Forgejo rootless — git.hacktivism.ch (2026-07-10)

Emphasis: rootless

Forgejo is installed rootless end-to-end:

Image: codeberg.org/forgejo/forgejo:11-rootless (process runs as UID/GID 1000, not container root).
Podman: started as user hernani (rootless podman), not rootful.
Userns: userns_mode: keep-id so container 1000 maps to host hernani.
Bind mounts: ./data → /var/lib/gitea, ./config → /etc/gitea under ~/koopa-forgejo/.

Do not switch to the non-rootless forgejo:11 image under rootless podman: that image refuses to run as mapped root (Forgejo is not supposed to be run as root).

Stack

Item	Value
Path	`/home/hernani/koopa-forgejo/`
Containers	`koopa-forgejo` (rootless), `koopa-forgejo-db` (postgres:16-alpine)
HTTP	host 9024 → Caddy `git.hacktivism.ch`
SSH (git)	host 9200 → container 2222 (direct; not via Caddy)
ROOT_URL	`https://git.hacktivism.ch/`
Landing	explore (public browse OK)
LE cert	automatic via Caddy (`CN=git.hacktivism.ch`)

Compose + redacted app.ini: configs/forgejo/.
Caddy site block: configs/caddy/git.hacktivism.ch.caddy (+ full configs/caddy/Caddyfile).

Access policy

Setting	Value
`DISABLE_REGISTRATION`	true — no free self-signup
`SHOW_REGISTRATION_BUTTON`	false
OpenID signup/signin	false
Public site	readable without login (`REQUIRE_SIGNIN_VIEW=false`)
Accounts	admin-created only (`forgejo admin user create`)

Reserved username admin cannot be used; first admin: hernani.

Passwords: ~/koopa-forgejo/users.env + DB/secrets in .env (mode 600).
Mirror: koopa-admin-secrets/koopa/home-hernani/koopa-forgejo/.

Start / status

cd ~/koopa-forgejo
set -a && source .env && set +a
podman-compose up -d
podman ps --filter name=koopa-forgejo
curl -sS http://127.0.0.1:9024/api/healthz
curl -sS https://git.hacktivism.ch/api/healthz

Caddy (host root)

Site block live in /etc/caddy/Caddyfile (mirror under configs/caddy/).
Prefer including http://git.hacktivism.ch in the shared ACME/redirect host list.

sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy

Network exposure (2026-07-10)

Layer	Rule
VeciGate IPv4	WAN 9200 → `192.168.100.95:9200`; hairpin LAN/LAN2 → public A:9200
VeciGate IPv6	WAN→LAN forward tcp/9200
koopa firewalld	`public` 9200/tcp

Docs: ../vecigate-admin-log (ip/firewall/nat/, ipv6/firewall/filter/, docs/CHANGELOG.md);
host ports: configs/firewalld/public-ports.md.

# host
sudo firewall-cmd --permanent --add-port=9200/tcp && sudo firewall-cmd --reload
# client
ssh -p 9200 -T git@git.hacktivism.ch

Notes

DNS: git.hacktivism.ch → koopa (same family as other *.hacktivism.ch).
Git over SSH: ssh://git@git.hacktivism.ch:9200/…
Clone URLs advertise SSH_PORT=9200; container still listens on internal 2222.
Admin-log origin: hernani/koopa-admin-log on this Forgejo — see 2026-07-10--admin-log-origin-forgejo.md.

3.2 KiB Raw Blame History