diff --git a/2026/2026-07-10--forgejo-rootless.md b/2026/2026-07-10--forgejo-rootless.md
new file mode 100644
index 0000000..f00cff1
--- /dev/null
+++ b/2026/2026-07-10--forgejo-rootless.md
@@ -0,0 +1,64 @@
+# Forgejo rootless — git.hacktivism.ch (2026-07-10)
+
+## Emphasis: rootless
+
+Forgejo is installed **rootless end-to-end**:
+
+1. **Image:** `codeberg.org/forgejo/forgejo:11-rootless` (process runs as UID/GID **1000**, not container root).
+2. **Podman:** started as user **hernani** (rootless podman), **not** rootful.
+3. **Userns:** `userns_mode: keep-id` so container 1000 maps to host hernani.
+4. **Bind mounts:** `./data` → `/var/lib/gitea`, `./config` → `/etc/gitea` under `~/koopa-forgejo/`.
+
+Do **not** switch to the non-rootless `forgejo:11` image under rootless podman: that image refuses to run as mapped root (`Forgejo is not supposed to be run as root`).
+
+## Stack
+
+| Item | Value |
+|------|--------|
+| Path | `/home/hernani/koopa-forgejo/` |
+| Containers | `koopa-forgejo` (**rootless**), `koopa-forgejo-db` (postgres:16-alpine) |
+| HTTP | host **9024** → Caddy `git.hacktivism.ch` |
+| SSH (git) | host **2222** → container 2222 (direct; not via Caddy) |
+| ROOT_URL | `https://git.hacktivism.ch/` |
+| Landing | explore (public browse OK) |
+
+## Access policy
+
+| Setting | Value |
+|---------|--------|
+| `DISABLE_REGISTRATION` | **true** — no free self-signup |
+| `SHOW_REGISTRATION_BUTTON` | **false** |
+| OpenID signup/signin | **false** |
+| Public site | readable without login (`REQUIRE_SIGNIN_VIEW=false`) |
+| Accounts | admin-created only (`forgejo admin user create`) |
+
+Reserved username `admin` cannot be used; first admin: **`hernani`**.
+
+Passwords: `~/koopa-forgejo/users.env` + DB/secrets in `.env` (mode 600). Mirror: `koopa-admin-secrets/…/koopa-forgejo/`.
+
+## Start / status
+
+```bash
+cd ~/koopa-forgejo
+set -a && source .env && set +a
+podman-compose up -d
+podman ps --filter name=koopa-forgejo
+curl -sS http://127.0.0.1:9024/api/healthz
+```
+
+## Caddy (host root)
+
+Site block mirror: `configs/caddy/git.hacktivism.ch.caddy`.
+
+Also add `http://git.hacktivism.ch` to the shared ACME/redirect host list, then:
+
+```bash
+sudo caddy validate --config /etc/caddy/Caddyfile
+sudo systemctl reload caddy
+```
+
+## Notes
+
+- DNS already points `git.hacktivism.ch` at koopa (with other hacktivism names).
+- Git over SSH: `ssh://git@git.hacktivism.ch:2222/…` (open **2222** on firewall/router if WAN access needed).
+- Until Caddy is reloaded, only `http://127.0.0.1:9024` works on host.
diff --git a/2026/2026-07-10.md b/2026/2026-07-10.md
index 9a1c514..cff0176 100644
--- a/2026/2026-07-10.md
+++ b/2026/2026-07-10.md
@@ -3,3 +3,4 @@
 - landing mem snapshot fix (pipeline → 0 B)
 - Caddy redir / → /intro/ (three sites)
 - SECRETS.md paths only; no secret material in admin-log
+- **Forgejo rootless** on `git.hacktivism.ch` (:9024 / SSH :2222); no free registration
diff --git a/README.md b/README.md
index d6dabb8..e66834b 100644
--- a/README.md
+++ b/README.md
@@ -29,11 +29,12 @@ scripts/                   # merchant, exchange, monitoring helpers
 | `taler-exchange-hacktivism` | exchange | **9011** |
 | `taler-bank-hacktivism` | libeufin-bank (GOA, no IBAN) | **9012** |
 | `koopa-castopod` (+ mariadb/redis) | Castopod Fediverse podcast | **9020** |
+| `koopa-forgejo` (+ postgres) | **Forgejo rootless** git | **9024** (+ SSH **2222**) |
 
 Start model (Taler): **root** `/root/start_base_services_*` → shell as service user → `/usr/local/bin/start_*.sh [--restart]`.  
 Start model (Castopod): `hernani` → `cd ~/koopa-castopod && podman-compose up -d`.
 
-Public hosts: `taler.` / `exchange.` / `bank.` / **`castopod.hacktivism.ch`** (Caddy → 9010/9011/9012/**9020**).
+Public hosts: `taler.` / `exchange.` / `bank.` / `castopod.` / **`git.hacktivism.ch`** (Caddy → 9010–9012 / 9020 / **9024**).
 
 Service **details**: `configs/taler-*`, `scripts/*`.  
 Host-wide picture: **`host/overview/services.md`**.  
@@ -49,4 +50,4 @@ Router: **`../vecigate-admin-log`**.
 `configs/taler-exchange/README.md` (section "/keys, Wire and Account").
 
 **Castopod pilot content (FOSS Airwaves, user ngi, free licenses):**  
-`2026/2026-07-09--castopod-content.md` → https://castopod.hacktivism.ch/@foss
+`2026/2026-07-09--castopod-content.md` → https://castopod.hacktivism.ch` / **`git.hacktivism.ch/@foss
diff --git a/SECRETS.md b/SECRETS.md
index 90a78b9..9fda90b 100644
--- a/SECRETS.md
+++ b/SECRETS.md
@@ -20,6 +20,7 @@ Live passwords/keys live in sibling **`koopa-admin-secrets`**.
 | Castopod | `koopa/home-hernani/koopa-castopod/{.env,users.env}` | `~/koopa-castopod/` |
 | Bonfire | `koopa/home-hernani/koopa-bonfire/{.env,users.env}` | `~/koopa-bonfire/` |
 | Prime (Jellyfin + qBittorrent) | `koopa/home-hernani/koopa-prime/{.env,users.env}` | `~/koopa-prime/` |
+| Forgejo (**rootless**) | `koopa/home-hernani/koopa-forgejo/{.env,users.env}` | `~/koopa-forgejo/` |
 
 ## Rules
 
diff --git a/configs/caddy/git.hacktivism.ch.caddy b/configs/caddy/git.hacktivism.ch.caddy
new file mode 100644
index 0000000..c20d9a7
--- /dev/null
+++ b/configs/caddy/git.hacktivism.ch.caddy
@@ -0,0 +1,15 @@
+# 9024 forgejo HTTP (SSH :2222 host-direct, not via Caddy)
+# Apply on host: merge into /etc/caddy/Caddyfile, validate, reload
+git.hacktivism.ch {
+	header Alt-Svc "clear"
+	reverse_proxy 127.0.0.1:9024 {
+		header_up Host {host}
+		header_up X-Forwarded-For {remote_host}
+		header_up X-Forwarded-Proto {scheme}
+		flush_interval -1
+		transport http {
+			read_timeout 3600s
+			write_timeout 3600s
+		}
+	}
+}
diff --git a/configs/forgejo/compose.yml b/configs/forgejo/compose.yml
new file mode 100644
index 0000000..df3df7c
--- /dev/null
+++ b/configs/forgejo/compose.yml
@@ -0,0 +1,84 @@
+# koopa-forgejo — ROOTLESS Forgejo image + rootless podman (user hernani)
+# Site: https://git.hacktivism.ch  |  HTTP :9024  |  SSH :2222
+services:
+  forgejo:
+    image: codeberg.org/forgejo/forgejo:11-rootless
+    container_name: koopa-forgejo
+    restart: unless-stopped
+    user: "1000:1000"
+    userns_mode: keep-id
+    env_file: [.env]
+    environment:
+      USER_UID: "1000"
+      USER_GID: "1000"
+      FORGEJO__database__DB_TYPE: postgres
+      FORGEJO__database__HOST: db:5432
+      FORGEJO__database__NAME: forgejo
+      FORGEJO__database__USER: forgejo
+      FORGEJO__database__PASSWD: ${FORGEJO_DB_PASSWORD}
+      FORGEJO__server__DOMAIN: git.hacktivism.ch
+      FORGEJO__server__SSH_DOMAIN: git.hacktivism.ch
+      FORGEJO__server__ROOT_URL: https://git.hacktivism.ch/
+      FORGEJO__server__HTTP_PORT: "3000"
+      FORGEJO__server__SSH_PORT: "2222"
+      FORGEJO__server__SSH_LISTEN_PORT: "2222"
+      FORGEJO__server__START_SSH_SERVER: "true"
+      FORGEJO__server__DISABLE_SSH: "false"
+      FORGEJO__server__LANDING_PAGE: explore
+      FORGEJO__service__DISABLE_REGISTRATION: "true"
+      FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: "false"
+      FORGEJO__service__SHOW_REGISTRATION_BUTTON: "false"
+      FORGEJO__service__REQUIRE_SIGNIN_VIEW: "false"
+      FORGEJO__service__DEFAULT_ALLOW_CREATE_ORGANIZATION: "true"
+      FORGEJO__openid__ENABLE_OPENID_SIGNIN: "false"
+      FORGEJO__openid__ENABLE_OPENID_SIGNUP: "false"
+      FORGEJO__repository__DEFAULT_PRIVATE: public
+      FORGEJO__repository__ENABLE_PUSH_CREATE_USER: "true"
+      FORGEJO__repository__ENABLE_PUSH_CREATE_ORG: "true"
+      FORGEJO__security__INSTALL_LOCK: "true"
+      FORGEJO__session__PROVIDER: memory
+      FORGEJO__log__LEVEL: Info
+      FORGEJO____APP_NAME: "hacktivism git"
+    ports:
+      - "9024:3000"
+      - "2222:2222"
+    volumes:
+      - ./data:/var/lib/gitea
+      - ./config:/etc/gitea
+      - /etc/localtime:/etc/localtime:ro
+    depends_on:
+      db:
+        condition: service_healthy
+    labels:
+      org.hacktivism.service: forgejo
+      org.hacktivism.variant: rootless
+      org.hacktivism.host_port: "9024"
+      org.hacktivism.ssh_port: "2222"
+      org.hacktivism.site: git.hacktivism.ch
+      org.hacktivism.managed_by: koopa-admin
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/api/healthz"]
+      interval: 30s
+      timeout: 10s
+      retries: 10
+      start_period: 90s
+
+  db:
+    image: docker.io/library/postgres:16-alpine
+    container_name: koopa-forgejo-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: forgejo
+      POSTGRES_PASSWORD: ${FORGEJO_DB_PASSWORD}
+      POSTGRES_DB: forgejo
+    volumes:
+      - db-data:/var/lib/postgresql/data
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U forgejo -d forgejo"]
+      interval: 5s
+      timeout: 5s
+      retries: 20
+      start_period: 10s
+
+volumes:
+  db-data: