From 1c2f4a1c81f5e8261eb7cc037d72ec10bff21e49 Mon Sep 17 00:00:00 2001
From: Brian Pooe <brian.method@gmail.com>
Date: Sun, 19 Jul 2026 15:17:25 +0200
Subject: [PATCH] fix(forgejo): set SSH_DOMAIN so the UI's clone URL is
 actually usable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Forgejo's displayed SSH clone URL comes from SSH_DOMAIN, which defaults
to "localhost" (not DOMAIN) when unset — completely unusable, and
DOMAIN itself would've been wrong anyway since it resolves through
Caddy's wildcard CNAME, which SSH can't traverse. Point it at the
dedicated forgejo.home.brianpooe.com A record instead.
---
 docker-compose-files/forgejo/.env.sample   | 5 +++++
 docker-compose-files/forgejo/template.yaml | 6 ++++++
 2 files changed, 11 insertions(+)

diff --git a/docker-compose-files/forgejo/.env.sample b/docker-compose-files/forgejo/.env.sample
index ebb1339..d663ba2 100644
--- a/docker-compose-files/forgejo/.env.sample
+++ b/docker-compose-files/forgejo/.env.sample
@@ -13,6 +13,11 @@ FORGEJO_MEM_LIMIT=1G
 FORGEJO_ROOT_URL=https://git.home.example.com
 FORGEJO_DOMAIN=git.home.example.com
 
+# Hostname shown in the web UI's SSH clone URL. Must resolve directly to
+# this LXC (not through Caddy — SSH can't be proxied), so it needs its own
+# DNS A record rather than reusing FORGEJO_DOMAIN's wildcard CNAME to Caddy.
+FORGEJO_SSH_DOMAIN=forgejo.home.example.com
+
 # Generate with: openssl rand -base64 32
 FORGEJO_DB_PASSWORD=<random-secret>
 
diff --git a/docker-compose-files/forgejo/template.yaml b/docker-compose-files/forgejo/template.yaml
index 45b7532..ad932e6 100644
--- a/docker-compose-files/forgejo/template.yaml
+++ b/docker-compose-files/forgejo/template.yaml
@@ -67,6 +67,12 @@ services:
       FORGEJO__database__PASSWD: "{{FORGEJO_DB_PASSWORD}}"
       FORGEJO__server__ROOT_URL: "{{FORGEJO_ROOT_URL}}"
       FORGEJO__server__DOMAIN: "{{FORGEJO_DOMAIN}}"
+      # SSH_DOMAIN drives the SSH clone URL shown in the web UI. It defaults
+      # to "localhost" (not DOMAIN), which is unusable here regardless: SSH
+      # can't be proxied through Caddy, so FORGEJO_DOMAIN's wildcard CNAME
+      # to the Caddy host would be wrong too. Point it at a dedicated DNS
+      # record resolving directly to this LXC instead (see README).
+      FORGEJO__server__SSH_DOMAIN: "{{FORGEJO_SSH_DOMAIN}}"
       FORGEJO__server__SSH_PORT: "{{FORGEJO_SSH_PORT:-2222}}"
       # LANDING_PAGE controls what anonymous visitors see at "/" — set to
       # login so they land on sign-in instead of the marketing homepage.