Forgejo rootless — git.hacktivism.ch (2026-07-10)

Emphasis: rootless

Forgejo is installed rootless end-to-end:

Image: codeberg.org/forgejo/forgejo:11-rootless (process runs as UID/GID 1000, not container root).
Podman: started as user hernani (rootless podman), not rootful.
Userns: userns_mode: keep-id so container 1000 maps to host hernani.
Bind mounts: ./data → /var/lib/gitea, ./config → /etc/gitea under ~/koopa-forgejo/.

Do not switch to the non-rootless forgejo:11 image under rootless podman: that image refuses to run as mapped root (Forgejo is not supposed to be run as root).

Stack

Item	Value
Path	`/home/hernani/koopa-forgejo/`
Containers	`koopa-forgejo` (rootless), `koopa-forgejo-db` (postgres:16-alpine)
HTTP	host 9024 → Caddy `git.hacktivism.ch`
SSH (git)	host 2222 → container 2222 (direct; not via Caddy)
ROOT_URL	`https://git.hacktivism.ch/`
Landing	explore (public browse OK)

Access policy

Setting	Value
`DISABLE_REGISTRATION`	true — no free self-signup
`SHOW_REGISTRATION_BUTTON`	false
OpenID signup/signin	false
Public site	readable without login (`REQUIRE_SIGNIN_VIEW=false`)
Accounts	admin-created only (`forgejo admin user create`)

Reserved username admin cannot be used; first admin: hernani.

Passwords: ~/koopa-forgejo/users.env + DB/secrets in .env (mode 600). Mirror: koopa-admin-secrets/…/koopa-forgejo/.

Start / status

cd ~/koopa-forgejo
set -a && source .env && set +a
podman-compose up -d
podman ps --filter name=koopa-forgejo
curl -sS http://127.0.0.1:9024/api/healthz

Caddy (host root)

Site block mirror: configs/caddy/git.hacktivism.ch.caddy.

Also add http://git.hacktivism.ch to the shared ACME/redirect host list, then:

sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy

Notes

DNS already points git.hacktivism.ch at koopa (with other hacktivism names).
Git over SSH: ssh://git@git.hacktivism.ch:2222/… (open 2222 on firewall/router if WAN access needed).
Until Caddy is reloaded, only http://127.0.0.1:9024 works on host.

2.3 KiB Raw Blame History