57 lines
2.2 KiB
Markdown
57 lines
2.2 KiB
Markdown
# Forgejo host RO users (rabbithole-ro, amanita-ro, firecuda-ro)
|
|
|
|
Created 2026-10-20 on koopa Forgejo for targeted **read-only** clones of selected `hernani/*` repos (replace host-local tree copies via git, no rsync/scp of SoT).
|
|
|
|
## Users
|
|
|
|
| Username | ID | Email | Flags |
|
|
|----------|----|-------|-------|
|
|
| `rabbithole-ro` | 182 | `rabbithole-ro@hosts.hacktivism.ch` | active, restricted, not admin |
|
|
| `amanita-ro` | 183 | `amanita-ro@hosts.hacktivism.ch` | active, restricted, not admin |
|
|
| `firecuda-ro` | 184 | `firecuda-ro@hosts.hacktivism.ch` | active, restricted, not admin |
|
|
|
|
## Repo access
|
|
|
|
- Collaborator **read** on `hernani/waldpfad` (all three).
|
|
- SSH user keys titled `*-host-ro` (ed25519) uploaded via oneshot admin token.
|
|
|
|
## Secrets (enc only)
|
|
|
|
Laptop SoT (git-crypt):
|
|
|
|
`PATH[koopa-admin-secrets-enc]/koopa/home-hernani/koopa-forgejo/hosts/{rabbithole,amanita,firecuda}-ro/`
|
|
|
|
Per host: `password.txt` (600), `ssh/id_ed25519` (+ `.pub`), `README.md`. Never commit plaintext; never grant write collab.
|
|
|
|
## Create recipe (idempotent)
|
|
|
|
On koopa as `hernani`, Forgejo HTTP **9024**:
|
|
|
|
```bash
|
|
podman exec koopa-forgejo gitea admin user create \
|
|
--username USER --email USER@hosts.hacktivism.ch \
|
|
--random-password --must-change-password=false --restricted
|
|
```
|
|
|
|
SSH key + read collab via oneshot token (`write:admin,write:repository,write:user`) against `http://127.0.0.1:9024/api/v1`:
|
|
|
|
- `POST /admin/users/USER/keys` with `{"title","key"}`
|
|
- `PUT /repos/hernani/waldpfad/collaborators/USER` with `{"permission":"read"}`
|
|
|
|
Purge leftover `oneshot-*` tokens in Forgejo UI (API delete often 403). Wipe `/tmp/*.pub` / oneshot scripts after use.
|
|
|
|
## Clone pattern (on target host)
|
|
|
|
```bash
|
|
GIT_SSH_COMMAND='ssh -i /path/to/id_ed25519 -o IdentitiesOnly=yes -o BatchMode=yes' \
|
|
git clone --depth 1 --single-branch --branch master \
|
|
ssh://git@git.hacktivism.ch:9200/hernani/waldpfad.git
|
|
```
|
|
|
|
Or Host stanza with `IdentityFile` for that RO key and `User git` / Port 9200 (ProxyJump as needed).
|
|
|
|
## Related
|
|
|
|
- Forgejo rootless: `2026-07-10--forgejo-rootless.md`
|
|
- Oneshot token pattern: `2026-09-07--git-meta-origin-forgejo.md`
|
|
- Host skill: Forgejo ports 9200 SSH / 9024 HTTP; secrets always `*enc`
|