# Forgejo host RO users (rabbithole-ro, amanita-ro, firecuda-ro)

Created 2026-10-20 on koopa Forgejo for targeted **read-only** clones of selected `hernani/*` repos (replace host-local tree copies via git, no rsync/scp of SoT).

## Users

| Username | ID | Email | Flags |
|----------|----|-------|-------|
| `rabbithole-ro` | 182 | `rabbithole-ro@hosts.hacktivism.ch` | active, restricted, not admin |
| `amanita-ro` | 183 | `amanita-ro@hosts.hacktivism.ch` | active, restricted, not admin |
| `firecuda-ro` | 184 | `firecuda-ro@hosts.hacktivism.ch` | active, restricted, not admin |

## Repo access

- Collaborator **read** on `hernani/waldpfad` (all three).
- SSH user keys titled `*-host-ro` (ed25519) uploaded via oneshot admin token.

## Secrets (enc only)

Laptop SoT (git-crypt):

`PATH[koopa-admin-secrets-enc]/koopa/home-hernani/koopa-forgejo/hosts/{rabbithole,amanita,firecuda}-ro/`

Per host: `password.txt` (600), `ssh/id_ed25519` (+ `.pub`), `README.md`. Never commit plaintext; never grant write collab.

## Create recipe (idempotent)

On koopa as `hernani`, Forgejo HTTP **9024**:

```bash
podman exec koopa-forgejo gitea admin user create \
  --username USER --email USER@hosts.hacktivism.ch \
  --random-password --must-change-password=false --restricted
```

SSH key + read collab via oneshot token (`write:admin,write:repository,write:user`) against `http://127.0.0.1:9024/api/v1`:

- `POST /admin/users/USER/keys` with `{"title","key"}`
- `PUT /repos/hernani/waldpfad/collaborators/USER` with `{"permission":"read"}`

Purge leftover `oneshot-*` tokens in Forgejo UI (API delete often 403). Wipe `/tmp/*.pub` / oneshot scripts after use.

## Clone pattern (on target host)

```bash
GIT_SSH_COMMAND='ssh -i /path/to/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes' \
  git clone --depth 1 --single-branch --branch master \
  ssh://git@git.hacktivism.ch:9200/hernani/waldpfad.git
```

Or Host stanza with `IdentityFile` for that RO key and `User git` / Port 9200 (ProxyJump as needed).

## Related

- Forgejo rootless: `2026-07-10--forgejo-rootless.md`
- Oneshot token pattern: `2026-09-07--git-meta-origin-forgejo.md`
- Host skill: Forgejo ports 9200 SSH / 9024 HTTP; secrets always `*enc`