Gitea 1.24+ persists settings back to app.ini on boot (e.g. WORK_PATH).
Mounting app.ini directly as a read-only swarm config makes that write
fail (logged error, possible repo-access bugs). Mount the rendered config
as app.ini.init and seed a writable copy in the config volume instead.
app.ini.tmpl changed in "BREAKING CHANGE: remove forgejo" but the config version
stayed at v22. Swarm configs are immutable, so upgrading an existing deployment
aborts:
FATA failed to update config <stack>_app_ini_v22: Error response from daemon:
rpc error: code = InvalidArgument desc = only updates to Labels are allowed
Bumping to v23 makes Swarm create a new config object instead of mutating v22; the
orphaned v22 can be pruned after rollout.
Add an opt-in compose.lfs.yml that mounts the lfs_jwt_secret secret and
enables GITEA_LFS_START_SERVER for plain gitea (forgejo already bundles
LFS). Emit LFS_JWT_SECRET in app.ini whenever the LFS server is on so the
JWT secret is stable across redeploys instead of being regenerated on
every restart (app.ini is a read-only config mount).
Bump version 3.5.2 -> 3.6.0.