chore: merge upstream main (BREAKING CHANGE: remove forgejo) into upgrade branch

The upgrade branch was cut before upstream's forgejo removal, so its tree (and the
!testme run that verified it) did not reflect what would actually deploy. Merging
upstream in brings the branch current; the gitea 1.27.1-rootless bump — which fixes
CVE-2026-60004 and CVE-2026-59774 (both CVSS 9.8) — is unchanged.

.drone.yml

@@ -51,7 +51,7 @@ steps:
         from_secret: drone_abra-bot_token
       fork: true
       repositories:
-        - coop-cloud/auto-recipes-catalogue-json
+        - toolshed/auto-recipes-catalogue-json
 
 trigger:
   event: tag

.env.sample

@@ -8,8 +8,10 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml"
 # COMPOSE_FILE="$COMPOSE_FILE:compose.sqlite3.yml"
 # COMPOSE_FILE="$COMPOSE_FILE:compose.postgres.yml"
 
-# Enable to use forgejo instead of gitea
-# COMPOSE_FILE="$COMPOSE_FILE:compose.forgejo.yml"
+# Enable Git LFS on plain gitea (not needed with forgejo, which bundles it).
+# Mounts the lfs_jwt_secret secret and sets GITEA_LFS_START_SERVER=true.
+# COMPOSE_FILE="$COMPOSE_FILE:compose.lfs.yml"
+# SECRET_LFS_JWT_SECRET_VERSION=v1 # length=43
 
 GITEA_DOMAIN=git.example.com
 GITEA_ALLOW_ONLY_EXTERNAL_REGISTRATION=true
@@ -33,6 +35,7 @@ GITEA_DEFAULT_ORG_VISIBILITY=limited
 GITEA_REQUIRE_SIGNIN_VIEW=true
 GITEA_ENABLE_PUSH_CREATE_USER=false
 GITEA_ENABLE_PUSH_CREATE_ORG=false
+GITEA_LFS_START_SERVER=false
 
 GITEA_REPO_UPLOAD_ENABLED=true
 GITEA_REPO_UPLOAD_ALLOWED_TYPES=*/*
@@ -67,6 +70,11 @@ SECRET_SECRET_KEY_VERSION=v1 # length=64
 # GITEA_ACCOUNT_LINKING=replace-me
 # GITEA_OAUTH2_CLIENT_ENABLED=replace-me
 
+# Lifetime of an OAuth2 refresh token in hours, prolly no need to edit. We
+# were hitting issues with infrequently pushed to repos that were not picked
+# up by drone after a month of inactivity, hence the option.
+# GITEA__oauth2__REFRESH_TOKEN_EXPIRATION_TIME=730
+
 # Indexer (for issue search)
 # GITEA_REPO_INDEXER_ENABLED=false
 # GITEA_ISSUE_INDEXER_TYPE=db

README.md

@@ -15,7 +15,7 @@
 
 ## Basic usage
 
-1. Set up Docker Swarm and [`abra`][abra]
+1. [Set up Docker Swarm and `abra`][operators-tutorial]
 2. Deploy [`coop-cloud/traefik`][cc-traefik]
 3. `abra app new gitea --secrets` (optionally with `--pass` if you'd like
    to save secrets in `pass`)
@@ -23,12 +23,15 @@
    your Docker swarm box
 5. `abra app deploy YOURAPPDOMAIN`
 
+[operators-tutorial]: https://docs.coopcloud.tech/operators/tutorial/
+[cc-traefik]: https://git.coopcloud.tech/coop-cloud/traefik/
+
 ## Create first user
 
 Run
 
 ```bash
-abra app run YOURAPPNAME app gitea -c /etc/gitea/app.ini admin user create --username USERNAME --admin --random-password --email EMAIL
+abra app run YOURAPPNAME app -- gitea -c /etc/gitea/app.ini admin user create --username USERNAME --admin --random-password --email EMAIL
 ```
 
 See the [Gitea command-line documentation](https://docs.gitea.io/en-us/command-line/) for more options.  Make sure not to forget the `-c /etc/gitea/app.ini`.
@@ -36,25 +39,34 @@ See the [Gitea command-line documentation](https://docs.gitea.io/en-us/command-l
 ## Enable SSH
 
 You most certainly want to be able to access your repository over SSH.  To do so, make sure you uncomment the right lines in the configuration for `traefik`.
-```
+
+```sh
 abra app config YOURTRAEFIKAPP
 ```
+
 There uncomment or add these lines:
-```
+
+```sh
 GITEA_SSH_ENABLED=1
 COMPOSE_FILE="compose.yml:compose.gitea.yml"
 ```
+
 Then redeploy traefik:
-```
+
+```sh
 abra app undeploy YOURTRAEFIKAPP
 abra app deploy YOURTRAEFIKAPP
 ```
+
 You might need to wait a bit.  To check if it worked, you can run
-```
+
+```sh
 telnet my.gitea.example.com 2222
 ```
+
 Once you have added a public SSH key, you can check that you can connect to your gitea server with
-```
+
+```sh
 ssh -T -p 2222 git@my.gitea.example.com
 ```
 

abra.sh

@@ -1,4 +1,4 @@
-export APP_INI_VERSION=v20
+export APP_INI_VERSION=v22
 export DOCKER_SETUP_SH_VERSION=v1
 export PG_BACKUP_VERSION=v1
 

app.ini.tmpl

@@ -60,6 +60,10 @@ SSH_DOMAIN = {{ env "GITEA_DOMAIN" }}
 SSH_LISTEN_PORT = {{ env "GITEA_SSH_PORT" }}
 SSH_PORT = {{ env "GITEA_SSH_PORT" }}
 START_SSH_SERVER = true
+LFS_START_SERVER = {{ env "GITEA_LFS_START_SERVER" }}
+{{ if (eq (env "GITEA_LFS_START_SERVER") "true") }}
+LFS_JWT_SECRET = {{ secret "lfs_jwt_secret" }}
+{{ end }}
 
 [security]
 INSTALL_LOCK = true

compose.forgejo.yml

@@ -1,5 +0,0 @@
-version: '3.8'
-
-services:
-  app:
-    image: codeberg.org/forgejo/forgejo:10.0.0-rootless

compose.lfs.yml

@@ -0,0 +1,13 @@
+version: "3.8"
+
+services:
+  app:
+    environment:
+      - GITEA_LFS_START_SERVER=true
+    secrets:
+      - lfs_jwt_secret
+
+secrets:
+  lfs_jwt_secret:
+    name: ${STACK_NAME}_lfs_jwt_secret_${SECRET_LFS_JWT_SECRET_VERSION}
+    external: true

compose.postgres.yml

@@ -10,7 +10,7 @@ services:
     secrets:
       - db_password
   db:
-    image: postgres:15.10
+    image: postgres:15.18
     deploy:
       labels:
         backupbot.backup.pre-hook: "/pg_backup.sh backup"

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "gitea/gitea:1.23.1-rootless"
+    image: "gitea/gitea:1.27.1-rootless"
     configs:
       - source: app_ini
         target: /etc/gitea/app.ini
@@ -51,6 +51,8 @@ services:
       - GITEA_ALLOWED_USER_VISIBILITY_MODES
       - GITEA_DEFAULT_ORG_VISIBILITY
       - GITEA_REQUIRE_SIGNIN_VIEW
+      - GITEA__oauth2__REFRESH_TOKEN_EXPIRATION_TIME
+      - GITEA_LFS_START_SERVER=${GITEA_LFS_START_SERVER:-false}
     volumes:
       - data:/var/lib/gitea
       - config:/etc/gitea
@@ -68,7 +70,7 @@ services:
     deploy:
       update_config:
         failure_action: rollback
-        order: start-first
+        order: stop-first
       labels:
         - "backupbot.backup=${ENABLE_BACKUPS:-true}"
         - "traefik.enable=true"
@@ -81,10 +83,11 @@ services:
         - "traefik.tcp.services.${STACK_NAME}-ssh.loadbalancer.server.port=${GITEA_SSH_PORT}"
         - "traefik.http.routers.${STACK_NAME}.middlewares=${STACK_NAME}_cors"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
+        - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolallowheaders=content-type,authorization"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true"
-        - coop-cloud.${STACK_NAME}.version=3.2.0+1.23.1-rootless
+        - coop-cloud.${STACK_NAME}.version=3.6.0+1.24.2-rootless
 
 
 networks:

release/next

@@ -0,0 +1,6 @@
+Forgejo support has been moved to its own recipe.  Make the move by:
+
+* Getting the recipe locally with `abra recipe fetch forgejo`
+* Changing the recipe's TYPE with `abra application config FORGEJO_DOMAIN`
+* Redeploy the app with `abra application undeploy` and `abra
+  application deploy`