Forgejo host RO users (rabbithole-ro, amanita-ro, firecuda-ro)

Created 2026-10-20 on koopa Forgejo for targeted read-only clones of selected hernani/* repos (replace host-local tree copies via git, no rsync/scp of SoT).

Users

Username	ID	Email	Flags
`rabbithole-ro`	182	`rabbithole-ro@hosts.hacktivism.ch`	active, restricted, not admin
`amanita-ro`	183	`amanita-ro@hosts.hacktivism.ch`	active, restricted, not admin
`firecuda-ro`	184	`firecuda-ro@hosts.hacktivism.ch`	active, restricted, not admin

Repo access

Collaborator read on hernani/waldpfad (all three).
SSH user keys titled *-host-ro (ed25519) uploaded via oneshot admin token.

Secrets (enc only)

Laptop SoT (git-crypt):

PATH[koopa-admin-secrets-enc]/koopa/home-hernani/koopa-forgejo/hosts/{rabbithole,amanita,firecuda}-ro/

Per host: password.txt (600), ssh/id_ed25519 (+ .pub), README.md. Never commit plaintext; never grant write collab.

Create recipe (idempotent)

On koopa as hernani, Forgejo HTTP 9024:

podman exec koopa-forgejo gitea admin user create \
  --username USER --email USER@hosts.hacktivism.ch \
  --random-password --must-change-password=false --restricted

SSH key + read collab via oneshot token (write:admin,write:repository,write:user) against http://127.0.0.1:9024/api/v1:

POST /admin/users/USER/keys with {"title","key"}
PUT /repos/hernani/waldpfad/collaborators/USER with {"permission":"read"}

Purge leftover oneshot-* tokens in Forgejo UI (API delete often 403). Wipe /tmp/*.pub / oneshot scripts after use.

Clone pattern (on target host)

GIT_SSH_COMMAND='ssh -i /path/to/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes' \
  git clone --depth 1 --single-branch --branch master \
  ssh://git@git.hacktivism.ch:9200/hernani/waldpfad.git

Or Host stanza with IdentityFile for that RO key and User git / Port 9200 (ProxyJump as needed).

Forgejo rootless: 2026-07-10--forgejo-rootless.md
Oneshot token pattern: 2026-09-07--git-meta-origin-forgejo.md
Host skill: Forgejo ports 9200 SSH / 9024 HTTP; secrets always *enc

2.2 KiB Raw Blame History