forgejo: serve dev.jinemi.com alongside git.thermograph.org #148

Merged

admin_emi merged 3 commits from feat/forgejo-jinemi-alias into dev

2026-08-01 16:28:50 +00:00

admin_emi commented

2026-08-01 16:16:42 +00:00

Owner

Serves dev.jinemi.com from vps1's Caddy alongside git.thermograph.org, as the transitional state of the domain migration. Both names already resolve to vps1; both are now served, with git.thermograph.org still canonical.

Both hostnames go on a single site block. That is load-bearing rather than cosmetic: the /v2/* mesh-only matcher that keeps the OCI registry API off the public internet (hazard #15) is scoped per block, so a separate block for the new name would have served the same Forgejo with the registry wide open.

Forgejo has exactly one ROOT_URL and builds every absolute URL from it, so on dev.jinemi.com the clone URLs, OAuth callback and post-login redirects still name git.thermograph.org. Browsing, git-over-HTTP and the API work on both. deploy/forgejo/README.md gains a "Migrating the domain" section documenting the four prerequisites for flipping FORGEJO_DOMAIN — the Google OAuth redirect URI is the one that locks everyone out if missed, since login is SSO-only.

Also ignores .claude/settings.local.json, which was untracked but not ignored, so one git add -A would have published an operator's local permission allowlist as shared repo config.

Applied and verified live

vps1's /etc/caddy/Caddyfile is edited by hand, so this was applied there as well as tracked here:

https://dev.jinemi.com/ -> 200, serving Forgejo; Let's Encrypt cert issued via HTTP-01 on reload
/v2/ -> 403 from the public internet on both hostnames
git.thermograph.org/v2/ -> 401 (registry auth challenge) from vps2 over the mesh, so the CI push/pull path is intact
emigriffith.dev 200, dashboard.thermograph.org 302, dev.thermograph.org/healthz 200 — no collateral damage
caddy validate passed before reload; pre-change backup at /etc/caddy/Caddyfile.bak-jinemi

Serves `dev.jinemi.com` from vps1's Caddy alongside `git.thermograph.org`, as the transitional state of the domain migration. Both names already resolve to vps1; both are now served, with `git.thermograph.org` still canonical. Both hostnames go on a **single** site block. That is load-bearing rather than cosmetic: the `/v2/*` mesh-only matcher that keeps the OCI registry API off the public internet (hazard #15) is scoped per block, so a separate block for the new name would have served the same Forgejo with the registry wide open. Forgejo has exactly one `ROOT_URL` and builds every absolute URL from it, so on `dev.jinemi.com` the clone URLs, OAuth callback and post-login redirects still name `git.thermograph.org`. Browsing, git-over-HTTP and the API work on both. `deploy/forgejo/README.md` gains a "Migrating the domain" section documenting the four prerequisites for flipping `FORGEJO_DOMAIN` — the Google OAuth redirect URI is the one that locks everyone out if missed, since login is SSO-only. Also ignores `.claude/settings.local.json`, which was untracked but not ignored, so one `git add -A` would have published an operator's local permission allowlist as shared repo config. ### Applied and verified live vps1's `/etc/caddy/Caddyfile` is edited by hand, so this was applied there as well as tracked here: - `https://dev.jinemi.com/` -> 200, serving Forgejo; Let's Encrypt cert issued via HTTP-01 on reload - `/v2/` -> 403 from the public internet on **both** hostnames - `git.thermograph.org/v2/` -> 401 (registry auth challenge) from vps2 over the mesh, so the CI push/pull path is intact - `emigriffith.dev` 200, `dashboard.thermograph.org` 302, `dev.thermograph.org/healthz` 200 — no collateral damage - `caddy validate` passed before reload; pre-change backup at `/etc/caddy/Caddyfile.bak-jinemi`

admin_emi added 2 commits 2026-08-01 16:16:43 +00:00

forgejo: serve dev.jinemi.com alongside git.thermograph.org 396b80cf91

Both hostnames go on a single Caddy site block. That is load-bearing rather
than cosmetic: the /v2/* mesh-only matcher that keeps the OCI registry API
off the public internet (hazard #15) is scoped per block, so a separate
block for the new name would serve the same Forgejo with the registry open.

git.thermograph.org stays canonical — Forgejo has one ROOT_URL and builds
every absolute URL from it, so clone URLs, the OAuth callback and post-login
redirects keep naming the .org host. Flipping FORGEJO_DOMAIN additionally
requires the Google OAuth redirect URI, the registry host baked into image
names and runner labels, and the mesh /etc/hosts pins; README documents
those prerequisites.

Config verified with `caddy validate` and by asserting against the adapted
JSON that the /v2 403 guard matches both hostnames.

gitignore: ignore .claude/settings.local.json

PR build (required check) / changes (pull_request) Successful in 6s

Details

secrets-guard / encrypted (pull_request) Successful in 7s

Details

PR build (required check) / build-backend (pull_request) Has been skipped

Details

shell-lint / shellcheck (pull_request) Successful in 7s

Details

PR build (required check) / build-frontend (pull_request) Has been skipped

Details

PR build (required check) / validate-observability (pull_request) Has been skipped

Details

PR build (required check) / gate (pull_request) Successful in 2s

Details

5b5f28560d

It was untracked but not ignored, so a single `git add -A` would have
committed one operator's local permission allowlist — including which vault
secrets they may decrypt — as shared repo config. `.claude/settings.json`
stays tracked as the reviewed team config.

admin_emi changed title from ~~WIP: forgejo: serve dev.jinemi.com alongside git.thermograph.org~~ to forgejo: serve dev.jinemi.com alongside git.thermograph.org

2026-08-01 16:19:21 +00:00

admin_emi referenced this pull request from a commit

2026-08-01 16:27:27 +00:00

Merge dev into feat/forgejo-jinemi-alias (dev moved while #148 was open)

admin_emi added 1 commit 2026-08-01 16:27:28 +00:00

Merge dev into feat/forgejo-jinemi-alias (dev moved while #148 was open)

PR build (required check) / changes (pull_request) Successful in 7s

Details

secrets-guard / encrypted (pull_request) Successful in 5s

Details

PR build (required check) / build-backend (pull_request) Has been skipped

Details