docs: new root as prior history lost (orphan + GC); ~215 commits not recoverable

2026/2026-07-10--forgejo-rootless.md

@@ -0,0 +1,90 @@
+# Forgejo rootless — git.hacktivism.ch (2026-07-10)
+
+## Emphasis: rootless
+
+Forgejo is installed **rootless end-to-end**:
+
+1. **Image:** `codeberg.org/forgejo/forgejo:11-rootless` (process runs as UID/GID **1000**, not container root).
+2. **Podman:** started as user **hernani** (rootless podman), **not** rootful.
+3. **Userns:** `userns_mode: keep-id` so container 1000 maps to host hernani.
+4. **Bind mounts:** `./data` → `/var/lib/gitea`, `./config` → `/etc/gitea` under `~/koopa-forgejo/`.
+
+Do **not** switch to the non-rootless `forgejo:11` image under rootless podman: that image refuses to run as mapped root (`Forgejo is not supposed to be run as root`).
+
+## Stack
+
+| Item | Value |
+|------|--------|
+| Path | `/home/hernani/koopa-forgejo/` |
+| Containers | `koopa-forgejo` (**rootless**), `koopa-forgejo-db` (postgres:16-alpine) |
+| HTTP | host **9024** → Caddy `git.hacktivism.ch` |
+| SSH (git) | host **9200** → container 2222 (direct; not via Caddy) |
+| ROOT_URL | `https://git.hacktivism.ch/` |
+| Landing | explore (public browse OK) |
+| LE cert | automatic via Caddy (`CN=git.hacktivism.ch`) |
+
+Compose + redacted `app.ini`: `configs/forgejo/`.  
+Caddy site block: `configs/caddy/git.hacktivism.ch.caddy` (+ full `configs/caddy/Caddyfile`).
+
+## Access policy
+
+| Setting | Value |
+|---------|--------|
+| `DISABLE_REGISTRATION` | **true** — no free self-signup |
+| `SHOW_REGISTRATION_BUTTON` | **false** |
+| OpenID signup/signin | **false** |
+| Public site | readable without login (`REQUIRE_SIGNIN_VIEW=false`) |
+| Accounts | admin-created only (`forgejo admin user create`) |
+
+Reserved username `admin` cannot be used; first admin: **`hernani`**.
+
+Passwords: `~/koopa-forgejo/users.env` + DB/secrets in `.env` (mode 600).  
+Mirror: `koopa-admin-secrets/koopa/home-hernani/koopa-forgejo/`.
+
+## Start / status
+
+```bash
+cd ~/koopa-forgejo
+set -a && source .env && set +a
+podman-compose up -d
+podman ps --filter name=koopa-forgejo
+curl -sS http://127.0.0.1:9024/api/healthz
+curl -sS https://git.hacktivism.ch/api/healthz
+```
+
+## Caddy (host root)
+
+Live `/etc/caddy/Caddyfile` matches `configs/caddy/Caddyfile` (applied 2026-07-10; `http://git.` in ACME list; SSH note **9200**).
+
+Site block live in `/etc/caddy/Caddyfile` (mirror under `configs/caddy/`).  
+Prefer including `http://git.hacktivism.ch` in the shared ACME/redirect host list.
+
+```bash
+sudo caddy validate --config /etc/caddy/Caddyfile
+sudo systemctl reload caddy
+```
+
+## Network exposure (2026-07-10)
+
+| Layer | Rule |
+|-------|------|
+| **VeciGate IPv4** | WAN **9200** → `192.168.100.95:9200`; hairpin LAN/LAN2 → public A:9200 |
+| **VeciGate IPv6** | WAN→LAN forward **tcp/9200** |
+| **koopa firewalld** | `public` **9200/tcp** (verified 2026-07-10: LAN + hairpin + `ssh -T`) |
+
+Docs: `../vecigate-admin-log` (`ip/firewall/nat/`, `ipv6/firewall/filter/`, `docs/CHANGELOG.md`);  
+host ports: `configs/firewalld/public-ports.md`.
+
+```bash
+# host
+sudo firewall-cmd --permanent --add-port=9200/tcp && sudo firewall-cmd --reload
+# client
+ssh -p 9200 -T git@git.hacktivism.ch
+```
+
+## Notes
+
+- DNS: `git.hacktivism.ch` → koopa (same family as other `*.hacktivism.ch`).
+- Git over SSH: `ssh://git@git.hacktivism.ch:9200/…`
+- Clone URLs advertise `SSH_PORT=9200`; container still listens on internal **2222**.
+- Admin-log origin: `hernani/koopa-admin-log` on this Forgejo — see `2026-07-10--admin-log-origin-forgejo.md`.