chore: merge upstream main (BREAKING CHANGE: remove forgejo) into upgrade branch

The upgrade branch was cut before upstream's forgejo removal, so its tree (and the
!testme run that verified it) did not reflect what would actually deploy. Merging
upstream in brings the branch current; the gitea 1.27.1-rootless bump — which fixes
CVE-2026-60004 and CVE-2026-59774 (both CVSS 9.8) — is unchanged.

.env.sample

@@ -8,10 +8,6 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml"
 # COMPOSE_FILE="$COMPOSE_FILE:compose.sqlite3.yml"
 # COMPOSE_FILE="$COMPOSE_FILE:compose.postgres.yml"
 
-# Enable to use forgejo instead of gitea
-# COMPOSE_FILE="$COMPOSE_FILE:compose.forgejo.yml"
-# SECRET_LFS_JWT_SECRET_VERSION=v1 # length=43
-
 # Enable Git LFS on plain gitea (not needed with forgejo, which bundles it).
 # Mounts the lfs_jwt_secret secret and sets GITEA_LFS_START_SERVER=true.
 # COMPOSE_FILE="$COMPOSE_FILE:compose.lfs.yml"

abra.sh

@@ -1,5 +1,5 @@
 export APP_INI_VERSION=v22
-export DOCKER_SETUP_SH_VERSION=v3
+export DOCKER_SETUP_SH_VERSION=v1
 export PG_BACKUP_VERSION=v1
 
 abra_backup_app() {

app.ini.tmpl

@@ -61,7 +61,7 @@ SSH_LISTEN_PORT = {{ env "GITEA_SSH_PORT" }}
 SSH_PORT = {{ env "GITEA_SSH_PORT" }}
 START_SSH_SERVER = true
 LFS_START_SERVER = {{ env "GITEA_LFS_START_SERVER" }}
-{{ if or (eq (env "FORGE") "forgejo") (eq (env "GITEA_LFS_START_SERVER") "true") }}
+{{ if (eq (env "GITEA_LFS_START_SERVER") "true") }}
 LFS_JWT_SECRET = {{ secret "lfs_jwt_secret" }}
 {{ end }}
 

compose.forgejo.yml

@@ -1,13 +0,0 @@
-version: '3.8'
-
-services:
-  app:
-    image: codeberg.org/forgejo/forgejo:12.0.2-rootless
-    environment:
-    - FORGE=forgejo
-    secrets:
-    - lfs_jwt_secret
-secrets:
-  lfs_jwt_secret:
-    name: ${STACK_NAME}_lfs_jwt_secret_${SECRET_LFS_JWT_SECRET_VERSION}
-    external: true

compose.postgres.yml

@@ -10,7 +10,7 @@ services:
     secrets:
       - db_password
   db:
-    image: postgres:15.13
+    image: postgres:15.18
     deploy:
       labels:
         backupbot.backup.pre-hook: "/pg_backup.sh backup"

compose.yml

@@ -3,10 +3,10 @@ version: "3.8"
 
 services:
   app:
-    image: "gitea/gitea:1.24.2-rootless"
+    image: "gitea/gitea:1.27.1-rootless"
     configs:
       - source: app_ini
-        target: /etc/gitea/app.ini.init
+        target: /etc/gitea/app.ini
       - source: docker_setup_sh
         target: /usr/local/bin/docker-setup.sh
         mode: 0555
@@ -15,7 +15,6 @@ services:
       - jwt_secret
       - secret_key
     environment:
-      - FORGE=gitea
       - GITEA_ALLOW_ONLY_EXTERNAL_REGISTRATION
       - GITEA_APP_NAME
       - GITEA_AUTO_WATCH_NEW_REPOS

docker-setup.sh.tmpl

@@ -13,17 +13,3 @@ mkdir -p ${GITEA_CUSTOM} && chmod 0500 ${GITEA_CUSTOM}
 # Prepare temp folder
 mkdir -p ${GITEA_TEMP} && chmod 0700 ${GITEA_TEMP}
 if [ ! -w ${GITEA_TEMP} ]; then echo "${GITEA_TEMP} is not writable"; exit 1; fi
-
-# Seed app.ini into the WRITABLE config volume (/etc/gitea) from the read-only swarm config
-# (mounted at /etc/gitea/app.ini.init). Gitea must be able to PERSIST settings to app.ini — e.g.
-# Gitea 1.24+ (re)generates and SAVES the [oauth2] JWT_SECRET at LoadCommonSettings; with app.ini
-# mounted directly as a read-only swarm config this fails fatally ("open /etc/gitea/app.ini:
-# read-only file system") on (re)deploy. Seed when MISSING OR EMPTY (`! -s`, not `! -f`): upgrading
-# from a release that mounted app.ini directly as a swarm config leaves a 0-byte placeholder at
-# /etc/gitea/app.ini in the reattached config volume — `! -f` would treat that as "present" and skip,
-# leaving Gitea to boot the install wizard on an empty config. A non-empty app.ini (Gitea's persisted
-# state) is preserved across restarts; truncate/delete it to force a re-seed from the rendered config.
-if [ ! -s /etc/gitea/app.ini ]; then
-  cp /etc/gitea/app.ini.init /etc/gitea/app.ini
-fi
-chmod 0600 /etc/gitea/app.ini 2>/dev/null || true

release/next

@@ -0,0 +1,6 @@
+Forgejo support has been moved to its own recipe.  Make the move by:
+
+* Getting the recipe locally with `abra recipe fetch forgejo`
+* Changing the recipe's TYPE with `abra application config FORGEJO_DOMAIN`
+* Redeploy the app with `abra application undeploy` and `abra
+  application deploy`