# Forgejo rootless — git.hacktivism.ch (2026-07-10)

## Emphasis: rootless

Forgejo is installed **rootless end-to-end**:

1. **Image:** `codeberg.org/forgejo/forgejo:11-rootless` (process runs as UID/GID **1000**, not container root).
2. **Podman:** started as user **hernani** (rootless podman), **not** rootful.
3. **Userns:** `userns_mode: keep-id` so container 1000 maps to host hernani.
4. **Bind mounts:** `./data` → `/var/lib/gitea`, `./config` → `/etc/gitea` under `~/koopa-forgejo/`.

Do **not** switch to the non-rootless `forgejo:11` image under rootless podman: that image refuses to run as mapped root (`Forgejo is not supposed to be run as root`).

## Stack

| Item | Value |
|------|--------|
| Path | `/home/hernani/koopa-forgejo/` |
| Containers | `koopa-forgejo` (**rootless**), `koopa-forgejo-db` (postgres:16-alpine) |
| HTTP | host **9024** → Caddy `git.hacktivism.ch` |
| SSH (git) | host **9200** → container 2222 (direct; not via Caddy) |
| ROOT_URL | `https://git.hacktivism.ch/` |
| Landing | explore (public browse OK) |
| LE cert | automatic via Caddy (`CN=git.hacktivism.ch`) |

Compose + redacted `app.ini`: `configs/forgejo/`.  
Caddy site block: `configs/caddy/git.hacktivism.ch.caddy` (+ full `configs/caddy/Caddyfile`).

## Access policy

| Setting | Value |
|---------|--------|
| `DISABLE_REGISTRATION` | **true** — no free self-signup |
| `SHOW_REGISTRATION_BUTTON` | **false** |
| OpenID signup/signin | **false** |
| Public site | readable without login (`REQUIRE_SIGNIN_VIEW=false`) |
| Accounts | admin-created only (`forgejo admin user create`) |

Reserved username `admin` cannot be used; first admin: **`hernani`**.

Passwords: `~/koopa-forgejo/users.env` + DB/secrets in `.env` (mode 600).  
Mirror: `koopa-admin-secrets/koopa/home-hernani/koopa-forgejo/`.

## Start / status

```bash
cd ~/koopa-forgejo
set -a && source .env && set +a
podman-compose up -d
podman ps --filter name=koopa-forgejo
curl -sS http://127.0.0.1:9024/api/healthz
curl -sS https://git.hacktivism.ch/api/healthz
```

## Caddy (host root)

Site block live in `/etc/caddy/Caddyfile` (mirror under `configs/caddy/`).  
Prefer including `http://git.hacktivism.ch` in the shared ACME/redirect host list.

```bash
sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy
```

## Network exposure (2026-07-10)

| Layer | Rule |
|-------|------|
| **VeciGate IPv4** | WAN **9200** → `192.168.100.95:9200`; hairpin LAN/LAN2 → public A:9200 |
| **VeciGate IPv6** | WAN→LAN forward **tcp/9200** |
| **koopa firewalld** | `public` **9200/tcp** |

Docs: `../vecigate-admin-log` (`ip/firewall/nat/`, `ipv6/firewall/filter/`, `docs/CHANGELOG.md`);  
host ports: `configs/firewalld/public-ports.md`.

```bash
# host
sudo firewall-cmd --permanent --add-port=9200/tcp && sudo firewall-cmd --reload
# client
ssh -p 9200 -T git@git.hacktivism.ch
```

## Notes

- DNS: `git.hacktivism.ch` → koopa (same family as other `*.hacktivism.ch`).
- Git over SSH: `ssh://git@git.hacktivism.ch:9200/…`
- Clone URLs advertise `SSH_PORT=9200`; container still listens on internal **2222**.
- Admin-log origin: `hernani/koopa-admin-log` on this Forgejo — see `2026-07-10--admin-log-origin-forgejo.md`.