Forgejo at git.makefuture.ro
The forge for makefuture.io and campfire-custom, on the web box
(178.104.116.235) alongside the site, the multiplayer relay and Campfire.
Caddy terminates TLS and proxies the web UI to the container over the
web-edge Docker network. Git over SSH cannot be proxied by Caddy — it is not
HTTP — so it has its own listener on port 2222.
https://git.makefuture.ro/ web UI, git over HTTPS
ssh://git@git.makefuture.ro:2222/ git over SSH
/opt/web/apps/forgejo/data/ repositories, SQLite DB, LFS, app.ini
First admin account
The web installer is disabled (INSTALL_LOCK = true) and sign-ups are closed,
so there is no wizard to race — the first admin is made on the box:
ssh root@178.104.116.235 "docker exec -u git forgejo forgejo admin user create \
--admin --username YOUR_NAME --email YOU@EXAMPLE.COM --random-password"
It prints a generated password once. You are forced to change it at first
login. Pass the password with --password only if you enjoy having it in your
shell history and in ps output on a machine other people can reach.
Then add your public key at Settings → SSH / GPG Keys, and check it:
ssh -T -p 2222 git@git.makefuture.ro
Moving the repositories here
Create the two empty repositories in the UI first (they default to private —
see DEFAULT_PRIVATE in the compose file), then, from each working copy:
git remote add forge ssh://git@git.makefuture.ro:2222/YOUR_NAME/makefuture.io.git
git push forge --all
git push forge --tags
Nothing is destroyed by this: origin still points at GitHub afterwards. Swap
which remote is canonical only once you have pushed and cloned back once.
CI, and the thing that will break
Deployment currently runs from GitHub Actions (.github/workflows/deploy.yml),
using the DEPLOY_HOST and DEPLOY_SSH_KEY secrets in the GitHub repository.
Moving the canonical remote here does not move that. Forgejo Actions is enabled
and is GitHub-Actions-compatible, but it needs two things that do not exist yet:
- A runner. Forgejo does not execute workflows itself. A
forgejo-runner
container has to be registered against this instance with a token from
Site Administration → Actions → Runners, which requires the admin account
above — which is why this is not already done.
- The secrets again.
DEPLOY_HOST and DEPLOY_SSH_KEY have to be recreated
under the repository's Actions settings here. The CI keypair is
~/.ssh/makefuture_ci; its public half is already in the box's
/root/.ssh/authorized_keys.
Until both exist, keep pushing to GitHub as well, or deploy by hand:
DEPLOY_HOST=178.104.116.235 ./scripts/deploy.sh
Backups
/opt/web/apps/forgejo/data/ is the entire forge — repositories, database,
config. Back up that one directory. It sits next to the other two stateful
paths on this box, /opt/web/apps/campfire/storage/ and
/opt/web/apps/campfire/.env.
A note on the firewall
ufw on this box allows only 22, 80 and 443, and yet 2222 is reachable from
the internet. That is not a mistake in the rules — Docker inserts its own
iptables rules ahead of ufw's, so published container ports bypass ufw
entirely. Here that is the behaviour we want. It is worth knowing before
assuming ufw status describes what is actually exposed on this machine.