64 lines
2.3 KiB
Markdown
64 lines
2.3 KiB
Markdown
# Forgejo rootless — git.hacktivism.ch (2026-07-10)
|
|
|
|
## Emphasis: rootless
|
|
|
|
Forgejo is installed **rootless end-to-end**:
|
|
|
|
1. **Image:** `codeberg.org/forgejo/forgejo:11-rootless` (process runs as UID/GID **1000**, not container root).
|
|
2. **Podman:** started as user **hernani** (rootless podman), **not** rootful.
|
|
3. **Userns:** `userns_mode: keep-id` so container 1000 maps to host hernani.
|
|
4. **Bind mounts:** `./data` → `/var/lib/gitea`, `./config` → `/etc/gitea` under `~/koopa-forgejo/`.
|
|
|
|
Do **not** switch to the non-rootless `forgejo:11` image under rootless podman: that image refuses to run as mapped root (`Forgejo is not supposed to be run as root`).
|
|
|
|
## Stack
|
|
|
|
| Item | Value |
|
|
|------|--------|
|
|
| Path | `/home/hernani/koopa-forgejo/` |
|
|
| Containers | `koopa-forgejo` (**rootless**), `koopa-forgejo-db` (postgres:16-alpine) |
|
|
| HTTP | host **9024** → Caddy `git.hacktivism.ch` |
|
|
| SSH (git) | host **9200** → container 2222 (direct; not via Caddy) |
|
|
| ROOT_URL | `https://git.hacktivism.ch/` |
|
|
| Landing | explore (public browse OK) |
|
|
|
|
## Access policy
|
|
|
|
| Setting | Value |
|
|
|---------|--------|
|
|
| `DISABLE_REGISTRATION` | **true** — no free self-signup |
|
|
| `SHOW_REGISTRATION_BUTTON` | **false** |
|
|
| OpenID signup/signin | **false** |
|
|
| Public site | readable without login (`REQUIRE_SIGNIN_VIEW=false`) |
|
|
| Accounts | admin-created only (`forgejo admin user create`) |
|
|
|
|
Reserved username `admin` cannot be used; first admin: **`hernani`**.
|
|
|
|
Passwords: `~/koopa-forgejo/users.env` + DB/secrets in `.env` (mode 600). Mirror: `koopa-admin-secrets/…/koopa-forgejo/`.
|
|
|
|
## Start / status
|
|
|
|
```bash
|
|
cd ~/koopa-forgejo
|
|
set -a && source .env && set +a
|
|
podman-compose up -d
|
|
podman ps --filter name=koopa-forgejo
|
|
curl -sS http://127.0.0.1:9024/api/healthz
|
|
```
|
|
|
|
## Caddy (host root)
|
|
|
|
Site block mirror: `configs/caddy/git.hacktivism.ch.caddy`.
|
|
|
|
Also add `http://git.hacktivism.ch` to the shared ACME/redirect host list, then:
|
|
|
|
```bash
|
|
sudo caddy validate --config /etc/caddy/Caddyfile
|
|
sudo systemctl reload caddy
|
|
```
|
|
|
|
## Notes
|
|
|
|
- DNS already points `git.hacktivism.ch` at koopa (with other hacktivism names).
|
|
- Git over SSH: `ssh://git@git.hacktivism.ch:9200/…` (open **9200**/tcp on firewall/router if WAN access needed).
|
|
- Until Caddy is reloaded, only `http://127.0.0.1:9024` works on host.
|