jaskaran/source-forge-remote
Watch
1
0
Fork
You've already forked source-forge-remote
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
No description
29 commits 1 branch 0 tags 22 KiB
  • Dockerfile 100%
Find a file
Exact
Repository files (latest commit first)
Filename Latest commit message Latest commit date
jaskaran 57e5fd49a6 fix: 🐛 forward ssh git commands via docker exec shim 
The old shim did a second ssh hop to 127.0.0.1:2222 and depended on a
host key for user git that did not survive a reinstall, causing
'/usr/local/bin/gitea: not found' and 'Permission denied (publickey)'.
Run the forced command directly in the forgejo container instead.
2026-11-04 22:09:34 +00:00
ansible fix: 🐛 forward ssh git commands via docker exec shim 2026-11-04 22:09:34 +00:00
.gitignore fix: 🐛 gitignore 2025-03-12 16:20:15 +00:00
Caddyfile.local fix: 🐛 gitignore 2025-03-12 16:20:15 +00:00
Caddyfile.remote fix: 🐛 tokens 2025-03-13 09:03:26 +00:00
docker-compose.production.yaml chore: 🤖 pass env var to caddy 2025-07-22 09:16:35 +01:00
docker-compose.yaml chore: 🤖 bump forgejo 2026-10-31 21:03:58 +00:00
Dockerfile chore: 🤖 bump caddy and forgejo 2026-10-21 22:20:56 +01:00
README.md fix: 🐛 forward ssh git commands via docker exec shim 2026-11-04 22:09:34 +00:00
renovate.json ci: 🎡 add custom.regex for docker-compose 2026-03-08 20:26:42 +00:00

README.md

Source Forge

This repo holds the config for deploying a source code forge to a remote server.

Bootstrap the remote instance

Anisible handles the bootstrapping and the deploying of local files to the server.

ansible-playbook -i ansible/inventory.ini ansible/playbook.yaml

Architecture

Caddy sits in front of the forge and docker compose runs the stack.

SSH git setup

Forgejo runs in Docker and its built-in SSH server is only published on host port 2222. The host's own sshd (port 22) is what clients connect to.

Forgejo writes a forced command into the host's /home/git/.ssh/authorized_keys (which is bind-mounted into the container at /data/git/.ssh) of the form:

command="/usr/local/bin/gitea --config=/data/gitea/conf/app.ini serv key-N",...

The Ansible git role installs a small host shim at /usr/local/bin/gitea that runs that command inside the forgejo container with docker exec and passes SSH_ORIGINAL_COMMAND through. The host git user therefore needs to be in the docker group (the role does this).

Earlier versions forwarded via a second ssh hop to 127.0.0.1:2222. That depended on a host SSH key that did not survive a reinstall, causing sh: 1: /usr/local/bin/gitea: not found / Permission denied (publickey).