chore: merge upstream main (BREAKING CHANGE: remove forgejo) into upgrade branch

The upgrade branch was cut before upstream's forgejo removal, so its tree (and the
!testme run that verified it) did not reflect what would actually deploy. Merging
upstream in brings the branch current; the gitea 1.27.1-rootless bump — which fixes
CVE-2026-60004 and CVE-2026-59774 (both CVSS 9.8) — is unchanged.

.env.sample

@@ -8,8 +8,9 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml"
 # COMPOSE_FILE="$COMPOSE_FILE:compose.sqlite3.yml"
 # COMPOSE_FILE="$COMPOSE_FILE:compose.postgres.yml"
 
-# Enable to use forgejo instead of gitea
+# Enable Git LFS on plain gitea (not needed with forgejo, which bundles it).
-# COMPOSE_FILE="$COMPOSE_FILE:compose.forgejo.yml"
+# Mounts the lfs_jwt_secret secret and sets GITEA_LFS_START_SERVER=true.
+# COMPOSE_FILE="$COMPOSE_FILE:compose.lfs.yml"
 # SECRET_LFS_JWT_SECRET_VERSION=v1 # length=43
 
 GITEA_DOMAIN=git.example.com

abra.sh

@@ -1,4 +1,4 @@
-export APP_INI_VERSION=v21
+export APP_INI_VERSION=v22
 export DOCKER_SETUP_SH_VERSION=v1
 export PG_BACKUP_VERSION=v1
 

app.ini.tmpl

@@ -61,7 +61,7 @@ SSH_LISTEN_PORT = {{ env "GITEA_SSH_PORT" }}
 SSH_PORT = {{ env "GITEA_SSH_PORT" }}
 START_SSH_SERVER = true
 LFS_START_SERVER = {{ env "GITEA_LFS_START_SERVER" }}
-{{ if eq (env "FORGE") "forgejo" }}
+{{ if (eq (env "GITEA_LFS_START_SERVER") "true") }}
 LFS_JWT_SECRET = {{ secret "lfs_jwt_secret" }}
 {{ end }}
 

compose.lfs.yml

@@ -1,12 +1,12 @@
-version: '3.8'
+version: "3.8"
 
 services:
   app:
-    image: codeberg.org/forgejo/forgejo:12.0.2-rootless
     environment:
-    - FORGE=forgejo
+      - GITEA_LFS_START_SERVER=true
     secrets:
       - lfs_jwt_secret
+
 secrets:
   lfs_jwt_secret:
     name: ${STACK_NAME}_lfs_jwt_secret_${SECRET_LFS_JWT_SECRET_VERSION}

compose.postgres.yml

@@ -10,7 +10,7 @@ services:
     secrets:
       - db_password
   db:
-    image: postgres:15.13
+    image: postgres:15.18
     deploy:
       labels:
         backupbot.backup.pre-hook: "/pg_backup.sh backup"

compose.yml

@@ -3,7 +3,7 @@ version: "3.8"
 
 services:
   app:
-    image: "gitea/gitea:1.24.2-rootless"
+    image: "gitea/gitea:1.27.1-rootless"
     configs:
       - source: app_ini
         target: /etc/gitea/app.ini
@@ -15,7 +15,6 @@ services:
       - jwt_secret
       - secret_key
     environment:
-      - FORGE=gitea
       - GITEA_ALLOW_ONLY_EXTERNAL_REGISTRATION
       - GITEA_APP_NAME
       - GITEA_AUTO_WATCH_NEW_REPOS
@@ -88,7 +87,7 @@ services:
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100"
         - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true"
-        - coop-cloud.${STACK_NAME}.version=3.5.3+1.24.2-rootless
+        - coop-cloud.${STACK_NAME}.version=3.6.0+1.24.2-rootless
 
 
 networks:

release/next

@@ -0,0 +1,6 @@
+Forgejo support has been moved to its own recipe.  Make the move by:
+
+* Getting the recipe locally with `abra recipe fetch forgejo`
+* Changing the recipe's TYPE with `abra application config FORGEJO_DOMAIN`
+* Redeploy the app with `abra application undeploy` and `abra
+  application deploy`