fa20edf2e9
Live /etc/caddy/Caddyfile matches configs/caddy mirror. Record daylog, forgejo note, and close LOCAL-CHANGES-PENDING Caddy items.
90 lines
3.3 KiB
Markdown
90 lines
3.3 KiB
Markdown
# Forgejo rootless — git.hacktivism.ch (2026-07-10)
|
|
|
|
## Emphasis: rootless
|
|
|
|
Forgejo is installed **rootless end-to-end**:
|
|
|
|
1. **Image:** `codeberg.org/forgejo/forgejo:11-rootless` (process runs as UID/GID **1000**, not container root).
|
|
2. **Podman:** started as user **hernani** (rootless podman), **not** rootful.
|
|
3. **Userns:** `userns_mode: keep-id` so container 1000 maps to host hernani.
|
|
4. **Bind mounts:** `./data` → `/var/lib/gitea`, `./config` → `/etc/gitea` under `~/koopa-forgejo/`.
|
|
|
|
Do **not** switch to the non-rootless `forgejo:11` image under rootless podman: that image refuses to run as mapped root (`Forgejo is not supposed to be run as root`).
|
|
|
|
## Stack
|
|
|
|
| Item | Value |
|
|
|------|--------|
|
|
| Path | `/home/hernani/koopa-forgejo/` |
|
|
| Containers | `koopa-forgejo` (**rootless**), `koopa-forgejo-db` (postgres:16-alpine) |
|
|
| HTTP | host **9024** → Caddy `git.hacktivism.ch` |
|
|
| SSH (git) | host **9200** → container 2222 (direct; not via Caddy) |
|
|
| ROOT_URL | `https://git.hacktivism.ch/` |
|
|
| Landing | explore (public browse OK) |
|
|
| LE cert | automatic via Caddy (`CN=git.hacktivism.ch`) |
|
|
|
|
Compose + redacted `app.ini`: `configs/forgejo/`.
|
|
Caddy site block: `configs/caddy/git.hacktivism.ch.caddy` (+ full `configs/caddy/Caddyfile`).
|
|
|
|
## Access policy
|
|
|
|
| Setting | Value |
|
|
|---------|--------|
|
|
| `DISABLE_REGISTRATION` | **true** — no free self-signup |
|
|
| `SHOW_REGISTRATION_BUTTON` | **false** |
|
|
| OpenID signup/signin | **false** |
|
|
| Public site | readable without login (`REQUIRE_SIGNIN_VIEW=false`) |
|
|
| Accounts | admin-created only (`forgejo admin user create`) |
|
|
|
|
Reserved username `admin` cannot be used; first admin: **`hernani`**.
|
|
|
|
Passwords: `~/koopa-forgejo/users.env` + DB/secrets in `.env` (mode 600).
|
|
Mirror: `koopa-admin-secrets/koopa/home-hernani/koopa-forgejo/`.
|
|
|
|
## Start / status
|
|
|
|
```bash
|
|
cd ~/koopa-forgejo
|
|
set -a && source .env && set +a
|
|
podman-compose up -d
|
|
podman ps --filter name=koopa-forgejo
|
|
curl -sS http://127.0.0.1:9024/api/healthz
|
|
curl -sS https://git.hacktivism.ch/api/healthz
|
|
```
|
|
|
|
## Caddy (host root)
|
|
|
|
Live `/etc/caddy/Caddyfile` matches `configs/caddy/Caddyfile` (applied 2026-07-10; `http://git.` in ACME list; SSH note **9200**).
|
|
|
|
Site block live in `/etc/caddy/Caddyfile` (mirror under `configs/caddy/`).
|
|
Prefer including `http://git.hacktivism.ch` in the shared ACME/redirect host list.
|
|
|
|
```bash
|
|
sudo caddy validate --config /etc/caddy/Caddyfile
|
|
sudo systemctl reload caddy
|
|
```
|
|
|
|
## Network exposure (2026-07-10)
|
|
|
|
| Layer | Rule |
|
|
|-------|------|
|
|
| **VeciGate IPv4** | WAN **9200** → `192.168.100.95:9200`; hairpin LAN/LAN2 → public A:9200 |
|
|
| **VeciGate IPv6** | WAN→LAN forward **tcp/9200** |
|
|
| **koopa firewalld** | `public` **9200/tcp** (verified 2026-07-10: LAN + hairpin + `ssh -T`) |
|
|
|
|
Docs: `../vecigate-admin-log` (`ip/firewall/nat/`, `ipv6/firewall/filter/`, `docs/CHANGELOG.md`);
|
|
host ports: `configs/firewalld/public-ports.md`.
|
|
|
|
```bash
|
|
# host
|
|
sudo firewall-cmd --permanent --add-port=9200/tcp && sudo firewall-cmd --reload
|
|
# client
|
|
ssh -p 9200 -T git@git.hacktivism.ch
|
|
```
|
|
|
|
## Notes
|
|
|
|
- DNS: `git.hacktivism.ch` → koopa (same family as other `*.hacktivism.ch`).
|
|
- Git over SSH: `ssh://git@git.hacktivism.ch:9200/…`
|
|
- Clone URLs advertise `SSH_PORT=9200`; container still listens on internal **2222**.
|
|
- Admin-log origin: `hernani/koopa-admin-log` on this Forgejo — see `2026-07-10--admin-log-origin-forgejo.md`.
|