Dread Forgejo Infra

Ansible-controlled Forgejo deployment for git.dread.technology / dgit.

Target service:

• Host: first VPS target TBD, recommended label vultr-dgit-1
• App: Forgejo in Docker Compose
• Public URL: https://git.dread.technology
• App listen port: 127.0.0.1:3000
• SSH clone port: 127.0.0.1:2222 initially, public/tailnet route TBD
• Database: co-located postgres:16 in Compose for first deployment
• Control node: Brixton Mac Studio

This repo intentionally stores templates and runbooks, not secrets. Put secrets in secrets/prod.yml, which is ignored by git.

Happy Path

Provision or target a VPS, then:

git clone <repo-url>
cd dread-forgejo-infra
make deps
make init
make set-target HOST=<vps-ip-or-hostname> SSH_USER=root
make bootstrap-host
make set-tailnet-target HOST=<tailnet-hostname> SSH_USER=brixton
make preflight
make deploy
make cloudflare
make status

make cloudflare maps https://git.dread.technology to http://127.0.0.1:3000 on the target.

First Security Defaults

• Forgejo web and SSH bind to loopback by default.
• Self-registration is disabled.
• REQUIRE_SIGNIN_VIEW is enabled.
• HTTPS clone/push through Cloudflare Tunnel is the first supported path.
• Public SSH Git is a later explicit route decision.
• Agents use Forgejo service accounts/tokens, not human sessions.

See docs/operator-guide.md for the full workflow.

Current QA Status

See docs/qa-2026-06-18-dgit.md for the latest visual, auth, Cloudflare, and external-sharing readiness pass.