docs: Forgejo rootless on git.hacktivism.ch (no free signup)

2026/2026-07-10--forgejo-rootless.md

@@ -0,0 +1,64 @@
+# Forgejo rootless — git.hacktivism.ch (2026-07-10)
+
+## Emphasis: rootless
+
+Forgejo is installed **rootless end-to-end**:
+
+1. **Image:** `codeberg.org/forgejo/forgejo:11-rootless` (process runs as UID/GID **1000**, not container root).
+2. **Podman:** started as user **hernani** (rootless podman), **not** rootful.
+3. **Userns:** `userns_mode: keep-id` so container 1000 maps to host hernani.
+4. **Bind mounts:** `./data` → `/var/lib/gitea`, `./config` → `/etc/gitea` under `~/koopa-forgejo/`.
+
+Do **not** switch to the non-rootless `forgejo:11` image under rootless podman: that image refuses to run as mapped root (`Forgejo is not supposed to be run as root`).
+
+## Stack
+
+| Item | Value |
+|------|--------|
+| Path | `/home/hernani/koopa-forgejo/` |
+| Containers | `koopa-forgejo` (**rootless**), `koopa-forgejo-db` (postgres:16-alpine) |
+| HTTP | host **9024** → Caddy `git.hacktivism.ch` |
+| SSH (git) | host **2222** → container 2222 (direct; not via Caddy) |
+| ROOT_URL | `https://git.hacktivism.ch/` |
+| Landing | explore (public browse OK) |
+
+## Access policy
+
+| Setting | Value |
+|---------|--------|
+| `DISABLE_REGISTRATION` | **true** — no free self-signup |
+| `SHOW_REGISTRATION_BUTTON` | **false** |
+| OpenID signup/signin | **false** |
+| Public site | readable without login (`REQUIRE_SIGNIN_VIEW=false`) |
+| Accounts | admin-created only (`forgejo admin user create`) |
+
+Reserved username `admin` cannot be used; first admin: **`hernani`**.
+
+Passwords: `~/koopa-forgejo/users.env` + DB/secrets in `.env` (mode 600). Mirror: `koopa-admin-secrets/…/koopa-forgejo/`.
+
+## Start / status
+
+```bash
+cd ~/koopa-forgejo
+set -a && source .env && set +a
+podman-compose up -d
+podman ps --filter name=koopa-forgejo
+curl -sS http://127.0.0.1:9024/api/healthz
+```
+
+## Caddy (host root)
+
+Site block mirror: `configs/caddy/git.hacktivism.ch.caddy`.
+
+Also add `http://git.hacktivism.ch` to the shared ACME/redirect host list, then:
+
+```bash
+sudo caddy validate --config /etc/caddy/Caddyfile
+sudo systemctl reload caddy
+```
+
+## Notes
+
+- DNS already points `git.hacktivism.ch` at koopa (with other hacktivism names).
+- Git over SSH: `ssh://git@git.hacktivism.ch:2222/…` (open **2222** on firewall/router if WAN access needed).
+- Until Caddy is reloaded, only `http://127.0.0.1:9024` works on host.

2026/2026-07-10.md

@@ -3,3 +3,4 @@
 - landing mem snapshot fix (pipeline → 0 B)
 - Caddy redir / → /intro/ (three sites)
 - SECRETS.md paths only; no secret material in admin-log
+- **Forgejo rootless** on `git.hacktivism.ch` (:9024 / SSH :2222); no free registration