Commit dd75657461727cf1146fb33cb1d6f0649c09e9b9 | home-infra

author	clover caruso <git@paperclover.net> 2026-01-02 01:00:15-08:00
committer	clover caruso <git@paperclover.net> 2026-01-05 03:50:50-08:00
log	dd75657461727cf1146fb33cb1d6f0649c09e9b9
tree	5215c462c216a452527df7d84a9a62ae705a9655
parent	914005dab4ce28f6ba6f52c236f3c621549630ce
signature	Commit is signed but in an unrecognized format.

feat: forgejo + snow sign on

10 files changed, 352 insertions(+), 175 deletions(-)

.env.example+1

...	...	@@ -8,6 +8,7 @@ APP_ROOT=./.apps
8	8	STORE_ROOT=/Volumes
9	9	CLOVER_ROOT=/Volumes/clover
10	10	MEDIA_ROOT=/Volumes/media
	11	TORRENT_TEMP=
11	12
12	13	MAILER_ADDRESS=smtp.example.com
13	14	MAILER_USERNAME=me@paperclover.net

compose.yaml+26-15

...	...	@@ -98,7 +98,7 @@ services:
98	98	keycloak:
99	99	condition: service_healthy
100	100	volumes:
101		- "${APP_ROOT}/keycloak/forward-auth:/shared/forward-auth:ro"
	101	- "${APP_ROOT}/keycloak:/shared:ro"
102	102	# file manager
103	103	copyparty: # port 80
104	104	image: copyparty/ac
...	...	@@ -146,37 +146,46 @@ services:
146	146	# git hosting
147	147	forgejo: # port 3000
148	148	container_name: forgejo
	149	image: code.forgejo.org/forgejo/forgejo:13
	150	entrypoint: ["/bin/sh", "/custom/init/entry.sh"]
	151	ports:
	152	- 22:22
	153	- 40244:3000 # port used for forgejo-runner
149	154	environment:
150	155	USER_UID: "$USER_ID"
151	156	USER_GID: "$GROUP_ID"
	157	HOME_DOMAIN: "${HOME_DOMAIN}"
152	158	FORGEJO_CUSTOM: "/custom"
153		FORGEJO__MAILER__SMTP_ADDR: "${MAILER_ADDRESS}"
154		FORGEJO__MAILER__USER: "${MAILER_USERNAME}"
155		FORGEJO__MAILER__PASSWD: "${MAILER_PASSWORD}"
156		FORGEJO__SERVER__LFS_JWT_SECRET: "${FORGEJO_SERVER_LFS_JWT_SECRET}"
157		FORGEJO__OAUTH2__JWT_SECRET: "${FORGEJO_OAUTH2_JWT_SECRET}"
158		FORGEJO__SECURITY__SECRET_KEY: "${FORGEJO_SECURITY_SECRET_KEY}"
159		FORGEJO__SECURITY__INTERNAL_TOKEN: "${FORGEJO_SECURITY_INTERNAL_TOKEN}"
160		image: code.forgejo.org/forgejo/forgejo:13
161		ports:
162		- 22:22
163		- 40244:3000
	159	MAILER_ADDRESS: "${MAILER_ADDRESS}"
	160	MAILER_USERNAME: "${MAILER_USERNAME}"
	161	MAILER_PASSWORD: "${MAILER_PASSWORD}"
	162	FORGEJO_SERVER_LFS_JWT_SECRET: "${FORGEJO_SERVER_LFS_JWT_SECRET}"
	163	FORGEJO_OAUTH2_JWT_SECRET: "${FORGEJO_OAUTH2_JWT_SECRET}"
	164	FORGEJO_SECURITY_SECRET_KEY: "${FORGEJO_SECURITY_SECRET_KEY}"
	165	FORGEJO_SECURITY_INTERNAL_TOKEN: "${FORGEJO_SECURITY_INTERNAL_TOKEN}"
164	166	restart: unless-stopped
165	167	volumes:
	168	- "${APP_ROOT}/keycloak:/shared-keys:ro"
166	169	- "${APP_ROOT}/forgejo:/data:rw"
167	170	- "/etc/timezone:/etc/timezone:ro"
168	171	- "/etc/localtime:/etc/localtime:ro"
169		- ./config/forgejo:/custom:ro
	172	- ./config/forgejo/public:/custom/public:ro
	173	- ./config/forgejo/templates:/custom/templates:ro
170	174	- ./config/font:/custom/public/assets/font:ro
	175	- ./config/forgejo/init:/custom/init:ro
171	176	labels:
172	177	net.paperclover.list.name: Clover Git Forge
173	178	net.paperclover.list.domain: git
174	179	net.paperclover.list.priority: 105
175	180	depends_on:
	181	postgres:
	182	condition: service_healthy
	183	redis:
	184	condition: service_healthy
176	185	keycloak:
177	186	condition: service_healthy
178		# forgejo-anubis:
179		# condition: service_healthy
	187	forgejo-anubis:
	188	condition: service_started
180	189	forgejo-anubis:
181	190	container_name: forgejo-anubis
182	191	image: ghcr.io/techarohq/anubis:latest
...	...	@@ -385,6 +394,8 @@ services:
385	394	timeout: 5s
386	395	retries: 5
387	396	start_period: 10s
	397	ports:
	398	- 5432:5432
388	399	pgadmin: # port 80
389	400	container_name: pgadmin
390	401	entrypoint: ["/bin/sh", "/init/pgadmin-init.sh"]

config/Caddyfile+3

...	...	@@ -68,6 +68,9 @@ db.{$HOME_DOMAIN} {
68	68	reverse_proxy "http://clover-source-of-truth"
69	69	}
70	70	git.{$HOME_DOMAIN} {
	71	handle /user/login {
	72	rewrite /user/oauth2/snow
	73	}
71	74	reverse_proxy "http://forgejo-anubis" {
72	75	header_up X-Real-Ip {remote_host}
73	76	header_up X-Http-Version {http.request.proto}

config/forgejo/conf/app.ini deleted-105

...	...	@@ -1,105 +0,0 @@
1		APP_NAME="clover's git"
2		APP_SLOGAL=and then we knew, just like paper airplanes: that we could fly...
3		RUN_MODE=prod
4		RUN_USER=git
5		WORK_PATH=/data/work
6
7		[repository]
8		MAX_CREATION_LIMIT=0
9		ROOT=/data/git/repositories
10		DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH=true
11		DEFAULT_REPO_UNITS=repo.code,repo.issues,repo.pulls
12		DISABLE_STARS=true
13		DEFAULT_BRANCH=master
14
15		[repository.local]
16		LOCAL_COPY_PATH=/data/work/tmp/local-repo
17
18		[repository.upload]
19		TEMP_PATH=/data/work/uploads
20
21		[ui]
22		EXPLORE_PAGING_NUM=100
23		ISSUE_PAGING_NUM=500
24		MEMBERS_PAGING_NUM=100
25		THEMES=clover
26		DEFAULT_THEME=clover
27
28		[server]
29		APP_DATA_PATH=/data/work
30		DOMAIN=git.paperclover.net
31		SSH_DOMAIN=git.paperclover.net
32		HTTP_PORT=3000
33		ROOT_URL=https://git.paperclover.net/
34		DISABLE_SSH=false
35		SSH_PORT=22
36		SSH_LISTEN_PORT=22
37		LFS_START_SERVER=true
38		OFFLINE_MODE=true
39		LANDING_PAGE=/explore/repos
40
41		[database]
42		PATH=/data/work/gitea.db
43		DB_TYPE=sqlite3
44		HOST=localhost:3306
45		NAME=gitea
46		USER=root
47		PASSWD=
48		LOG_SQL=false
49		SCHEMA=
50		SSL_MODE=disable
51
52		[indexer]
53		ISSUE_INDEXER_PATH=/data/work/indexers/issues.bleve
54
55		[session]
56		PROVIDER_CONFIG=/data/work/sessions
57		PROVIDER=file
58
59		[picture]
60		AVATAR_UPLOAD_PATH=/data/work/avatars
61		REPOSITORY_AVATAR_UPLOAD_PATH=/data/work/repo-avatars
62
63		[admin]
64		DISABLE_REGULAR_ORG_CREATION=true
65
66		[attachment]
67		PATH=/data/work/attachments
68
69		[log]
70		MODE=console
71		LEVEL=info
72		ROOT_PATH=/data/work/log
73
74		[security]
75		INSTALL_LOCK=true
76		REVERSE_PROXY_LIMIT=1
77		REVERSE_PROXY_TRUSTED_PROXIES=*
78		PASSWORD_HASH_ALGO=pbkdf2_hi
79
80		[service]
81		DISABLE_REGISTRATION=false
82		REQUIRE_SIGNIN_VIEW=false
83		REGISTER_EMAIL_CONFIRM=true
84		ENABLE_NOTIFY_MAIL=true
85		ALLOW_ONLY_EXTERNAL_REGISTRATION=false
86		DEFAULT_KEEP_EMAIL_PRIVATE=false
87		DEFAULT_ALLOW_CREATE_ORGANIZATION=true
88		DEFAULT_ENABLE_TIMETRACKING=true
89		NO_REPLY_ADDRESS=noreply.localhost
90
91		[lfs]
92		PATH = /data/git/lfs
93
94		[mailer]
95		ENABLED = true
96		FROM=noreply.git@paperclover.net
97		PROTOCOL=smtps
98		SMTP_PORT=587
99		IS_TLS_ENABLED=true
100
101		[repository.pull-request]
102		DEFAULT_MERGE_STYLE=squash
103
104		[repository.signing]
105		DEFAULT_TRUST_MODEL=committer

config/forgejo/init/app.ini created+121

...	...	@@ -0,0 +1,121 @@
	1	APP_NAME="clover's git"
	2	APP_SLOGAL=and then we knew, just like paper airplanes: that we could fly...
	3	RUN_MODE=prod
	4	RUN_USER=git
	5	WORK_PATH=/data/work
	6
	7	[repository]
	8	MAX_CREATION_LIMIT=0
	9	ROOT=/data/git/repositories
	10	DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH=true
	11	DEFAULT_REPO_UNITS=repo.code,repo.issues,repo.pulls
	12	DISABLE_STARS=true
	13	DISABLE_FORKS=true
	14	DEFAULT_BRANCH=master
	15
	16	[repository.local]
	17	LOCAL_COPY_PATH=/data/work/tmp/local-repo
	18
	19	[repository.upload]
	20	TEMP_PATH=/data/work/uploads
	21
	22	[ui]
	23	EXPLORE_PAGING_NUM=100
	24	ISSUE_PAGING_NUM=500
	25	MEMBERS_PAGING_NUM=100
	26	THEMES=clover
	27	DEFAULT_THEME=clover
	28
	29	[server]
	30	APP_DATA_PATH=/data/work
	31	DOMAIN=git.$HOME_DOMAIN
	32	SSH_DOMAIN=git.$HOME_DOMAIN
	33	HTTP_PORT=3000
	34	ROOT_URL=https://git.$HOME_DOMAIN/
	35	DISABLE_SSH=false
	36	SSH_PORT=22
	37	SSH_LISTEN_PORT=22
	38	LFS_JWT_SECRET=$FORGEJO_SERVER_LFS_JWT_SECRET
	39	LFS_START_SERVER=true
	40	OFFLINE_MODE=true
	41	LANDING_PAGE=/explore/repos
	42
	43	[database]
	44	PATH=/data/work/gitea.db
	45	DB_TYPE=sqlite3
	46	HOST=localhost:3306
	47	NAME=gitea
	48	USER=root
	49	PASSWD=
	50	LOG_SQL=false
	51	SCHEMA=
	52	SSL_MODE=disable
	53
	54	[indexer]
	55	ISSUE_INDEXER_PATH=/data/work/indexers/issues.bleve
	56
	57	[session]
	58	PROVIDER_CONFIG=/data/work/sessions
	59	PROVIDER=file
	60
	61	[picture]
	62	AVATAR_UPLOAD_PATH=/data/work/avatars
	63	REPOSITORY_AVATAR_UPLOAD_PATH=/data/work/repo-avatars
	64
	65	[admin]
	66	DISABLE_REGULAR_ORG_CREATION=true
	67
	68	[attachment]
	69	PATH=/data/work/attachments
	70
	71	[log]
	72	MODE=console
	73	LEVEL=info
	74	ROOT_PATH=/data/work/log
	75
	76	[security]
	77	INSTALL_LOCK=true
	78	REVERSE_PROXY_LIMIT=1
	79	REVERSE_PROXY_TRUSTED_PROXIES=*
	80	PASSWORD_HASH_ALGO=pbkdf2_hi
	81	SECRET_KEY=$FORGEJO_SECURITY_SECRET_KEY
	82	INTERNAL_TOKEN=$FORGEJO_SECURITY_INTERNAL_TOKEN
	83
	84	[openid]
	85	ENABLE_OPENID_SIGNIN=false
	86	ENABLE_OPENID_SIGNUP=true
	87	WHITELISTED_URIS=auth.local.test
	88
	89	[service]
	90	ENABLE_INTERNAL_SIGNIN=false
	91	DISABLE_REGISTRATION=false
	92	ALLOW_ONLY_EXTERNAL_REGISTRATION=true
	93	SHOW_REGISTRATION_BUTTON=false
	94	REQUIRE_SIGNIN_VIEW=false
	95	REGISTER_EMAIL_CONFIRM=true
	96	ENABLE_NOTIFY_MAIL=true
	97	DEFAULT_KEEP_EMAIL_PRIVATE=false
	98	DEFAULT_ALLOW_CREATE_ORGANIZATION=true
	99	DEFAULT_ENABLE_TIMETRACKING=true
	100	NO_REPLY_ADDRESS=noreply.localhost
	101
	102	[lfs]
	103	PATH = /data/git/lfs
	104
	105	[mailer]
	106	ENABLED=false
	107	FROM=noreply.git@$HOME_DOMAIN
	108	PROTOCOL=smtps
	109	SMTP_PORT=587
	110	SMTP_ADDR=$MAILER_ADDRESS
	111	USER=$MAILER_USERNAME
	112	PASSWD=$MAILER_PASSWORD
	113
	114	[repository.pull-request]
	115	DEFAULT_MERGE_STYLE=squash
	116
	117	[repository.signing]
	118	DEFAULT_TRUST_MODEL=committer
	119
	120	[oauth2]
	121	JWT_SECRET=$FORGEJO_OAUTH2_JWT_SECRET

config/forgejo/init/config.sh created+20

...	...	@@ -0,0 +1,20 @@
	1	#!/bin/sh
	2	set -e
	3
	4	FORGEJO_OPENID_SECRET="$(cat /shared-keys/forgejo)"
	5
	6	openid_args="--provider=openidConnect \
	7	--name=snow \
	8	--key=forgejo \
	9	--secret=$FORGEJO_OPENID_SECRET \
	10	--auto-discover-url=https://auth.$HOME_DOMAIN/realms/master/.well-known/openid-configuration \
	11	--scopes=openid email profile groups"
	12
	13	forgejo migrate
	14
	15	if ! forgejo admin auth add-oauth $openid_args; then
	16	id=$(forgejo admin auth list \| awk '$2=="snow" {print $1}')
	17	if [ -n "$id" ]; then
	18	forgejo admin auth update-oauth --id="$id" $openid_args
	19	fi
	20	fi

config/forgejo/init/entry.sh created+14

...	...	@@ -0,0 +1,14 @@
	1	#!/bin/sh
	2	set -e
	3
	4	mkdir -p /custom/conf
	5	envsubst </custom/init/app.ini >/custom/conf/app.ini
	6	chmod 444 /custom/conf/app.ini
	7
	8	CADDY_IP="$(getent hosts caddy \| awk '{print $1}')"
	9	echo "${CADDY_IP} auth.${HOME_DOMAIN}" >>/etc/hosts
	10
	11	/usr/bin/entrypoint echo meow >/dev/null
	12	su git -c "bash /custom/init/config.sh"
	13
	14	exec /usr/bin/entrypoint /usr/bin/s6-svscan /etc/s6

config/forgejo/public/assets/css/theme-clover.css+130-52

...	...	@@ -2,32 +2,32 @@
2	2	@import "theme-forgejo-dark.css" (prefers-color-scheme: dark);
3	3
4	4	@font-face {
5		font-family: 'Name Mono';
6		src: url('../font/ATNameMono-Regular.woff2') format('woff2');
	5	font-family: "Name Mono";
	6	src: url("../font/nm.woff2") format("woff2");
7	7	font-weight: 400;
8	8	font-style: normal;
9	9	font-display: swap;
10	10	}
11	11
12	12	@font-face {
13		font-family: 'Name Mono';
14		src: url('../font/ATNameMono-Bold.woff2') format('woff2');
	13	font-family: "Name Mono";
	14	src: url("../font/nmb.woff2") format("woff2");
15	15	font-weight: 700;
16	16	font-style: normal;
17	17	font-display: swap;
18	18	}
19	19
20	20	@font-face {
21		font-family: 'Name Mono';
22		src: url('../font/ATNameMono-Italic.woff2') format('woff2');
	21	font-family: "Name Mono";
	22	src: url("../font/nmi.woff2") format("woff2");
23	23	font-weight: 400;
24	24	font-style: italic;
25	25	font-display: swap;
26	26	}
27	27
28	28	@font-face {
29		font-family: 'Name Sans';
30		src: url('../font/ATNameSansVariable-Regular.woff2') format('woff2') tech(variations);
	29	font-family: "Name Sans";
	30	src: url("../font/nsv.woff2") format("woff2") tech(variations);
31	31	font-weight: 100 900;
32	32	font-style: normal;
33	33	font-display: swap;
...	...	@@ -35,8 +35,8 @@
35	35	}
36	36
37	37	@font-face {
38		font-family: 'Name Sans';
39		src: url('../font/ATNameSansVariable-Italic.woff2') format('woff2') tech(variations);
	38	font-family: "Name Sans";
	39	src: url("../font/nsvi.woff2") format("woff2") tech(variations);
40	40	font-weight: 100 900;
41	41	font-style: italic;
42	42	font-display: swap;
...	...	@@ -44,9 +44,14 @@
44	44	}
45	45
46	46	:root {
47		--fonts-proportional: 'Name Sans', -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Noto Sans', Helvetica, Arial, sans-serif !important;
48		--fonts-monospace: 'Name Mono', 'SF Mono', Monaco, 'Cascadia Code', 'Roboto Mono', Consolas, 'Courier New', monospace !important;
49		--fonts-emoji: 'Apple Color Emoji', 'Segoe UI Emoji', 'Noto Color Emoji' !important;
	47	--fonts-proportional:
	48	"Name Sans", -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans",
	49	Helvetica, Arial, sans-serif !important;
	50	--fonts-monospace:
	51	"Name Mono", "SF Mono", Monaco, "Cascadia Code", "Roboto Mono", Consolas,
	52	"Courier New", monospace !important;
	53	--fonts-emoji:
	54	"Apple Color Emoji", "Segoe UI Emoji", "Noto Color Emoji" !important;
50	55	--steel-900: oklch(0.15 0.08 320);
51	56	--steel-850: oklch(0.18 0.07 320);
52	57	--steel-800: oklch(0.21 0.06 320);
...	...	@@ -65,24 +70,24 @@
65	70	--steel-150: oklch(0.90 0.04 320);
66	71	--steel-100: oklch(0.95 0.01 320);
67	72
68		--zinc-900: oklch(calc(0.15 * 1.05) calc(0.08/1.5) 320);
69		--zinc-850: oklch(calc(0.18 * 1.05) calc(0.07/1.5) 320);
70		--zinc-800: oklch(calc(0.21 * 1.05) calc(0.06/1.5) 320);
71		--zinc-750: oklch(calc(0.24 * 1.05) calc(0.06/1.5) 320);
72		--zinc-700: oklch(calc(0.27 * 1.05) calc(0.04/1.5) 320);
73		--zinc-650: oklch(calc(0.30 * 1.05) calc(0.05/1.5) 320);
74		--zinc-600: oklch(calc(0.35 * 1.05) calc(0.04/1.5) 320);
75		--zinc-550: oklch(calc(0.40 * 1.05) calc(0.03/1.5) 320);
76		--zinc-500: oklch(calc(0.45 * 1.05) calc(0.02/1.5) 320);
77		--zinc-450: oklch(calc(0.50 * 1.05) calc(0.03/1.5) 320);
78		--zinc-400: oklch(calc(0.55 * 1.05) calc(0.04/1.5) 320);
79		--zinc-350: oklch(calc(0.60 * 1.05) calc(0.04/1.5) 320);
80		--zinc-300: oklch(calc(0.65 * 1.05) calc(0.06/1.5) 320);
81		--zinc-250: oklch(calc(0.70 * 1.05) calc(0.06/1.5) 320);
82		--zinc-200: oklch(calc(0.75 * 1.05) calc(0.07/1.5) 320);
83		--zinc-150: oklch(calc(0.90 * 1.05) calc(0.04/1.5) 320);
84		--zinc-100: oklch(calc(0.95 * 1.05) calc(0.01/1.5) 320);
85		--zinc-50: oklch(calc(0.95 * 1.05) calc(0.01/1.5) 320);
	73	--zinc-900: oklch(calc(0.15 * 1.05) calc(0.08 / 1.5) 320);
	74	--zinc-850: oklch(calc(0.18 * 1.05) calc(0.07 / 1.5) 320);
	75	--zinc-800: oklch(calc(0.21 * 1.05) calc(0.06 / 1.5) 320);
	76	--zinc-750: oklch(calc(0.24 * 1.05) calc(0.06 / 1.5) 320);
	77	--zinc-700: oklch(calc(0.27 * 1.05) calc(0.04 / 1.5) 320);
	78	--zinc-650: oklch(calc(0.30 * 1.05) calc(0.05 / 1.5) 320);
	79	--zinc-600: oklch(calc(0.35 * 1.05) calc(0.04 / 1.5) 320);
	80	--zinc-550: oklch(calc(0.40 * 1.05) calc(0.03 / 1.5) 320);
	81	--zinc-500: oklch(calc(0.45 * 1.05) calc(0.02 / 1.5) 320);
	82	--zinc-450: oklch(calc(0.50 * 1.05) calc(0.03 / 1.5) 320);
	83	--zinc-400: oklch(calc(0.55 * 1.05) calc(0.04 / 1.5) 320);
	84	--zinc-350: oklch(calc(0.60 * 1.05) calc(0.04 / 1.5) 320);
	85	--zinc-300: oklch(calc(0.65 * 1.05) calc(0.06 / 1.5) 320);
	86	--zinc-250: oklch(calc(0.70 * 1.05) calc(0.06 / 1.5) 320);
	87	--zinc-200: oklch(calc(0.75 * 1.05) calc(0.07 / 1.5) 320);
	88	--zinc-150: oklch(calc(0.90 * 1.05) calc(0.04 / 1.5) 320);
	89	--zinc-100: oklch(calc(0.95 * 1.05) calc(0.01 / 1.5) 320);
	90	--zinc-50: oklch(calc(0.95 * 1.05) calc(0.01 / 1.5) 320);
86	91
87	92	--color-primary: #00896e;
88	93	--color-primary-contrast: #000;
...	...	@@ -100,27 +105,63 @@
100	105	--color-primary-light-5: color-mix(in srgb, var(--color-primary) 50%, black);
101	106	--color-primary-light-6: color-mix(in srgb, var(--color-primary) 40%, black);
102	107	--color-primary-light-7: color-mix(in srgb, var(--color-primary) 30%, black);
103		--color-primary-alpha-10: color-mix(in srgb, var(--color-primary) 10%, transparent);
104		--color-primary-alpha-20: color-mix(in srgb, var(--color-primary) 20%, transparent);
105		--color-primary-alpha-30: color-mix(in srgb, var(--color-primary) 30%, transparent);
106		--color-primary-alpha-40: color-mix(in srgb, var(--color-primary) 40%, transparent);
107		--color-primary-alpha-50: color-mix(in srgb, var(--color-primary) 50%, transparent);
108		--color-primary-alpha-60: color-mix(in srgb, var(--color-primary) 60%, transparent);
109		--color-primary-alpha-70: color-mix(in srgb, var(--color-primary) 70%, transparent);
110		--color-primary-alpha-80: color-mix(in srgb, var(--color-primary) 80%, transparent);
111		--color-primary-alpha-90: color-mix(in srgb, var(--color-primary) 90%, transparent);
	108	--color-primary-alpha-10: color-mix(
	109	in srgb,
	110	var(--color-primary) 10%,
	111	transparent
	112	);
	113	--color-primary-alpha-20: color-mix(
	114	in srgb,
	115	var(--color-primary) 20%,
	116	transparent
	117	);
	118	--color-primary-alpha-30: color-mix(
	119	in srgb,
	120	var(--color-primary) 30%,
	121	transparent
	122	);
	123	--color-primary-alpha-40: color-mix(
	124	in srgb,
	125	var(--color-primary) 40%,
	126	transparent
	127	);
	128	--color-primary-alpha-50: color-mix(
	129	in srgb,
	130	var(--color-primary) 50%,
	131	transparent
	132	);
	133	--color-primary-alpha-60: color-mix(
	134	in srgb,
	135	var(--color-primary) 60%,
	136	transparent
	137	);
	138	--color-primary-alpha-70: color-mix(
	139	in srgb,
	140	var(--color-primary) 70%,
	141	transparent
	142	);
	143	--color-primary-alpha-80: color-mix(
	144	in srgb,
	145	var(--color-primary) 80%,
	146	transparent
	147	);
	148	--color-primary-alpha-90: color-mix(
	149	in srgb,
	150	var(--color-primary) 90%,
	151	transparent
	152	);
112	153	}
113	154
114	155	@media (prefers-color-scheme: dark) {
115	156	:root {
116	157	--is-dark-theme: true;
117		--color-primary: #45F0CE;
	158	--color-primary: #45f0ce;
118	159	}
119	160	}
120	161
121	162	.warning {
122	163	--color-primary: #c35b06;
123		@media (prefers-color-scheme:dark) {
	164	@media (prefers-color-scheme: dark) {
124	165	--color-primary: #ff9843;
125	166	}
126	167	--color-primary-contrast: #000;
...	...	@@ -138,13 +179,50 @@
138	179	--color-primary-light-5: color-mix(in srgb, var(--color-primary) 50%, black);
139	180	--color-primary-light-6: color-mix(in srgb, var(--color-primary) 40%, black);
140	181	--color-primary-light-7: color-mix(in srgb, var(--color-primary) 30%, black);
141		--color-primary-alpha-10: color-mix(in srgb, var(--color-primary) 10%, transparent);
142		--color-primary-alpha-20: color-mix(in srgb, var(--color-primary) 20%, transparent);
143		--color-primary-alpha-30: color-mix(in srgb, var(--color-primary) 30%, transparent);
144		--color-primary-alpha-40: color-mix(in srgb, var(--color-primary) 40%, transparent);
145		--color-primary-alpha-50: color-mix(in srgb, var(--color-primary) 50%, transparent);
146		--color-primary-alpha-60: color-mix(in srgb, var(--color-primary) 60%, transparent);
147		--color-primary-alpha-70: color-mix(in srgb, var(--color-primary) 70%, transparent);
148		--color-primary-alpha-80: color-mix(in srgb, var(--color-primary) 80%, transparent);
149		--color-primary-alpha-90: color-mix(in srgb, var(--color-primary) 90%, transparent);
150		}
		\ No newline at end of file
	182	--color-primary-alpha-10: color-mix(
	183	in srgb,
	184	var(--color-primary) 10%,
	185	transparent
	186	);
	187	--color-primary-alpha-20: color-mix(
	188	in srgb,
	189	var(--color-primary) 20%,
	190	transparent
	191	);
	192	--color-primary-alpha-30: color-mix(
	193	in srgb,
	194	var(--color-primary) 30%,
	195	transparent
	196	);
	197	--color-primary-alpha-40: color-mix(
	198	in srgb,
	199	var(--color-primary) 40%,
	200	transparent
	201	);
	202	--color-primary-alpha-50: color-mix(
	203	in srgb,
	204	var(--color-primary) 50%,
	205	transparent
	206	);
	207	--color-primary-alpha-60: color-mix(
	208	in srgb,
	209	var(--color-primary) 60%,
	210	transparent
	211	);
	212	--color-primary-alpha-70: color-mix(
	213	in srgb,
	214	var(--color-primary) 70%,
	215	transparent
	216	);
	217	--color-primary-alpha-80: color-mix(
	218	in srgb,
	219	var(--color-primary) 80%,
	220	transparent
	221	);
	222	--color-primary-alpha-90: color-mix(
	223	in srgb,
	224	var(--color-primary) 90%,
	225	transparent
	226	);
	227	}
	228

config/forgejo/templates/.gitignore

config/keycloak/init.py+37-3

...	...	@@ -126,6 +126,42 @@ def configure():
126	126	else:
127	127	logger.info(f"Group {group_name} already exists, skipping")
128	128
	129	Path("/shared").mkdir(parents=True, exist_ok=True)
	130
	131	# forgejo
	132	client_id = kc_admin.create_client(
	133	{
	134	"protocol": "openid-connect",
	135	"clientId": "forgejo",
	136	"name": "Forgejo",
	137	"description": "",
	138	"publicClient": False,
	139	"authorizationServicesEnabled": False,
	140	"serviceAccountsEnabled": False,
	141	"implicitFlowEnabled": False,
	142	"directAccessGrantsEnabled": False,
	143	"standardFlowEnabled": True,
	144	"frontchannelLogout": True,
	145	"attributes": {
	146	"saml_idp_initiated_sso_url_name": "",
	147	"standard.token.exchange.enabled": False,
	148	"oauth2.device.authorization.grant.enabled": False,
	149	"oidc.ciba.grant.enabled": False,
	150	"pkce.code.challenge.method": "",
	151	"dpop.bound.access.tokens": "false",
	152	"post.logout.redirect.uris": "*",
	153	},
	154	"alwaysDisplayInConsole": False,
	155	"rootUrl": "",
	156	"baseUrl": "",
	157	"redirectUris": ["*"],
	158	},
	159	skip_exists=True,
	160	)
	161	client_data = kc_admin.get_client(client_id)
	162	_ = Path("/shared/forgejo").write_text(client_data["secret"])
	163
	164	# forward auth
129	165	client_id = kc_admin.create_client(
130	166	{
131	167	"protocol": "openid-connect",
...	...	@@ -156,9 +192,7 @@ def configure():
156	192	skip_exists=True,
157	193	)
158	194	client_data = kc_admin.get_client(client_id)
159		fw_secret_path = Path("/shared/forward-auth")
160		fw_secret_path.parent.mkdir(parents=True, exist_ok=True)
161		_ = fw_secret_path.write_text(client_data["secret"])
	195	_ = Path("/shared/forward-auth").write_text(client_data["secret"])
162	196
163	197
164	198	def main():