hernani/koopa-admin-log
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

docs: forgejo host RO users rabbithole/amanita/firecuda-ro

Browse source
This commit is contained in:
Hernâni Marques 2026-10-21 02:51:00 +02:00
parent fe0c1e2b53
commit eb4349085d
No known key found for this signature in database
GPG key ID: CB5738652768F7E9
1 changed files with 57 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

57
2026/2026-10-20--forgejo-host-ro-users.md Normal file
View file

@ -0,0 +1,57 @@
# Forgejo host RO users (rabbithole-ro, amanita-ro, firecuda-ro)
Created 2026-10-20 on koopa Forgejo for targeted **read-only** clones of selected `hernani/*` repos (replace host-local tree copies via git, no rsync/scp of SoT).
## Users
| Username | ID | Email | Flags |
|----------|----|-------|-------|
| `rabbithole-ro` | 182 | `rabbithole-ro@hosts.hacktivism.ch` | active, restricted, not admin |
| `amanita-ro` | 183 | `amanita-ro@hosts.hacktivism.ch` | active, restricted, not admin |
| `firecuda-ro` | 184 | `firecuda-ro@hosts.hacktivism.ch` | active, restricted, not admin |
## Repo access
- Collaborator **read** on `hernani/waldpfad` (all three).
- SSH user keys titled `*-host-ro` (ed25519) uploaded via oneshot admin token.
## Secrets (enc only)
Laptop SoT (git-crypt):
`PATH[koopa-admin-secrets-enc]/koopa/home-hernani/koopa-forgejo/hosts/{rabbithole,amanita,firecuda}-ro/`
Per host: `password.txt` (600), `ssh/id_ed25519` (+ `.pub`), `README.md`. Never commit plaintext; never grant write collab.
## Create recipe (idempotent)
On koopa as `hernani`, Forgejo HTTP **9024**:
```bash
podman exec koopa-forgejo gitea admin user create \
--username USER --email USER@hosts.hacktivism.ch \
--random-password --must-change-password=false --restricted
```
SSH key + read collab via oneshot token (`write:admin,write:repository,write:user`) against `http://127.0.0.1:9024/api/v1`:
- `POST /admin/users/USER/keys` with `{"title","key"}`
- `PUT /repos/hernani/waldpfad/collaborators/USER` with `{"permission":"read"}`
Purge leftover `oneshot-*` tokens in Forgejo UI (API delete often 403). Wipe `/tmp/*.pub` / oneshot scripts after use.
## Clone pattern (on target host)
```bash
GIT_SSH_COMMAND='ssh -i /path/to/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes' \
git clone --depth 1 --single-branch --branch master \
ssh://git@git.hacktivism.ch:9200/hernani/waldpfad.git
```
Or Host stanza with `IdentityFile` for that RO key and `User git` / Port 9200 (ProxyJump as needed).
## Related
- Forgejo rootless: `2026-07-10--forgejo-rootless.md`
- Oneshot token pattern: `2026-09-07--git-meta-origin-forgejo.md`
- Host skill: Forgejo ports 9200 SSH / 9024 HTTP; secrets always `*enc`