Wire account verification end-to-end and fix an RFC 5322 mail bug (#1)

deploy/forgejo/docker-stack.yml

@@ -62,13 +62,19 @@ services:
       FORGEJO__server__DOMAIN: "${FORGEJO_DOMAIN:-git.thermograph.org}"
       FORGEJO__server__ROOT_URL: "https://${FORGEJO_DOMAIN:-git.thermograph.org}/"
       FORGEJO__server__SSH_PORT: "2222"
+      # Without this, Forgejo starts no SSH server at all despite SSH_PORT
+      # being set — git@ clones get "connection refused", not a slow failure.
+      FORGEJO__server__START_SSH_SERVER: "true"
+      # Config is fully supplied via env, so lock the install wizard rather
+      # than leave it open on the public internet waiting for someone to
+      # complete it first (DB config alone does NOT imply this).
+      FORGEJO__security__INSTALL_LOCK: "true"
       # Actions on: repo/org/user-level runners register against this instance.
       FORGEJO__actions__ENABLED: "true"
       # Gitea/Forgejo's app.ini env-mapping honors a __FILE suffix to read a
       # value from a file instead of the literal env var — same convention as
       # the official Postgres image's POSTGRES_PASSWORD_FILE above.
       FORGEJO__database__PASSWD__FILE: /run/secrets/forgejo_db_password
-      FORGEJO__database__USER: forgejo
     secrets:
       - source: forgejo_db_password
         target: forgejo_db_password
@@ -83,13 +89,15 @@ services:
         published: 2222
         protocol: tcp
         mode: host
-      # Web UI/API — host-local only. Not reachable from outside beta itself;
+      # Web UI/API. Swarm's port schema has no host_ip scoping, so this binds
-      # beta's own Caddy reverse-proxies to it (see deploy/forgejo/README.md).
+      # 0.0.0.0:3080 on beta — NOT actually localhost-only by itself. A
+      # DOCKER-USER iptables rule (see deploy/forgejo/README.md) is what
+      # actually restricts it, since Docker's own iptables rules bypass ufw
+      # for published ports. beta's Caddy reverse-proxies to 127.0.0.1:3080.
       - target: 3000
         published: 3080
         protocol: tcp
         mode: host
-        host_ip: 127.0.0.1
     deploy:
       placement:
         constraints: [node.labels.role == forge]

deploy/swarm/firewall-swarm.sh

@@ -30,5 +30,12 @@ echo
 echo "Rules added (not yet necessarily active — check ufw status):"
 ufw status numbered | grep -E "2377|7946|4789|Status" || true
 echo
-echo "If ufw is inactive, enable it: ufw enable   (make sure your SSH port is"
+if ! ufw status | grep -q "^Status: active"; then
-echo "allowed FIRST, or you will lock yourself out)."
+  echo "ufw is currently INACTIVE on this node — 'ufw enable' switches its"
+  echo "default policy to deny-incoming for EVERYTHING, not just the Swarm"
+  echo "ports above. Before enabling, explicitly allow every port this node"
+  echo "already serves publicly (SSH at minimum; on beta specifically, also"
+  echo "80/tcp and 443/tcp for the live thermograph.org Caddy) — check"
+  echo "'ss -tlnp' for what's actually listening first. Enabling ufw without"
+  echo "doing this WILL drop live traffic the moment it activates."
+fi