--- title: Forgejo description: Install Forgejo, a lightweight self-hosted Git service to manage your code repositories privately on your own server. --- :ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60} # Forgejo ::note 🎯 __Goals:__ - Install Forgejo - Expose Forgejo using Swag :: [Forgejo](https://forgejo.org/) is a self-hosted DevOps platform that allows you to manage repositories much like GitHub, but on your own infrastructure. It's a community-driven fork of Gitea. ## Installation Folder structure ```text [Directory tree] root └── docker └── forgejo └── data ``` Open Dockge, click on `compose`, name the stack `forgejo`, and paste the following content: ```yaml [compose.yaml] --- networks: forgejo: external: false services: server: image: codeberg.org/forgejo/forgejo:11 container_name: forgejo environment: - USER_UID=${UID} - USER_GID=${GID} - TZ=Europe/Paris restart: unless-stopped networks: - forgejo volumes: - ./data:/data ports: - 3333:3000 - 222:22 ``` Fill out the `.env` file with the required information, for example: ```properties [.env] UID=1000 GID=1000 ``` Deploy the container and go to `http://yourserverip:3333`. Your Forgejo instance is now up and running! ::caution __If it fails:__ check your firewall rules. :: ## Exposing Forgejo with Swag The benefit of this setup is being able to access it remotely from any of your devices. To do so, we’ll expose Forgejo through Swag. ::note __Prerequisite:__ We assume you have created a subdomain such as `forgejo.yourdomain.com` in your [DNS zone](/general/networking/dns) with `CNAME` pointing to `yourdomain.com`, and [unless you're using Cloudflare Zero Trust](/serveex/security/cloudflare), you have already forwarded port `443` from your router to your server’s port `443` in the [NAT rules](/general/networking/nat). :: In Dockge, go to the SWAG stack and edit the compose file by adding Forgejo's network: ```yaml [compose.yaml] services: swag: container_name: # ... # ... networks: # Connect the container to the custom network # ... - forgejo # Name of the declared network networks: # Define the custom network # ... forgejo: # Name of the declared network name: forgejo_default # Actual external network name external: true # Indicates it's an external network ``` ::note We assume the Forgejo network name is `forgejo_default`. You can verify connectivity by visiting the SWAG dashboard at http://yourserverip:81. :: Redeploy the stack by clicking "Deploy" and wait until SWAG is fully operational. Inside the Swag folders, create the file `forgejo.subdomain.conf`. ::tip{icon=""} ✨ __Tip:__ You can use [File Browser Quantum](/serveex/files/file-browser-quantum) to navigate and edit your files instead of using terminal commands. :: ```bash [Terminal] sudo nano /docker/swag/config/nginx/proxy-confs/forgejo.subdomain.conf ``` Paste the configuration below: ```nginx [forgejo.subdomain.conf] ## Version 2023/12/19 server { listen 443 ssl; listen [::]:443 ssl; server_name forgejo.*; include /config/nginx/ssl.conf; client_max_body_size 0; # enable for ldap auth (requires ldap-location.conf in the location block) #include /config/nginx/ldap-server.conf; # enable for Authelia (requires authelia-location.conf in the location block) #include /config/nginx/authelia-server.conf; # enable for Authentik (requires authentik-location.conf in the location block) #include /config/nginx/authentik-server.conf; location / { # enable the next two lines for http auth #auth_basic "Restricted"; #auth_basic_user_file /config/nginx/.htpasswd; # enable for ldap auth (requires ldap-server.conf in the server block) #include /config/nginx/ldap-location.conf; # enable for Authelia (requires authelia-server.conf in the server block) #include /config/nginx/authelia-location.conf; # enable for Authentik (requires authentik-server.conf in the server block) #include /config/nginx/authentik-location.conf; include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app forgejo; set $upstream_port 3000; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; } location ~ (/forgejo)?/info/lfs { include /config/nginx/proxy.conf; include /config/nginx/resolver.conf; set $upstream_app forgejo; set $upstream_port 3000; set $upstream_proto http; proxy_pass $upstream_proto://$upstream_app:$upstream_port; } } ``` Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit. Now open the `app.ini` file from the container's file system: ```bash [Terminal] sudo nano /docker/forgejo/data/gitea/conf/app.ini ``` Then modify the server section with your domain information: ```properties [app.ini] [server] DOMAIN = forgejo.yourdomain.com SSH_DOMAIN = forgejo.yourdomain.com ROOT_URL = https://forgejo.yourdomain.com/ ``` Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit, then restart the container. And that’s it! Forgejo is now exposed to the web. ## Protecting Forgejo with Pocket ID Forgejo can also delegate login to an OIDC provider instead of (or alongside) its own accounts. ::steps{level="3"} ### Register Forgejo as an OIDC client [Register an OIDC client in Pocket ID](/serveex/security/pocket-id#registering-an-oidc-client) named `Forgejo`, with this callback URL: ```text https://forgejo.yourdomain.com/user/oauth2/PocketID/callback ``` ::note The `PocketID` in the callback URL must match the __Authentication Name__ you set in the next step, exactly. :: ### Add the authentication source in Forgejo As an admin, go to _Site Administration > Identity & Access > Authentication Sources_, click _Add Authentication Source_, and fill in: | Field | Value | |-------|-------| | Authentication Type | `OAuth2` | | Authentication Name | `PocketID` | | OAuth2 Provider | `OpenID Connect` | | Client ID (Key) | The client ID copied from Pocket ID | | Client Secret | The client secret copied from Pocket ID | | OIDC Discovery URL | Pocket ID's OIDC discovery URL | | Additional Scopes | `openid email profile` | Also enable __Skip local 2FA__. ### Done ! :: ::tip ✨ You can use [Authentik](/serveex/advanced/authentik) instead of Pocket ID: 1. In Authentik, create an application and an OAuth2/OpenID Connect provider named `Forgejo`, with a redirect URI (type `Strict`) of `https://forgejo.yourdomain.com/user/oauth2/authentik/callback`. 2. Note the provider's __Client ID__, __Client Secret__, and __Slug__. 3. In Forgejo's authentication source, set __Authentication Name__ to `authentik`, __OIDC Discovery URL__ to `https://authentik.yourdomain.com/application/o//.well-known/openid-configuration`, then fill in the Client ID, Client Secret, and Additional Scopes `email profile`. ::