Brian Pooe
fef521909b
Public repos are now browsable/clonable anonymously (HTTPS) and over SSH, proxied through the Hetzner VPS. Unlike other public apps this is deliberately not behind the oauth2-proxy/Zitadel gate, since Forgejo already enforces its own per-repo visibility. Root redirects to the .profile landing page. Documents the REQUIRE_SIGNIN_VIEW gotcha and the Zitadel OIDC redirect_uri fix needed whenever FORGEJO_DOMAIN changes.
47 lines
2.3 KiB
Text
47 lines
2.3 KiB
Text
# Forgejo
|
|
FORGEJO_VERSION=10
|
|
FORGEJO_HTTP_PORT=3000
|
|
# Defaults to 2222 because the LXC's own system sshd already owns port 22.
|
|
# To use the standard port 22 for git-over-SSH instead, first move the LXC's
|
|
# own admin sshd off 22 (e.g. via a systemd ssh.socket override setting
|
|
# ListenStream to another port), then set FORGEJO_SSH_PORT=22 here.
|
|
FORGEJO_SSH_PORT=2222
|
|
FORGEJO_BIND_IP=0.0.0.0
|
|
FORGEJO_MEM_LIMIT=1G
|
|
|
|
# Full URL where Forgejo is reachable (used for clone URLs, webhooks, CSRF)
|
|
FORGEJO_ROOT_URL=https://git.home.example.com
|
|
FORGEJO_DOMAIN=git.home.example.com
|
|
|
|
# Hostname shown in the web UI's SSH clone URL. Must resolve directly to
|
|
# this LXC (not through Caddy — SSH can't be proxied), so it needs its own
|
|
# DNS A record rather than reusing FORGEJO_DOMAIN's wildcard CNAME to Caddy.
|
|
#
|
|
# If this instance is publicly exposed, FORGEJO_DOMAIN/FORGEJO_SSH_DOMAIN
|
|
# should be the same public-facing names used everywhere (LAN and internet),
|
|
# resolved via split-horizon DNS: an internal DNS server answers them
|
|
# directly for LAN clients (its own zone/record, not the wildcard CNAME
|
|
# above), public DNS points them at your public edge for everyone else. See
|
|
# the Forgejo README's "Public Exposure" section for the full pattern.
|
|
FORGEJO_SSH_DOMAIN=forgejo.home.example.com
|
|
|
|
# Generate with: openssl rand -base64 32
|
|
FORGEJO_DB_PASSWORD=<random-secret>
|
|
|
|
# Root of the UNAS forgejo_data share (bind-mounted into the LXC). Must
|
|
# contain repositories/, lfs/, attachments/, and avatars/ subdirectories.
|
|
FORGEJO_DATA_ROOT=/mnt/unas/forgejo_data
|
|
|
|
# false = open self-signup; leave true and create accounts with
|
|
# `docker exec forgejo forgejo admin user create ...` instead.
|
|
FORGEJO_DISABLE_REGISTRATION=true
|
|
# If this instance is ever exposed publicly with the intent of letting
|
|
# outsiders browse public repos anonymously (GitHub-style), this MUST stay
|
|
# false. true forces every page -- including /explore and any .profile
|
|
# landing page -- through /user/login for anonymous visitors, regardless of
|
|
# FORGEJO_LANDING_PAGE. It silently defeats public repo browsing.
|
|
FORGEJO_REQUIRE_SIGNIN_VIEW=false
|
|
# login = anonymous visitors land on the sign-in page (LAN-only/private use).
|
|
# explore = anonymous visitors land on the public repo listing, like GitHub's
|
|
# logged-out homepage. Use explore if this instance is publicly exposed.
|
|
FORGEJO_LANDING_PAGE=login
|