`) |
+
+## Secrets
+
+`koopa-admin-secrets/koopa/home-hernani/koopa-forgejo/{.env,users.env}`  
+→ live `~/koopa-forgejo/`.
+
+## Ops
+
+```bash
+cd ~/koopa-forgejo
+set -a && source .env && set +a
+podman-compose up -d
+curl -sS http://127.0.0.1:9024/api/healthz
+# SSH clone: ssh://git@git.hacktivism.ch:9200/<user>/<repo>.git
+```

configs/forgejo/app.ini.example

@@ -0,0 +1,79 @@
+APP_NAME = hacktivism git
+RUN_USER = git
+RUN_MODE = prod
+WORK_PATH = /var/lib/gitea
+
+[repository]
+ROOT = /var/lib/gitea/git/repositories
+ENABLE_PUSH_CREATE_USER = true
+ENABLE_PUSH_CREATE_ORG = true
+DEFAULT_PRIVATE = public
+
+[repository.local]
+LOCAL_COPY_PATH = /tmp/gitea/local-repo
+
+[repository.upload]
+TEMP_PATH = /tmp/gitea/uploads
+
+[server]
+APP_DATA_PATH = /var/lib/gitea
+SSH_DOMAIN = git.hacktivism.ch
+HTTP_PORT = 3000
+ROOT_URL = https://git.hacktivism.ch/
+DISABLE_SSH = false
+; In rootless gitea container only internal ssh server is supported
+START_SSH_SERVER = true
+SSH_PORT = 9200
+SSH_LISTEN_PORT = 2222
+BUILTIN_SSH_SERVER_USER = git
+LFS_START_SERVER = 
+DOMAIN = git.hacktivism.ch
+LANDING_PAGE = explore
+
+[database]
+PATH = /var/lib/gitea/data/gitea.db
+DB_TYPE = postgres
+HOST = db:5432
+NAME = forgejo
+USER = forgejo
+PASSWD = @inline-secret@
+
+[session]
+PROVIDER_CONFIG = /var/lib/gitea/data/sessions
+PROVIDER = memory
+
+[picture]
+AVATAR_UPLOAD_PATH = /var/lib/gitea/data/avatars
+REPOSITORY_AVATAR_UPLOAD_PATH = /var/lib/gitea/data/repo-avatars
+
+[attachment]
+PATH = /var/lib/gitea/data/attachments
+
+[log]
+ROOT_PATH = /var/lib/gitea/data/log
+LEVEL = Info
+
+[security]
+INSTALL_LOCK = true
+SECRET_KEY = @inline-secret@
+REVERSE_PROXY_LIMIT = 1
+REVERSE_PROXY_TRUSTED_PROXIES = *
+INTERNAL_TOKEN = @inline-secret@
+
+[service]
+DISABLE_REGISTRATION = true
+REQUIRE_SIGNIN_VIEW = false
+SHOW_REGISTRATION_BUTTON = false
+DEFAULT_ALLOW_CREATE_ORGANIZATION = true
+ALLOW_ONLY_EXTERNAL_REGISTRATION = false
+
+[lfs]
+PATH = /var/lib/gitea/git/lfs
+
+[openid]
+ENABLE_OPENID_SIGNUP = false
+ENABLE_OPENID_SIGNIN = false
+
+[oauth2]
+JWT_SECRET = @inline-secret@
+