docudjeex/content/en/3.serveex/8.development/2.forgejo.md

title, description

title	description
Forgejo	Install Forgejo, a lightweight self-hosted Git service to manage your code repositories privately on your own server.

:ellipsis{left=0px width=40rem top=10rem blur=140px zIndex=60}

Forgejo

::note 🎯 Goals:

• Install Forgejo
• Expose Forgejo using Swag ::

Forgejo is a self-hosted DevOps platform that allows you to manage repositories much like GitHub, but on your own infrastructure. It's a community-driven fork of Gitea.

Installation

::file-tree

tree: /: - docker: - forgejo: - compose.yaml - .env - data/

::

Open Dockge, click on compose, name the stack forgejo, and paste the following content:

---
networks:
  forgejo:
    external: false
services:
  server:
    image: codeberg.org/forgejo/forgejo:11
    container_name: forgejo
    environment:
      - USER_UID=${UID}
      - USER_GID=${GID}
      - TZ=Europe/Paris
    restart: unless-stopped
    networks:
      - forgejo
    volumes:
      - ./data:/data
    ports:
      - 3333:3000
      - 222:22

Fill out the .env file with the required information, for example:

UID=1000
GID=1000

Deploy the container and go to http://yourserverip:3333. Your Forgejo instance is now up and running!

::caution

If it fails: check your firewall rules. ::

Exposing Forgejo with Swag

The benefit of this setup is being able to access it remotely from any of your devices. To do so, we’ll expose Forgejo through Swag.

::note

Prerequisite: We assume you have created a subdomain such as forgejo.yourdomain.com in your DNS zone with CNAME pointing to yourdomain.com, and unless you're using Cloudflare Zero Trust, you have already forwarded port 443 from your router to your server’s port 443 in the NAT rules. ::

In Dockge, go to the SWAG stack and edit the compose file by adding Forgejo's network:

---
services:
  swag:
     container_name: # ...
      # ... 
     networks:              # Connect the container to the custom network
      # ...           
      - forgejo             # Name of the declared network
    
networks:                   # Define the custom network
  # ...
  forgejo:                  # Name of the declared network
    name: forgejo_default   # Actual external network name
    external: true          # Indicates it's an external network

::note

We assume the Forgejo network name is forgejo_default. You can verify connectivity by visiting the SWAG dashboard at http://yourserverip:81. ::

Redeploy the stack by clicking "Deploy" and wait until SWAG is fully operational.

Inside the Swag folders, create the file forgejo.subdomain.conf.

::tip{icon=""} ✨ Tip: You can use File Browser Quantum to navigate and edit your files instead of using terminal commands. ::

sudo nano /docker/swag/config/nginx/proxy-confs/forgejo.subdomain.conf

Paste the configuration below:

## Version 2023/12/19

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name forgejo.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    # enable for ldap auth (requires ldap-location.conf in the location block)
    #include /config/nginx/ldap-server.conf;

    # enable for Authelia (requires authelia-location.conf in the location block)
    #include /config/nginx/authelia-server.conf;

    # enable for Authentik (requires authentik-location.conf in the location block)
    #include /config/nginx/authentik-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable for ldap auth (requires ldap-server.conf in the server block)
        #include /config/nginx/ldap-location.conf;

        # enable for Authelia (requires authelia-server.conf in the server block)
        #include /config/nginx/authelia-location.conf;

        # enable for Authentik (requires authentik-server.conf in the server block)
        #include /config/nginx/authentik-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app forgejo;
        set $upstream_port 3000;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }

    location ~ (/forgejo)?/info/lfs {
        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        set $upstream_app forgejo;
        set $upstream_port 3000;
        set $upstream_proto http;
        proxy_pass $upstream_proto://$upstream_app:$upstream_port;

    }
}

Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit.

Now open the app.ini file from the container's file system:

sudo nano /docker/forgejo/data/gitea/conf/app.ini

Then modify the server section with your domain information:

[server]
DOMAIN = forgejo.yourdomain.com
SSH_DOMAIN = forgejo.yourdomain.com
ROOT_URL = https://forgejo.yourdomain.com/

Press :kbd{value="Ctrl+O"}, then :kbd{value="Enter"} to save, and :kbd{value="Ctrl+X"} to exit, then restart the container.

And that’s it! Forgejo is now exposed to the web.

Protecting Forgejo with Pocket ID

Forgejo can also delegate login to an OIDC provider instead of (or alongside) its own accounts.

::steps{level="3"}

Register Forgejo as an OIDC client

Register an OIDC client in Pocket ID named Forgejo, with this callback URL:

https://forgejo.yourdomain.com/user/oauth2/PocketID/callback

::note The PocketID in the callback URL must match the Authentication Name you set in the next step, exactly. ::

Add the authentication source in Forgejo

As an admin, go to Site Administration > Identity & Access > Authentication Sources, click Add Authentication Source, and fill in:

Field	Value
Authentication Type	OAuth2
Authentication Name	PocketID
OAuth2 Provider	OpenID Connect
Client ID (Key)	The client ID copied from Pocket ID
Client Secret	The client secret copied from Pocket ID
OIDC Discovery URL	Pocket ID's OIDC discovery URL
Additional Scopes	openid email profile

Also enable Skip local 2FA.

Done !

::

::tip ✨ You can use Authentik instead of Pocket ID:

1. In Authentik, create an application and an OAuth2/OpenID Connect provider named Forgejo, with a redirect URI (type Strict) of https://forgejo.yourdomain.com/user/oauth2/authentik/callback.
2. Note the provider's Client ID, Client Secret, and Slug.
3. In Forgejo's authentication source, set Authentication Name to authentik, OIDC Discovery URL to https://authentik.yourdomain.com/application/o/<slug>/.well-known/openid-configuration, then fill in the Client ID, Client Secret, and Additional Scopes email profile. ::