Forgejo's displayed SSH clone URL comes from SSH_DOMAIN, which defaults
to "localhost" (not DOMAIN) when unset — completely unusable, and
DOMAIN itself would've been wrong anyway since it resolves through
Caddy's wildcard CNAME, which SSH can't traverse. Point it at the
dedicated forgejo.home.brianpooe.com A record instead.
GitHub mirroring is no longer needed now that Forgejo is the primary
remote. Drops the gitea-mirror service, its volume, env vars, Caddy
site, and firewall rule; docs updated to match.
ENABLE_INTERNAL_SIGNIN=false hides the password form; ENABLE_BASIC_AUTHENTICATION=false
blocks raw-password basic auth. PATs and SSH keys are unaffected.
Zitadel sends preferred_username == full email when no separate nickname
is set, which fails Forgejo's username validation and crashes before
ACCOUNT_LINKING=auto gets a chance to match the existing local account.
Self-hosted Git service (Postgres-backed) plus gitea-mirror for automatic
GitHub repo mirroring. Storage split follows the Paperless pattern: DB and
app config on local disk, git objects/LFS/attachments/avatars on the UNAS
forgejo_data share. Wired into the Makefile, root README, and UNAS NFS docs;
adds Caddy routes for git.<domain> and git-mirror.<domain>.
