forgejo: make dev.jinemi.com canonical (ROOT_URL and OAuth callback) #151

Merged

admin_emi merged 1 commit from feat/forgejo-oauth-jinemi into dev

2026-08-01 16:33:17 +00:00

admin_emi commented

2026-08-01 16:32:32 +00:00

Owner

Makes dev.jinemi.com Forgejo's ROOT_URL, which is what actually moves clone URLs, the Google OAuth callback, webhook payload URLs and mail links onto the new domain. Serving the hostname (#148) was the cheap half; Forgejo has exactly one ROOT_URL and derives every absolute URL from it.

OAuth was verified before the flip, not assumed. Login is Google-SSO-only, so a redirect-URI mismatch locks everyone out of the UI — including out of the ability to undo it. Probing Google directly with the real client ID:

Callback URI	Before	After
`git.thermograph.org/user/oauth2/google/callback`	accepted	accepted
`dev.jinemi.com/user/oauth2/google/callback`	`redirect_uri_mismatch`	accepted

Both URIs are now registered. The README documents the probe command so the check stays repeatable instead of becoming folklore.

git.thermograph.org stays served, and stays load-bearing. It is not a courtesy redirect for old bookmarks — CI resolves it:

the registry host is baked into image names, runner labels, ci-runner/Dockerfile and every already-pushed tag;
mesh clients pin it to 10.10.0.2 in /etc/hosts, which is what makes Caddy's /v2/* matcher see a mesh source IP rather than returning 403;
registered runners hold https://git.thermograph.org as their instance URL.

Renaming the registry host is a separate migration. The docs now say that at each place someone would otherwise retire the name as dead weight.

Both names remain on a single Caddy site block — the /v2/* mesh-only matcher is per-block, so splitting them would re-expose the registry API publicly.

The stack has no auto-deploy trigger, so this takes effect only on a manual docker stack deploy from the manager (vps2), which follows once this lands.

Makes `dev.jinemi.com` Forgejo's `ROOT_URL`, which is what actually moves clone URLs, the Google OAuth callback, webhook payload URLs and mail links onto the new domain. Serving the hostname (#148) was the cheap half; Forgejo has exactly one `ROOT_URL` and derives every absolute URL from it. **OAuth was verified before the flip, not assumed.** Login is Google-SSO-only, so a redirect-URI mismatch locks everyone out of the UI — including out of the ability to undo it. Probing Google directly with the real client ID: | Callback URI | Before | After | |---|---|---| | `git.thermograph.org/user/oauth2/google/callback` | accepted | accepted | | `dev.jinemi.com/user/oauth2/google/callback` | `redirect_uri_mismatch` | accepted | Both URIs are now registered. The README documents the probe command so the check stays repeatable instead of becoming folklore. **`git.thermograph.org` stays served, and stays load-bearing.** It is not a courtesy redirect for old bookmarks — CI resolves it: - the registry host is baked into image names, runner labels, `ci-runner/Dockerfile` and every already-pushed tag; - mesh clients pin it to `10.10.0.2` in `/etc/hosts`, which is what makes Caddy's `/v2/*` matcher see a mesh source IP rather than returning 403; - registered runners hold `https://git.thermograph.org` as their instance URL. Renaming the registry host is a separate migration. The docs now say that at each place someone would otherwise retire the name as dead weight. Both names remain on a **single** Caddy site block — the `/v2/*` mesh-only matcher is per-block, so splitting them would re-expose the registry API publicly. The stack has no auto-deploy trigger, so this takes effect only on a manual `docker stack deploy` from the manager (vps2), which follows once this lands.

admin_emi added 1 commit 2026-08-01 16:32:33 +00:00

forgejo: make dev.jinemi.com canonical (ROOT_URL and OAuth callback)

PR build (required check) / changes (pull_request) Successful in 6s

Details

PR build (required check) / build-backend (pull_request) Has been skipped

Details

PR build (required check) / build-frontend (pull_request) Has been skipped

Details

secrets-guard / encrypted (pull_request) Successful in 9s

Details

shell-lint / shellcheck (pull_request) Successful in 7s

Details

PR build (required check) / validate-observability (pull_request) Has been skipped

Details

PR build (required check) / gate (pull_request) Successful in 1s

Details

a83a0b7d32

Forgejo derives every absolute URL from its single ROOT_URL, so this is what
moves clone URLs, the Google OAuth callback, webhook payload URLs and mail
links onto the new domain. Both redirect URIs are registered on the Google
OAuth client and were verified against Google before the flip — login is
SSO-only, so a mismatch locks everyone out of the UI including out of undoing
it. README documents the probe so the check is repeatable rather than assumed.

git.thermograph.org stays on the same Caddy site block and stays load-bearing:
the registry host baked into image names, the mesh /etc/hosts pins that make
the /v2/* matcher see a mesh source IP, and the runners' registered instance
URL all still use it. Renaming the registry is a separate migration; the docs
now say so where someone would otherwise retire the name as dead weight.

The stack has no auto-deploy, so this takes effect on a manual
`docker stack deploy` from the manager.