From 9ffd9d1cfb859cd7121ec89859755d050c1e5ca0 Mon Sep 17 00:00:00 2001 From: emi Date: Tue, 21 Jul 2026 03:57:20 +0000 Subject: [PATCH] Wire account verification end-to-end and fix an RFC 5322 mail bug (#1) --- deploy/forgejo/docker-stack.yml | 16 ++++++++++++---- deploy/swarm/firewall-swarm.sh | 11 +++++++++-- 2 files changed, 21 insertions(+), 6 deletions(-) diff --git a/deploy/forgejo/docker-stack.yml b/deploy/forgejo/docker-stack.yml index d35788f..9b0847f 100644 --- a/deploy/forgejo/docker-stack.yml +++ b/deploy/forgejo/docker-stack.yml @@ -62,13 +62,19 @@ services: FORGEJO__server__DOMAIN: "${FORGEJO_DOMAIN:-git.thermograph.org}" FORGEJO__server__ROOT_URL: "https://${FORGEJO_DOMAIN:-git.thermograph.org}/" FORGEJO__server__SSH_PORT: "2222" + # Without this, Forgejo starts no SSH server at all despite SSH_PORT + # being set — git@ clones get "connection refused", not a slow failure. + FORGEJO__server__START_SSH_SERVER: "true" + # Config is fully supplied via env, so lock the install wizard rather + # than leave it open on the public internet waiting for someone to + # complete it first (DB config alone does NOT imply this). + FORGEJO__security__INSTALL_LOCK: "true" # Actions on: repo/org/user-level runners register against this instance. FORGEJO__actions__ENABLED: "true" # Gitea/Forgejo's app.ini env-mapping honors a __FILE suffix to read a # value from a file instead of the literal env var — same convention as # the official Postgres image's POSTGRES_PASSWORD_FILE above. FORGEJO__database__PASSWD__FILE: /run/secrets/forgejo_db_password - FORGEJO__database__USER: forgejo secrets: - source: forgejo_db_password target: forgejo_db_password @@ -83,13 +89,15 @@ services: published: 2222 protocol: tcp mode: host - # Web UI/API — host-local only. Not reachable from outside beta itself; - # beta's own Caddy reverse-proxies to it (see deploy/forgejo/README.md). + # Web UI/API. Swarm's port schema has no host_ip scoping, so this binds + # 0.0.0.0:3080 on beta — NOT actually localhost-only by itself. A + # DOCKER-USER iptables rule (see deploy/forgejo/README.md) is what + # actually restricts it, since Docker's own iptables rules bypass ufw + # for published ports. beta's Caddy reverse-proxies to 127.0.0.1:3080. - target: 3000 published: 3080 protocol: tcp mode: host - host_ip: 127.0.0.1 deploy: placement: constraints: [node.labels.role == forge] diff --git a/deploy/swarm/firewall-swarm.sh b/deploy/swarm/firewall-swarm.sh index ba00b6a..0e0ee65 100755 --- a/deploy/swarm/firewall-swarm.sh +++ b/deploy/swarm/firewall-swarm.sh @@ -30,5 +30,12 @@ echo echo "Rules added (not yet necessarily active — check ufw status):" ufw status numbered | grep -E "2377|7946|4789|Status" || true echo -echo "If ufw is inactive, enable it: ufw enable (make sure your SSH port is" -echo "allowed FIRST, or you will lock yourself out)." +if ! ufw status | grep -q "^Status: active"; then + echo "ufw is currently INACTIVE on this node — 'ufw enable' switches its" + echo "default policy to deny-incoming for EVERYTHING, not just the Swarm" + echo "ports above. Before enabling, explicitly allow every port this node" + echo "already serves publicly (SSH at minimum; on beta specifically, also" + echo "80/tcp and 443/tcp for the live thermograph.org Caddy) — check" + echo "'ss -tlnp' for what's actually listening first. Enabling ufw without" + echo "doing this WILL drop live traffic the moment it activates." +fi