From c63e1cdd046afd3427e8d190ce28049f6fcd7316 Mon Sep 17 00:00:00 2001 From: notplants <@notplants> Date: Mon, 18 May 2026 12:51:20 -0400 Subject: [PATCH 01/28] change deploy logic to stop-first instead of start-first --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index a7a8928..a84af49 100644 --- a/compose.yml +++ b/compose.yml @@ -71,7 +71,7 @@ services: deploy: update_config: failure_action: rollback - order: start-first + order: stop-first labels: - "backupbot.backup=${ENABLE_BACKUPS:-true}" - "traefik.enable=true" From e7c4999f785de997ae7a9c6ee82c0002c0991175 Mon Sep 17 00:00:00 2001 From: notplants <@notplants> Date: Mon, 18 May 2026 12:59:07 -0400 Subject: [PATCH 02/28] bump version number to 3.5.3 --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index a84af49..b5041ed 100644 --- a/compose.yml +++ b/compose.yml @@ -87,7 +87,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true" - - coop-cloud.${STACK_NAME}.version=3.5.2+1.24.2-rootless + - coop-cloud.${STACK_NAME}.version=3.5.3+1.24.2-rootless networks: From 6aa52c1e7396828893711b42d9a450dbd64e30d4 Mon Sep 17 00:00:00 2001 From: ammaratef45 Date: Tue, 19 May 2026 03:43:34 +0000 Subject: [PATCH 03/28] fix abra command in documentation --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 7ac421e..b2784a0 100644 --- a/README.md +++ b/README.md @@ -31,7 +31,7 @@ Run ```bash -abra app run YOURAPPNAME app gitea -c /etc/gitea/app.ini admin user create --username USERNAME --admin --random-password --email EMAIL +abra app run YOURAPPNAME app -- gitea -c /etc/gitea/app.ini admin user create --username USERNAME --admin --random-password --email EMAIL ``` See the [Gitea command-line documentation](https://docs.gitea.io/en-us/command-line/) for more options. Make sure not to forget the `-c /etc/gitea/app.ini`. From 621c483397b3da7144edd8f5a77cd2519ce76be6 Mon Sep 17 00:00:00 2001 From: ammar Date: Fri, 29 May 2026 00:17:26 -0700 Subject: [PATCH 04/28] fix(#54): remove unused env GITEA_DOMAIN --- .env.sample | 1 - 1 file changed, 1 deletion(-) diff --git a/.env.sample b/.env.sample index 24e956e..1813a63 100644 --- a/.env.sample +++ b/.env.sample @@ -12,7 +12,6 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml" # COMPOSE_FILE="$COMPOSE_FILE:compose.forgejo.yml" # SECRET_LFS_JWT_SECRET_VERSION=v1 # length=43 -GITEA_DOMAIN=git.example.com GITEA_ALLOW_ONLY_EXTERNAL_REGISTRATION=true GITEA_APP_NAME="Git with solidaritea" GITEA_AUTO_WATCH_NEW_REPOS=false From 357926f26e69df5eb0c837c87081377486126077 Mon Sep 17 00:00:00 2001 From: notplants <@notplants> Date: Mon, 15 Jun 2026 19:04:00 +0000 Subject: [PATCH 05/28] feat: support Git LFS on plain gitea Add an opt-in compose.lfs.yml that mounts the lfs_jwt_secret secret and enables GITEA_LFS_START_SERVER for plain gitea (forgejo already bundles LFS). Emit LFS_JWT_SECRET in app.ini whenever the LFS server is on so the JWT secret is stable across redeploys instead of being regenerated on every restart (app.ini is a read-only config mount). Bump version 3.5.2 -> 3.6.0. --- .env.sample | 5 +++++ abra.sh | 2 +- app.ini.tmpl | 2 +- compose.lfs.yml | 13 +++++++++++++ compose.yml | 2 +- 5 files changed, 21 insertions(+), 3 deletions(-) create mode 100644 compose.lfs.yml diff --git a/.env.sample b/.env.sample index 24e956e..4176c93 100644 --- a/.env.sample +++ b/.env.sample @@ -12,6 +12,11 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml" # COMPOSE_FILE="$COMPOSE_FILE:compose.forgejo.yml" # SECRET_LFS_JWT_SECRET_VERSION=v1 # length=43 +# Enable Git LFS on plain gitea (not needed with forgejo, which bundles it). +# Mounts the lfs_jwt_secret secret and sets GITEA_LFS_START_SERVER=true. +# COMPOSE_FILE="$COMPOSE_FILE:compose.lfs.yml" +# SECRET_LFS_JWT_SECRET_VERSION=v1 # length=43 + GITEA_DOMAIN=git.example.com GITEA_ALLOW_ONLY_EXTERNAL_REGISTRATION=true GITEA_APP_NAME="Git with solidaritea" diff --git a/abra.sh b/abra.sh index ecb8721..54bf0f3 100644 --- a/abra.sh +++ b/abra.sh @@ -1,4 +1,4 @@ -export APP_INI_VERSION=v21 +export APP_INI_VERSION=v22 export DOCKER_SETUP_SH_VERSION=v1 export PG_BACKUP_VERSION=v1 diff --git a/app.ini.tmpl b/app.ini.tmpl index 9d5ceb2..fbd09a6 100644 --- a/app.ini.tmpl +++ b/app.ini.tmpl @@ -61,7 +61,7 @@ SSH_LISTEN_PORT = {{ env "GITEA_SSH_PORT" }} SSH_PORT = {{ env "GITEA_SSH_PORT" }} START_SSH_SERVER = true LFS_START_SERVER = {{ env "GITEA_LFS_START_SERVER" }} -{{ if eq (env "FORGE") "forgejo" }} +{{ if or (eq (env "FORGE") "forgejo") (eq (env "GITEA_LFS_START_SERVER") "true") }} LFS_JWT_SECRET = {{ secret "lfs_jwt_secret" }} {{ end }} diff --git a/compose.lfs.yml b/compose.lfs.yml new file mode 100644 index 0000000..e5c6750 --- /dev/null +++ b/compose.lfs.yml @@ -0,0 +1,13 @@ +version: "3.8" + +services: + app: + environment: + - GITEA_LFS_START_SERVER=true + secrets: + - lfs_jwt_secret + +secrets: + lfs_jwt_secret: + name: ${STACK_NAME}_lfs_jwt_secret_${SECRET_LFS_JWT_SECRET_VERSION} + external: true diff --git a/compose.yml b/compose.yml index 76fda73..88265c2 100644 --- a/compose.yml +++ b/compose.yml @@ -88,7 +88,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true" - - coop-cloud.${STACK_NAME}.version=3.5.3+1.24.2-rootless + - coop-cloud.${STACK_NAME}.version=3.6.0+1.24.2-rootless networks: From 6a0339d3f27397296b44a4cb29c2cde8050be682 Mon Sep 17 00:00:00 2001 From: f Date: Tue, 16 Jun 2026 18:33:21 -0300 Subject: [PATCH 06/28] BREAKING CHANGE: remove forgejo --- .env.sample | 4 ---- app.ini.tmpl | 2 +- compose.forgejo.yml | 13 ------------- compose.yml | 1 - 4 files changed, 1 insertion(+), 19 deletions(-) delete mode 100644 compose.forgejo.yml diff --git a/.env.sample b/.env.sample index 4176c93..aef67bc 100644 --- a/.env.sample +++ b/.env.sample @@ -8,10 +8,6 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml" # COMPOSE_FILE="$COMPOSE_FILE:compose.sqlite3.yml" # COMPOSE_FILE="$COMPOSE_FILE:compose.postgres.yml" -# Enable to use forgejo instead of gitea -# COMPOSE_FILE="$COMPOSE_FILE:compose.forgejo.yml" -# SECRET_LFS_JWT_SECRET_VERSION=v1 # length=43 - # Enable Git LFS on plain gitea (not needed with forgejo, which bundles it). # Mounts the lfs_jwt_secret secret and sets GITEA_LFS_START_SERVER=true. # COMPOSE_FILE="$COMPOSE_FILE:compose.lfs.yml" diff --git a/app.ini.tmpl b/app.ini.tmpl index fbd09a6..49979eb 100644 --- a/app.ini.tmpl +++ b/app.ini.tmpl @@ -61,7 +61,7 @@ SSH_LISTEN_PORT = {{ env "GITEA_SSH_PORT" }} SSH_PORT = {{ env "GITEA_SSH_PORT" }} START_SSH_SERVER = true LFS_START_SERVER = {{ env "GITEA_LFS_START_SERVER" }} -{{ if or (eq (env "FORGE") "forgejo") (eq (env "GITEA_LFS_START_SERVER") "true") }} +{{ if (eq (env "GITEA_LFS_START_SERVER") "true") }} LFS_JWT_SECRET = {{ secret "lfs_jwt_secret" }} {{ end }} diff --git a/compose.forgejo.yml b/compose.forgejo.yml deleted file mode 100644 index acc0376..0000000 --- a/compose.forgejo.yml +++ /dev/null @@ -1,13 +0,0 @@ -version: '3.8' - -services: - app: - image: codeberg.org/forgejo/forgejo:12.0.2-rootless - environment: - - FORGE=forgejo - secrets: - - lfs_jwt_secret -secrets: - lfs_jwt_secret: - name: ${STACK_NAME}_lfs_jwt_secret_${SECRET_LFS_JWT_SECRET_VERSION} - external: true diff --git a/compose.yml b/compose.yml index 88265c2..c6140a4 100644 --- a/compose.yml +++ b/compose.yml @@ -15,7 +15,6 @@ services: - jwt_secret - secret_key environment: - - FORGE=gitea - GITEA_ALLOW_ONLY_EXTERNAL_REGISTRATION - GITEA_APP_NAME - GITEA_AUTO_WATCH_NEW_REPOS From 2f7f1b6bfe6903ffaaa0961751a65b6cec7684d8 Mon Sep 17 00:00:00 2001 From: notplants <@notplants> Date: Mon, 22 Jun 2026 19:29:08 +0000 Subject: [PATCH 07/28] chore: upgrade gitea to 1.26.2-rootless, postgres to 15.18 --- compose.postgres.yml | 2 +- compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/compose.postgres.yml b/compose.postgres.yml index b41c078..ac49e4d 100644 --- a/compose.postgres.yml +++ b/compose.postgres.yml @@ -10,7 +10,7 @@ services: secrets: - db_password db: - image: postgres:15.13 + image: postgres:15.18 deploy: labels: backupbot.backup.pre-hook: "/pg_backup.sh backup" diff --git a/compose.yml b/compose.yml index 88265c2..dfbf218 100644 --- a/compose.yml +++ b/compose.yml @@ -3,7 +3,7 @@ version: "3.8" services: app: - image: "gitea/gitea:1.24.2-rootless" + image: "gitea/gitea:1.26.2-rootless" configs: - source: app_ini target: /etc/gitea/app.ini From 57e224c5b024de3a0c5139ef2060e23230b9ea33 Mon Sep 17 00:00:00 2001 From: f Date: Thu, 25 Jun 2026 16:48:12 -0300 Subject: [PATCH 08/28] doc: release notes --- release/next | 6 ++++++ 1 file changed, 6 insertions(+) create mode 100644 release/next diff --git a/release/next b/release/next new file mode 100644 index 0000000..a3405a4 --- /dev/null +++ b/release/next @@ -0,0 +1,6 @@ +Forgejo support has been moved to its own recipe. Make the move by: + +* Getting the recipe locally with `abra recipe fetch forgejo` +* Changing the recipe's TYPE with `abra application config FORGEJO_DOMAIN` +* Redeploy the app with `abra application undeploy` and `abra + application deploy` From 096cc70fd9c45dbe0e802c6dee718d8967b5e7fd Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Mon, 10 Aug 2026 16:27:26 +0000 Subject: [PATCH 09/28] chore: upgrade gitea to 1.27.1-rootless MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1: - CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch submitted twice triggers an add/add conflict that writes an executable post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea service account. Affects 1.17-1.27.0; public PoC. - CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0), escalating to RCE by reading config/tokens. Based on current upstream main, so it includes the BREAKING CHANGE: remove forgejo work; the previous branch predated it and was verified against a tree that would not have deployed. Version label left at 3.6.0+1.24.2-rootless per upgrade-PR convention (operator runs abra recipe release). --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 93148a7..675d168 100644 --- a/compose.yml +++ b/compose.yml @@ -3,7 +3,7 @@ version: "3.8" services: app: - image: "gitea/gitea:1.26.2-rootless" + image: "gitea/gitea:1.27.1-rootless" configs: - source: app_ini target: /etc/gitea/app.ini From 1f987b4ab38d365864e7d66d9b91556a9d06fb39 Mon Sep 17 00:00:00 2001 From: notplants <@notplants> Date: Mon, 10 Aug 2026 12:32:49 -0400 Subject: [PATCH 10/28] chore: publish 3.6.2+1.27.1-rootless release --- compose.yml | 2 +- release/{next => 3.6.2+1.27.1-rootless} | 0 2 files changed, 1 insertion(+), 1 deletion(-) rename release/{next => 3.6.2+1.27.1-rootless} (100%) diff --git a/compose.yml b/compose.yml index 675d168..96ad2e7 100644 --- a/compose.yml +++ b/compose.yml @@ -87,7 +87,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true" - - coop-cloud.${STACK_NAME}.version=3.6.0+1.24.2-rootless + - coop-cloud.${STACK_NAME}.version=3.6.2+1.27.1-rootless networks: diff --git a/release/next b/release/3.6.2+1.27.1-rootless similarity index 100% rename from release/next rename to release/3.6.2+1.27.1-rootless From 852717d212f4704be1292d4303d77ed2175a7c92 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Mon, 10 Aug 2026 16:48:35 +0000 Subject: [PATCH 11/28] fix: bump APP_INI_VERSION to v23 app.ini.tmpl changed in "BREAKING CHANGE: remove forgejo" but the config version stayed at v22. Swarm configs are immutable, so upgrading an existing deployment aborts: FATA failed to update config _app_ini_v22: Error response from daemon: rpc error: code = InvalidArgument desc = only updates to Labels are allowed Bumping to v23 makes Swarm create a new config object instead of mutating v22; the orphaned v22 can be pruned after rollout. --- abra.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/abra.sh b/abra.sh index 54bf0f3..68fe314 100644 --- a/abra.sh +++ b/abra.sh @@ -1,4 +1,4 @@ -export APP_INI_VERSION=v22 +export APP_INI_VERSION=v23 export DOCKER_SETUP_SH_VERSION=v1 export PG_BACKUP_VERSION=v1 From 97fe2bf21384dd75a2f7cc8beb832eeb7bf32d1b Mon Sep 17 00:00:00 2001 From: notplants <@notplants> Date: Mon, 10 Aug 2026 12:57:05 -0400 Subject: [PATCH 12/28] chore: publish 3.6.3+1.27.1-rootless release --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 96ad2e7..dc61ac1 100644 --- a/compose.yml +++ b/compose.yml @@ -87,7 +87,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true" - - coop-cloud.${STACK_NAME}.version=3.6.2+1.27.1-rootless + - coop-cloud.${STACK_NAME}.version=3.6.3+1.27.1-rootless networks: From 2f64ddfa16ed4c4766311ff968136b524d948e63 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Fri, 14 Aug 2026 02:36:09 +0000 Subject: [PATCH 13/28] chore: upgrade gitea to 1.27.2-rootless, postgres to 15.19 --- compose.postgres.yml | 2 +- compose.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/compose.postgres.yml b/compose.postgres.yml index ac49e4d..96719a5 100644 --- a/compose.postgres.yml +++ b/compose.postgres.yml @@ -10,7 +10,7 @@ services: secrets: - db_password db: - image: postgres:15.18 + image: postgres:15.19 deploy: labels: backupbot.backup.pre-hook: "/pg_backup.sh backup" diff --git a/compose.yml b/compose.yml index dc61ac1..4facc63 100644 --- a/compose.yml +++ b/compose.yml @@ -3,7 +3,7 @@ version: "3.8" services: app: - image: "gitea/gitea:1.27.1-rootless" + image: "gitea/gitea:1.27.2-rootless" configs: - source: app_ini target: /etc/gitea/app.ini From 4c70df77e88b44012db957b9b0691e3faf4953a0 Mon Sep 17 00:00:00 2001 From: trav Date: Mon, 17 Aug 2026 14:42:26 -0400 Subject: [PATCH 14/28] chore: publish 3.6.4+1.27.2-rootless release --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 4facc63..134f357 100644 --- a/compose.yml +++ b/compose.yml @@ -87,7 +87,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true" - - coop-cloud.${STACK_NAME}.version=3.6.3+1.27.1-rootless + - coop-cloud.${STACK_NAME}.version=3.6.4+1.27.2-rootless networks: From 050eda8ca46c4202d43ef050f2c15ed6cb54ae5b Mon Sep 17 00:00:00 2001 From: 3wc <3wc.coopcloud@doesthisthing.work> Date: Sun, 30 Aug 2026 13:39:14 -0400 Subject: [PATCH 15/28] docs: Fix Gitea image URL Thanks @namnatulco --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index b2784a0..bc2691b 100644 --- a/README.md +++ b/README.md @@ -5,7 +5,7 @@ * **Category**: Development * **Status**: 5 -* **Image**: [`gitea/gitea`](https://hub.docker.com/gitea/gitea), 4, upstream +* **Image**: [`gitea/gitea`](https://hub.docker.com/r/gitea/gitea), 4, upstream * **Healthcheck**: Yes * **Backups**: Yes * **Email**: Yes From dd017ef40cf39c070f5e2e7d30b434a0472dc785 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Mon, 31 Aug 2026 19:49:59 +0000 Subject: [PATCH 16/28] chore: upgrade to 1.27.3-rootless --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 134f357..af00cae 100644 --- a/compose.yml +++ b/compose.yml @@ -3,7 +3,7 @@ version: "3.8" services: app: - image: "gitea/gitea:1.27.2-rootless" + image: "gitea/gitea:1.27.3-rootless" configs: - source: app_ini target: /etc/gitea/app.ini From 116d6049b768e10bd1e397c173b044fe8e4221c8 Mon Sep 17 00:00:00 2001 From: Cassowary Date: Tue, 1 Sep 2026 10:39:22 -0700 Subject: [PATCH 17/28] Add Anubis config from Forgejo. --- .env.sample | 4 ++++ compose.anubis.yml | 7 +++++++ 2 files changed, 11 insertions(+) create mode 100644 compose.anubis.yml diff --git a/.env.sample b/.env.sample index dc9ef9b..75839f9 100644 --- a/.env.sample +++ b/.env.sample @@ -13,6 +13,9 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml" # COMPOSE_FILE="$COMPOSE_FILE:compose.lfs.yml" # SECRET_LFS_JWT_SECRET_VERSION=v1 # length=43 +# Anubis +# COMPOSE_FILE="$COMPOSE_FILE:compose.anubis.yml" + GITEA_ALLOW_ONLY_EXTERNAL_REGISTRATION=true GITEA_APP_NAME="Git with solidaritea" GITEA_AUTO_WATCH_NEW_REPOS=false @@ -78,3 +81,4 @@ SECRET_SECRET_KEY_VERSION=v1 # length=64 # GITEA_REPO_INDEXER_ENABLED=false # GITEA_ISSUE_INDEXER_TYPE=db # GITEA_STARTUP_TIMEOUT=-1 + diff --git a/compose.anubis.yml b/compose.anubis.yml new file mode 100644 index 0000000..2e3fd28 --- /dev/null +++ b/compose.anubis.yml @@ -0,0 +1,7 @@ +--- +version: "3.8" +services: + app: + deploy: + labels: + - "traefik.http.routers.${STACK_NAME}.middlewares=anubis,${STACK_NAME}_cors" From feb3acc851a7fb6cc490c053418188f640b03558 Mon Sep 17 00:00:00 2001 From: notplants <@notplants> Date: Mon, 7 Sep 2026 19:12:47 -0400 Subject: [PATCH 18/28] chore: publish 3.6.5+1.27.3-rootless release --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index af00cae..76d4973 100644 --- a/compose.yml +++ b/compose.yml @@ -87,7 +87,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true" - - coop-cloud.${STACK_NAME}.version=3.6.4+1.27.2-rootless + - coop-cloud.${STACK_NAME}.version=3.6.5+1.27.3-rootless networks: From bb17de666ec65b3fdd2f21f7f330e16139b97945 Mon Sep 17 00:00:00 2001 From: trav Date: Mon, 14 Sep 2026 12:20:10 -0700 Subject: [PATCH 19/28] chore: publish 3.6.6+1.27.3-rootless release --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 76d4973..8e0905d 100644 --- a/compose.yml +++ b/compose.yml @@ -87,7 +87,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true" - - coop-cloud.${STACK_NAME}.version=3.6.5+1.27.3-rootless + - coop-cloud.${STACK_NAME}.version=3.6.6+1.27.3-rootless networks: From 370757aa26695943976e9f87b178b27c596f5761 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Fri, 11 Sep 2026 02:41:22 +0000 Subject: [PATCH 20/28] chore: upgrade db to 10.11.19 (mariadb overlay) --- compose.mariadb.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.mariadb.yml b/compose.mariadb.yml index b4cc117..4fc7bc3 100644 --- a/compose.mariadb.yml +++ b/compose.mariadb.yml @@ -10,7 +10,7 @@ services: secrets: - db_password db: - image: "mariadb:10.11.2" + image: "mariadb:10.11.19" deploy: labels: backupbot.backup.pre-hook: 'mysqldump --single-transaction -u root -p"$$(cat /run/secrets/db_root_password)" gitea > /var/lib/mysql/backup.sql' From f167b7311575bc4f747f77c0eea5a31e79094dd9 Mon Sep 17 00:00:00 2001 From: trav Date: Mon, 14 Sep 2026 12:25:47 -0700 Subject: [PATCH 21/28] chore: publish 3.6.7+1.27.3-rootless release --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 8e0905d..ac093e9 100644 --- a/compose.yml +++ b/compose.yml @@ -87,7 +87,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true" - - coop-cloud.${STACK_NAME}.version=3.6.6+1.27.3-rootless + - coop-cloud.${STACK_NAME}.version=3.6.7+1.27.3-rootless networks: From 91e42c8a5ff9513df4b297a8683ca2c0ea6ad6e9 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Fri, 2 Oct 2026 03:57:03 +0000 Subject: [PATCH 22/28] chore: upgrade to 28.0.0-rootless --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index ac093e9..0b4f955 100644 --- a/compose.yml +++ b/compose.yml @@ -3,7 +3,7 @@ version: "3.8" services: app: - image: "gitea/gitea:1.27.3-rootless" + image: "gitea/gitea:28.0.0-rootless" configs: - source: app_ini target: /etc/gitea/app.ini From 97eb7bf110b1ae7e2fac1a7c4ca09835f86a54f9 Mon Sep 17 00:00:00 2001 From: trav Date: Mon, 5 Oct 2026 11:00:16 -0700 Subject: [PATCH 23/28] chore: publish 3.6.8+28.0.0-rootless release --- compose.yml | 2 +- release/3.6.8+28.0.0-rootless | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) create mode 100644 release/3.6.8+28.0.0-rootless diff --git a/compose.yml b/compose.yml index 0b4f955..269021a 100644 --- a/compose.yml +++ b/compose.yml @@ -87,7 +87,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true" - - coop-cloud.${STACK_NAME}.version=3.6.7+1.27.3-rootless + - coop-cloud.${STACK_NAME}.version=3.6.8+28.0.0-rootless networks: diff --git a/release/3.6.8+28.0.0-rootless b/release/3.6.8+28.0.0-rootless new file mode 100644 index 0000000..1c44d41 --- /dev/null +++ b/release/3.6.8+28.0.0-rootless @@ -0,0 +1 @@ + git egress has been reworked. ALLOWED_DOMAINS / BLOCKED_DOMAINS / ALLOW_LOCALNETWORKS are deprecated (migrated to [security] ALLOWED_HOST_LIST / BLOCKED_HOST_LIST) Operators who restrict git egress must switch to EGRESS_MODE = strict + explicit CIDRs to keep a deny-by-default policy. \ No newline at end of file From efa7274a313714b046eb2c0de5894065076040ee Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Fri, 9 Oct 2026 02:25:22 +0000 Subject: [PATCH 24/28] chore: upgrade to 28.1.0-rootless --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 269021a..08f86f5 100644 --- a/compose.yml +++ b/compose.yml @@ -3,7 +3,7 @@ version: "3.8" services: app: - image: "gitea/gitea:28.0.0-rootless" + image: "gitea/gitea:28.1.0-rootless" configs: - source: app_ini target: /etc/gitea/app.ini From f2b5089c08f6f26892b445d351a330f7dc43cc60 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Fri, 9 Oct 2026 02:31:53 +0000 Subject: [PATCH 25/28] chore(ci): refresh PR after upstream main rebase (no tree change) From e4d33286b4a339281e925058c908da96cd709e59 Mon Sep 17 00:00:00 2001 From: trav Date: Mon, 19 Oct 2026 09:44:17 -0700 Subject: [PATCH 26/28] chore: publish 3.6.9+28.1.0-rootless release --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 08f86f5..0ee22a7 100644 --- a/compose.yml +++ b/compose.yml @@ -87,7 +87,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true" - - coop-cloud.${STACK_NAME}.version=3.6.8+28.0.0-rootless + - coop-cloud.${STACK_NAME}.version=3.6.9+28.1.0-rootless networks: From 719d230085f62e961826c1419b957a8d0aaa3eed Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Fri, 23 Oct 2026 02:43:44 +0000 Subject: [PATCH 27/28] chore: upgrade to 28.2.0-rootless --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 0ee22a7..11284ad 100644 --- a/compose.yml +++ b/compose.yml @@ -3,7 +3,7 @@ version: "3.8" services: app: - image: "gitea/gitea:28.1.0-rootless" + image: "gitea/gitea:28.2.0-rootless" configs: - source: app_ini target: /etc/gitea/app.ini From 5bbcf147a3950b1a51fb9d5ae7636e81e446f7e9 Mon Sep 17 00:00:00 2001 From: trav Date: Mon, 26 Oct 2026 09:19:15 -0700 Subject: [PATCH 28/28] chore: publish 3.6.10+28.2.0-rootless release --- compose.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/compose.yml b/compose.yml index 11284ad..aa26f5f 100644 --- a/compose.yml +++ b/compose.yml @@ -87,7 +87,7 @@ services: - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100" - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true" - - coop-cloud.${STACK_NAME}.version=3.6.9+28.1.0-rootless + - coop-cloud.${STACK_NAME}.version=3.6.10+28.2.0-rootless networks: