# Forgejo
FORGEJO_VERSION=10
FORGEJO_HTTP_PORT=3000
# Defaults to 2222 because the LXC's own system sshd already owns port 22.
# To use the standard port 22 for git-over-SSH instead, first move the LXC's
# own admin sshd off 22 (e.g. via a systemd ssh.socket override setting
# ListenStream to another port), then set FORGEJO_SSH_PORT=22 here.
FORGEJO_SSH_PORT=2222
FORGEJO_BIND_IP=0.0.0.0
FORGEJO_MEM_LIMIT=1G

# Full URL where Forgejo is reachable (used for clone URLs, webhooks, CSRF)
FORGEJO_ROOT_URL=https://git.home.example.com
FORGEJO_DOMAIN=git.home.example.com

# Hostname shown in the web UI's SSH clone URL. Must resolve directly to
# this LXC (not through Caddy — SSH can't be proxied), so it needs its own
# DNS A record rather than reusing FORGEJO_DOMAIN's wildcard CNAME to Caddy.
#
# If this instance is publicly exposed, FORGEJO_DOMAIN/FORGEJO_SSH_DOMAIN
# should be the same public-facing names used everywhere (LAN and internet),
# resolved via split-horizon DNS: an internal DNS server answers them
# directly for LAN clients (its own zone/record, not the wildcard CNAME
# above), public DNS points them at your public edge for everyone else. See
# the Forgejo README's "Public Exposure" section for the full pattern.
FORGEJO_SSH_DOMAIN=forgejo.home.example.com

# Generate with: openssl rand -base64 32
FORGEJO_DB_PASSWORD=<random-secret>

# Root of the UNAS forgejo_data share (bind-mounted into the LXC). Must
# contain repositories/, lfs/, attachments/, and avatars/ subdirectories.
FORGEJO_DATA_ROOT=/mnt/unas/forgejo_data

# false = open self-signup; leave true and create accounts with
# `docker exec forgejo forgejo admin user create ...` instead.
FORGEJO_DISABLE_REGISTRATION=true
# If this instance is ever exposed publicly with the intent of letting
# outsiders browse public repos anonymously (GitHub-style), this MUST stay
# false. true forces every page -- including /explore and any .profile
# landing page -- through /user/login for anonymous visitors, regardless of
# FORGEJO_LANDING_PAGE. It silently defeats public repo browsing.
FORGEJO_REQUIRE_SIGNIN_VIEW=false
# login = anonymous visitors land on the sign-in page (LAN-only/private use).
# explore = anonymous visitors land on the public repo listing, like GitHub's
# logged-out homepage. Use explore if this instance is publicly exposed.
FORGEJO_LANDING_PAGE=login