Jinemi/thermograph
4
0
Fork 0
Code Issues 2 Pull requests 9 Projects Releases Packages Wiki Activity Actions

Forgejo: OAuth-only login with approval-gated access + mesh mailer (#24)

Browse source
This commit is contained in:
emi 2026-07-21 23:23:37 +00:00
parent 24749de0c7
commit 6e655722e4
1 changed files with 28 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

36
deploy/forgejo/docker-stack.yml
View file

@ -71,16 +71,36 @@ services:
FORGEJO__security__INSTALL_LOCK: "true" FORGEJO__security__INSTALL_LOCK: "true"
# Actions on: repo/org/user-level runners register against this instance. # Actions on: repo/org/user-level runners register against this instance.
FORGEJO__actions__ENABLED: "true" FORGEJO__actions__ENABLED: "true"
# Google SSO account handling. Forgejo only consults ACCOUNT_LINKING during # --- Access model: OAuth-only login, multi-user via an approval gate ---
# the auto-registration path, so auto-registration must be ON for a Google # Login is Google SSO only. Forgejo 9.0.3 has no setting to hide the
# login to auto-link (by verified email) to the existing account instead of # password sign-in form, so "OAuth-only" is enforced operationally: every
# dropping to the manual link/register page. To keep that from letting *any* # account is given an unusable (random) password and no NEW local account
# Google user register, the auth source pins a required email claim (added # can be created (ALLOW_ONLY_EXTERNAL_REGISTRATION). ENABLE_PASSWORD_SIGNIN_FORM
# via `forgejo admin auth update-oauth --required-claim-name email # is set anyway — ignored on 9.0.3, effective if the instance is upgraded.
# --required-claim-value <you>@gmail.com`), so only that one address can log # Auto-registration stays ON so a Google login auto-links (by verified email)
# in at all — it collides with the existing account's email and links to it. # to a PRE-CREATED account (`forgejo admin user create --username X --email
# X@gmail.com --random-password`). A single required-claim-value can't
# allowlist more than one email, so instead of pinning one address the
# required-claim-value is CLEARED (a DB change on the auth source, persisted
# in the forgejo_data volume — not re-applied from here) and every NEW signup
# is gated: a stranger who signs in with Google lands INACTIVE
# (REGISTER_MANUAL_CONFIRM) and RESTRICTED (DEFAULT_USER_IS_RESTRICTED)
# pending admin approval, so an un-provisioned Google user gets zero access.
FORGEJO__oauth2_client__ACCOUNT_LINKING: "auto" FORGEJO__oauth2_client__ACCOUNT_LINKING: "auto"
FORGEJO__oauth2_client__ENABLE_AUTO_REGISTRATION: "true" FORGEJO__oauth2_client__ENABLE_AUTO_REGISTRATION: "true"
FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION: "true"
FORGEJO__service__ENABLE_PASSWORD_SIGNIN_FORM: "false"
FORGEJO__service__REGISTER_MANUAL_CONFIRM: "true"
FORGEJO__service__DEFAULT_USER_IS_RESTRICTED: "true"
# Outbound mail via prod's Postfix null client over the WireGuard mesh
# (10.10.0.1:25 — mynetworks permits beta); self-signed cert on :25, so
# trust it. Send-only; used for admin/approval and notification mail.
FORGEJO__mailer__ENABLED: "true"
FORGEJO__mailer__PROTOCOL: "smtp"
FORGEJO__mailer__SMTP_ADDR: "10.10.0.1"
FORGEJO__mailer__SMTP_PORT: "25"
FORGEJO__mailer__FORCE_TRUST_SERVER_CERT: "true"
FORGEJO__mailer__FROM: "Thermograph Git <no-reply@thermograph.org>"
# Gitea/Forgejo's app.ini env-mapping honors a __FILE suffix to read a # Gitea/Forgejo's app.ini env-mapping honors a __FILE suffix to read a
# value from a file instead of the literal env var — same convention as # value from a file instead of the literal env var — same convention as
# the official Postgres image's POSTGRES_PASSWORD_FILE above. # the official Postgres image's POSTGRES_PASSWORD_FILE above.