Forgejo at git.makefuture.ro

The forge for makefuture.io and campfire-custom, on the web box (178.104.116.235) alongside the site, the multiplayer relay and Campfire.

Caddy terminates TLS and proxies the web UI to the container over the web-edge Docker network. Git over SSH cannot be proxied by Caddy — it is not HTTP — so it has its own listener on port 2222.

https://git.makefuture.ro/            web UI, git over HTTPS
ssh://git@git.makefuture.ro:2222/     git over SSH
/opt/web/apps/forgejo/data/           repositories, SQLite DB, LFS, app.ini

First admin account

The web installer is disabled (INSTALL_LOCK = true) and sign-ups are closed, so there is no wizard to race — the first admin is made on the box:

ssh root@178.104.116.235 "docker exec -u git forgejo forgejo admin user create \
  --admin --username YOUR_NAME --email YOU@EXAMPLE.COM --random-password"

It prints a generated password once. You are forced to change it at first login. Pass the password with --password only if you enjoy having it in your shell history and in ps output on a machine other people can reach.

Then add your public key at Settings → SSH / GPG Keys, and check it:

ssh -T -p 2222 git@git.makefuture.ro

Moving the repositories here

Create the two empty repositories in the UI first (they default to private — see DEFAULT_PRIVATE in the compose file), then, from each working copy:

git remote add forge ssh://git@git.makefuture.ro:2222/YOUR_NAME/makefuture.io.git
git push forge --all
git push forge --tags

Nothing is destroyed by this: origin still points at GitHub afterwards. Swap which remote is canonical only once you have pushed and cloned back once.

CI, and the thing that will break

Deployment currently runs from GitHub Actions (.github/workflows/deploy.yml), using the DEPLOY_HOST and DEPLOY_SSH_KEY secrets in the GitHub repository.

Moving the canonical remote here does not move that. Forgejo Actions is enabled and is GitHub-Actions-compatible, but it needs two things that do not exist yet:

1. A runner. Forgejo does not execute workflows itself. A forgejo-runner container has to be registered against this instance with a token from Site Administration → Actions → Runners, which requires the admin account above — which is why this is not already done.
2. The secrets again. DEPLOY_HOST and DEPLOY_SSH_KEY have to be recreated under the repository's Actions settings here. The CI keypair is ~/.ssh/makefuture_ci; its public half is already in the box's /root/.ssh/authorized_keys.

Until both exist, keep pushing to GitHub as well, or deploy by hand:

DEPLOY_HOST=178.104.116.235 ./scripts/deploy.sh

Backups

/opt/web/apps/forgejo/data/ is the entire forge — repositories, database, config. Back up that one directory. It sits next to the other two stateful paths on this box, /opt/web/apps/campfire/storage/ and /opt/web/apps/campfire/.env.

A note on the firewall

ufw on this box allows only 22, 80 and 443, and yet 2222 is reachable from the internet. That is not a mistake in the rules — Docker inserts its own iptables rules ahead of ufw's, so published container ports bypass ufw entirely. Here that is the behaviour we want. It is worth knowing before assuming ufw status describes what is actually exposed on this machine.