Forgejo rootless — git.hacktivism.ch (2026-07-10)

Emphasis: rootless

Forgejo is installed rootless end-to-end:

Image: codeberg.org/forgejo/forgejo:11-rootless (process runs as UID/GID 1000, not container root).
Podman: started as user hernani (rootless podman), not rootful.
Userns: userns_mode: keep-id so container 1000 maps to host hernani.
Bind mounts: ./data → /var/lib/gitea, ./config → /etc/gitea under ~/koopa-forgejo/.

Do not switch to the non-rootless forgejo:11 image under rootless podman: that image refuses to run as mapped root (Forgejo is not supposed to be run as root).

Stack

Item	Value
Path	`/home/hernani/koopa-forgejo/`
Containers	`koopa-forgejo` (rootless), `koopa-forgejo-db` (postgres:16-alpine)
HTTP	host 9024 → Caddy `git.hacktivism.ch`
SSH (git)	host 9200 → container 2222 (direct; not via Caddy)
ROOT_URL	`https://git.hacktivism.ch/`
Landing	explore (public browse OK)
LE cert	automatic via Caddy (`CN=git.hacktivism.ch`)

Compose + redacted app.ini: configs/forgejo/.
Caddy site block: configs/caddy/git.hacktivism.ch.caddy (+ full configs/caddy/Caddyfile).

Access policy

Setting	Value
`DISABLE_REGISTRATION`	true — no free self-signup
`SHOW_REGISTRATION_BUTTON`	false
OpenID signup/signin	false
Public site	readable without login (`REQUIRE_SIGNIN_VIEW=false`)
Accounts	admin-created only (`forgejo admin user create`)

Reserved username admin cannot be used; first admin: hernani.

Passwords: ~/koopa-forgejo/users.env + DB/secrets in .env (mode 600).
Mirror: koopa-admin-secrets/koopa/home-hernani/koopa-forgejo/.

Start / status

cd ~/koopa-forgejo
set -a && source .env && set +a
podman-compose up -d
podman ps --filter name=koopa-forgejo
curl -sS http://127.0.0.1:9024/api/healthz
curl -sS https://git.hacktivism.ch/api/healthz

Caddy (host root)

Site block live in /etc/caddy/Caddyfile (mirror under configs/caddy/).
Prefer including http://git.hacktivism.ch in the shared ACME/redirect host list.

sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy

Notes

DNS: git.hacktivism.ch → koopa (same family as other *.hacktivism.ch).
Git over SSH: ssh://git@git.hacktivism.ch:9200/… (open 9200/tcp on firewall/router if WAN access needed).
Clone URLs advertise SSH_PORT=9200; container still listens on internal 2222.

2.6 KiB Raw Blame History