# `$HOME/git/` meta-repo origin on git.hacktivism.ch (2026-09-07)

## Remote

| Item | Value |
|------|--------|
| Host | **Forgejo rootless** `https://git.hacktivism.ch/` |
| Repo | **hernani/git** (meta-repo: non-secret globals only) |
| Visibility | **private** (`DEFAULT_PRIVATE` template is public — create with `private:true`) |
| Default branch | `main` |
| SSH clone (FQDN form) | `git@git.hacktivism.ch:hernani/git.git` |
| SSH URL (API form) | `ssh://git@git.hacktivism.ch:9200/hernani/git.git` |
| Local tree | `$HOME/git/` (`PATH[git-root]`) |

Unauth HTTPS browse of a private repo → **404** (expected).

## Local setup (done 2026-09-07 ~14:21)

```bash
cd "$HOME/git"
git remote add origin git@git.hacktivism.ch:hernani/git.git
git push -u origin main
```

SSH Host `git.hacktivism.ch`: `HostName 127.0.0.1`, `Port 9200`, `User git`, `ProxyJump hernani@koopa`, `IdentityFile ~/.ssh/id_ed25519`.

## Create via One-Shot-Token (on koopa)

Do **not** use xAI / host-expert-ssh mutate for this. SSH as `hernani` → local HTTP **9024**.

```bash
# unique token name (default gitea-admin may already exist)
podman exec koopa-forgejo gitea admin user generate-access-token \
  --username hernani \
  --token-name "oneshot-git-meta-$(date +%s)" \
  --scopes write:repository,write:admin \
  --raw
# → TOKEN (never log / never commit)

curl -sS -X POST \
  -H "Authorization: token ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"name":"git","private":true,"auto_init":false,"default_branch":"main"}' \
  http://127.0.0.1:9024/api/v1/admin/users/hernani/repos
# expect HTTP 201, full_name=hernani/git
```

Token delete via API often **403** with those scopes — purge leftover `oneshot-*` in Forgejo UI if needed.

## Related

- This admin-log’s own origin: `2026-07-10--admin-log-origin-forgejo.md` (public)
- Forgejo install: `2026-07-10--forgejo-rootless.md`
- Host skill quirk: private repos need explicit `private:true`
- Meta Must: no secrets / no child worktrees in this Forgejo repo