novarto/forgejo
Watch
1
0
Fork
You've already forked forgejo
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Config files for the pilot project testing forgejo
2 commits 1 branch 0 tags 6.7 KiB
  • Shell 100%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Nikola 7ff4c7cf78 Add Forgejo pilot deployment config 
Forgejo 17 + Postgres 17 + Caddy on EC2 in the novarto-ext account,
Google login restricted to novarto.com, deployed with deploy.sh over SSM.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-10 15:19:50 +02:00
forgejo Add Forgejo pilot deployment config 2026-11-10 15:19:50 +02:00
deploy.sh Add Forgejo pilot deployment config 2026-11-10 15:19:50 +02:00
README.md Add Forgejo pilot deployment config 2026-11-10 15:19:50 +02:00

README.md

forgejo

Config files for the pilot project testing forgejo

This repo is the source of truth for what runs on the box. Edit files here, push them with deploy.sh, and commit. Don't edit files on the box directly.

deploy.sh                  push forgejo/ to the box over SSM (copied from ai-infra)
forgejo/
  docker-compose.yml       Forgejo + Postgres + Caddy (TLS)
  Caddyfile
  user-data.sh             first boot of a fresh instance (docker + .env from SSM)
  iam-policy.json          the instance role's inline policy (reference)

AWS_PROFILE=novarto-ext ./deploy.sh forgejo --diff   # what differs on the box; changes nothing
AWS_PROFILE=novarto-ext ./deploy.sh forgejo          # apply it

Shell on the box: aws ssm start-session --profile novarto-ext --region eu-central-1 --target i-07b9d3de9d696e1c2.

Server

Git hosting at git.novarto.net. It runs in the novarto-ext account (490004658066), not the lite-llm account where LiteLLM and Langfuse run (see the ai-infra repo). Every aws command for it, deploy.sh included, needs that account's profile:

AWS_PROFILE=novarto-ext ./deploy.sh forgejo
Forgejo
Instance i-07b9d3de9d696e1c2, t4g.small, AL2023 arm64
Disk 30 GB gp3, encrypted
Elastic IP 18.195.61.159
Security group forgejo: 80, 443, 222 (git over SSH) from anywhere
IAM role forgejo (SSM read /forgejo/*, SSM agent)
Stack Forgejo 17 + Postgres 17 + Caddy, in /opt/forgejo
Secrets /forgejo/postgres_password, /forgejo/secret_key, /forgejo/internal_token (novarto-ext SSM)
Backup DLM policy policy-067f54af5d557b1f6: daily snapshot of volumes tagged Name=forgejo at 03:00 UTC, keeps 1

Login with Google: auth source google (OpenID Connect, Google Cloud OAuth client, redirect https://git.novarto.net/user/oauth2/google/callback), restricted to hd=novarto.com. A novarto.com user's first Google login creates their account. The local sign-up form and the web installer are off. The OAuth client secret lives only in Forgejo's database (Site Administration → Authentication Sources). Local accounts (e.g. the first admin) are created on the box:

cd /opt/forgejo && sudo docker compose exec -u git forgejo forgejo admin user create --username <name> --email <email> --random-password [--admin]

Clone URLs use port 222: git clone ssh://git@git.novarto.net:222/<owner>/<repo>.git.