diff --git a/.env.example b/.env.example
index d393f37d03b2dbccaa3610e46e65d00d37abecbd..593265bafe329cba4601bec2312ca8e77fb3c448 100644
--- a/.env.example
+++ b/.env.example
@@ -8,6 +8,7 @@ APP_ROOT=./.apps
 STORE_ROOT=/Volumes
 CLOVER_ROOT=/Volumes/clover
 MEDIA_ROOT=/Volumes/media
+TORRENT_TEMP=
 
 MAILER_ADDRESS=smtp.example.com
 MAILER_USERNAME=me@paperclover.net
diff --git a/compose.yaml b/compose.yaml
index a9cbd5e94367bd0eb73e89b46e070ff352c93892..e2f86df7a15ca20d985ca4da647fa2157ec77793 100755
--- a/compose.yaml
+++ b/compose.yaml
@@ -98,7 +98,7 @@ services:
       keycloak:
         condition: service_healthy
     volumes:
-      - "${APP_ROOT}/keycloak/forward-auth:/shared/forward-auth:ro"
+      - "${APP_ROOT}/keycloak:/shared:ro"
   # file manager
   copyparty: # port 80
     image: copyparty/ac
@@ -146,37 +146,46 @@ services:
   # git hosting
   forgejo: # port 3000
     container_name: forgejo
+    image: code.forgejo.org/forgejo/forgejo:13
+    entrypoint: ["/bin/sh", "/custom/init/entry.sh"]
+    ports:
+      - 22:22
+      - 40244:3000 # port used for forgejo-runner
     environment:
       USER_UID: "$USER_ID"
       USER_GID: "$GROUP_ID"
+      HOME_DOMAIN: "${HOME_DOMAIN}"
       FORGEJO_CUSTOM: "/custom"
-      FORGEJO__MAILER__SMTP_ADDR: "${MAILER_ADDRESS}"
-      FORGEJO__MAILER__USER: "${MAILER_USERNAME}"
-      FORGEJO__MAILER__PASSWD: "${MAILER_PASSWORD}"
-      FORGEJO__SERVER__LFS_JWT_SECRET: "${FORGEJO_SERVER_LFS_JWT_SECRET}"
-      FORGEJO__OAUTH2__JWT_SECRET: "${FORGEJO_OAUTH2_JWT_SECRET}"
-      FORGEJO__SECURITY__SECRET_KEY: "${FORGEJO_SECURITY_SECRET_KEY}"
-      FORGEJO__SECURITY__INTERNAL_TOKEN: "${FORGEJO_SECURITY_INTERNAL_TOKEN}"
-    image: code.forgejo.org/forgejo/forgejo:13
-    ports:
-      - 22:22
-      - 40244:3000
+      MAILER_ADDRESS: "${MAILER_ADDRESS}"
+      MAILER_USERNAME: "${MAILER_USERNAME}"
+      MAILER_PASSWORD: "${MAILER_PASSWORD}"
+      FORGEJO_SERVER_LFS_JWT_SECRET: "${FORGEJO_SERVER_LFS_JWT_SECRET}"
+      FORGEJO_OAUTH2_JWT_SECRET: "${FORGEJO_OAUTH2_JWT_SECRET}"
+      FORGEJO_SECURITY_SECRET_KEY: "${FORGEJO_SECURITY_SECRET_KEY}"
+      FORGEJO_SECURITY_INTERNAL_TOKEN: "${FORGEJO_SECURITY_INTERNAL_TOKEN}"
     restart: unless-stopped
     volumes:
+      - "${APP_ROOT}/keycloak:/shared-keys:ro"
       - "${APP_ROOT}/forgejo:/data:rw"
       - "/etc/timezone:/etc/timezone:ro"
       - "/etc/localtime:/etc/localtime:ro"
-      - ./config/forgejo:/custom:ro
+      - ./config/forgejo/public:/custom/public:ro
+      - ./config/forgejo/templates:/custom/templates:ro
       - ./config/font:/custom/public/assets/font:ro
+      - ./config/forgejo/init:/custom/init:ro
     labels:
       net.paperclover.list.name: Clover Git Forge
       net.paperclover.list.domain: git
       net.paperclover.list.priority: 105
     depends_on:
+      postgres:
+        condition: service_healthy
+      redis:
+        condition: service_healthy
       keycloak:
         condition: service_healthy
-      # forgejo-anubis:
-      #   condition: service_healthy
+      forgejo-anubis:
+        condition: service_started
   forgejo-anubis:
     container_name: forgejo-anubis
     image: ghcr.io/techarohq/anubis:latest
@@ -385,6 +394,8 @@ services:
       timeout: 5s
       retries: 5
       start_period: 10s
+    ports:
+      - 5432:5432
   pgadmin: # port 80
     container_name: pgadmin
     entrypoint: ["/bin/sh", "/init/pgadmin-init.sh"]
diff --git a/config/Caddyfile b/config/Caddyfile
index a342c6934fb5289067b01ccf8a620a0c555852d3..1957fbe9077cc1d78f4e56c43a36fe2d778d9642 100644
--- a/config/Caddyfile
+++ b/config/Caddyfile
@@ -68,6 +68,9 @@ db.{$HOME_DOMAIN} {
 	reverse_proxy "http://clover-source-of-truth"
 }
 git.{$HOME_DOMAIN} {
+  handle /user/login {
+    rewrite /user/oauth2/snow
+  }
 	reverse_proxy "http://forgejo-anubis" {
 		header_up X-Real-Ip {remote_host}
 		header_up X-Http-Version {http.request.proto}
diff --git a/config/forgejo/conf/app.ini b/config/forgejo/conf/app.ini
deleted file mode 100755
index 777d39804c2b2da439ff24fbc60a8b974c2a5258..0000000000000000000000000000000000000000
--- a/config/forgejo/conf/app.ini
+++ /dev/null
@@ -1,105 +0,0 @@
-APP_NAME="clover's git"
-APP_SLOGAL=and then we knew, just like paper airplanes: that we could fly...
-RUN_MODE=prod
-RUN_USER=git
-WORK_PATH=/data/work
-
-[repository]
-MAX_CREATION_LIMIT=0
-ROOT=/data/git/repositories
-DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH=true
-DEFAULT_REPO_UNITS=repo.code,repo.issues,repo.pulls
-DISABLE_STARS=true
-DEFAULT_BRANCH=master
-
-[repository.local]
-LOCAL_COPY_PATH=/data/work/tmp/local-repo
-
-[repository.upload]
-TEMP_PATH=/data/work/uploads
-
-[ui]
-EXPLORE_PAGING_NUM=100
-ISSUE_PAGING_NUM=500
-MEMBERS_PAGING_NUM=100
-THEMES=clover
-DEFAULT_THEME=clover
-
-[server]
-APP_DATA_PATH=/data/work
-DOMAIN=git.paperclover.net
-SSH_DOMAIN=git.paperclover.net
-HTTP_PORT=3000
-ROOT_URL=https://git.paperclover.net/
-DISABLE_SSH=false
-SSH_PORT=22
-SSH_LISTEN_PORT=22
-LFS_START_SERVER=true
-OFFLINE_MODE=true
-LANDING_PAGE=/explore/repos
-
-[database]
-PATH=/data/work/gitea.db
-DB_TYPE=sqlite3
-HOST=localhost:3306
-NAME=gitea
-USER=root
-PASSWD=
-LOG_SQL=false
-SCHEMA=
-SSL_MODE=disable
-
-[indexer]
-ISSUE_INDEXER_PATH=/data/work/indexers/issues.bleve
-
-[session]
-PROVIDER_CONFIG=/data/work/sessions
-PROVIDER=file
-
-[picture]
-AVATAR_UPLOAD_PATH=/data/work/avatars
-REPOSITORY_AVATAR_UPLOAD_PATH=/data/work/repo-avatars
-
-[admin]
-DISABLE_REGULAR_ORG_CREATION=true
-
-[attachment]
-PATH=/data/work/attachments
-
-[log]
-MODE=console
-LEVEL=info
-ROOT_PATH=/data/work/log
-
-[security]
-INSTALL_LOCK=true
-REVERSE_PROXY_LIMIT=1
-REVERSE_PROXY_TRUSTED_PROXIES=*
-PASSWORD_HASH_ALGO=pbkdf2_hi
-
-[service]
-DISABLE_REGISTRATION=false
-REQUIRE_SIGNIN_VIEW=false
-REGISTER_EMAIL_CONFIRM=true
-ENABLE_NOTIFY_MAIL=true
-ALLOW_ONLY_EXTERNAL_REGISTRATION=false
-DEFAULT_KEEP_EMAIL_PRIVATE=false
-DEFAULT_ALLOW_CREATE_ORGANIZATION=true
-DEFAULT_ENABLE_TIMETRACKING=true
-NO_REPLY_ADDRESS=noreply.localhost
-
-[lfs]
-PATH = /data/git/lfs
-
-[mailer]
-ENABLED = true
-FROM=noreply.git@paperclover.net
-PROTOCOL=smtps
-SMTP_PORT=587
-IS_TLS_ENABLED=true
-
-[repository.pull-request]
-DEFAULT_MERGE_STYLE=squash
-
-[repository.signing]
-DEFAULT_TRUST_MODEL=committer
diff --git a/config/forgejo/init/app.ini b/config/forgejo/init/app.ini
new file mode 100755
index 0000000000000000000000000000000000000000..5ca5a0831647aeb7c75b761bdfc948706bf0af75
--- /dev/null
+++ b/config/forgejo/init/app.ini
@@ -0,0 +1,121 @@
+APP_NAME="clover's git"
+APP_SLOGAL=and then we knew, just like paper airplanes: that we could fly...
+RUN_MODE=prod
+RUN_USER=git
+WORK_PATH=/data/work
+
+[repository]
+MAX_CREATION_LIMIT=0
+ROOT=/data/git/repositories
+DEFAULT_CLOSE_ISSUES_VIA_COMMITS_IN_ANY_BRANCH=true
+DEFAULT_REPO_UNITS=repo.code,repo.issues,repo.pulls
+DISABLE_STARS=true
+DISABLE_FORKS=true
+DEFAULT_BRANCH=master
+
+[repository.local]
+LOCAL_COPY_PATH=/data/work/tmp/local-repo
+
+[repository.upload]
+TEMP_PATH=/data/work/uploads
+
+[ui]
+EXPLORE_PAGING_NUM=100
+ISSUE_PAGING_NUM=500
+MEMBERS_PAGING_NUM=100
+THEMES=clover
+DEFAULT_THEME=clover
+
+[server]
+APP_DATA_PATH=/data/work
+DOMAIN=git.$HOME_DOMAIN
+SSH_DOMAIN=git.$HOME_DOMAIN
+HTTP_PORT=3000
+ROOT_URL=https://git.$HOME_DOMAIN/
+DISABLE_SSH=false
+SSH_PORT=22
+SSH_LISTEN_PORT=22
+LFS_JWT_SECRET=$FORGEJO_SERVER_LFS_JWT_SECRET
+LFS_START_SERVER=true
+OFFLINE_MODE=true
+LANDING_PAGE=/explore/repos
+
+[database]
+PATH=/data/work/gitea.db
+DB_TYPE=sqlite3
+HOST=localhost:3306
+NAME=gitea
+USER=root
+PASSWD=
+LOG_SQL=false
+SCHEMA=
+SSL_MODE=disable
+
+[indexer]
+ISSUE_INDEXER_PATH=/data/work/indexers/issues.bleve
+
+[session]
+PROVIDER_CONFIG=/data/work/sessions
+PROVIDER=file
+
+[picture]
+AVATAR_UPLOAD_PATH=/data/work/avatars
+REPOSITORY_AVATAR_UPLOAD_PATH=/data/work/repo-avatars
+
+[admin]
+DISABLE_REGULAR_ORG_CREATION=true
+
+[attachment]
+PATH=/data/work/attachments
+
+[log]
+MODE=console
+LEVEL=info
+ROOT_PATH=/data/work/log
+
+[security]
+INSTALL_LOCK=true
+REVERSE_PROXY_LIMIT=1
+REVERSE_PROXY_TRUSTED_PROXIES=*
+PASSWORD_HASH_ALGO=pbkdf2_hi
+SECRET_KEY=$FORGEJO_SECURITY_SECRET_KEY
+INTERNAL_TOKEN=$FORGEJO_SECURITY_INTERNAL_TOKEN
+
+[openid]
+ENABLE_OPENID_SIGNIN=false
+ENABLE_OPENID_SIGNUP=true
+WHITELISTED_URIS=auth.local.test
+
+[service]
+ENABLE_INTERNAL_SIGNIN=false
+DISABLE_REGISTRATION=false
+ALLOW_ONLY_EXTERNAL_REGISTRATION=true
+SHOW_REGISTRATION_BUTTON=false
+REQUIRE_SIGNIN_VIEW=false
+REGISTER_EMAIL_CONFIRM=true
+ENABLE_NOTIFY_MAIL=true
+DEFAULT_KEEP_EMAIL_PRIVATE=false
+DEFAULT_ALLOW_CREATE_ORGANIZATION=true
+DEFAULT_ENABLE_TIMETRACKING=true
+NO_REPLY_ADDRESS=noreply.localhost
+
+[lfs]
+PATH = /data/git/lfs
+
+[mailer]
+ENABLED=false
+FROM=noreply.git@$HOME_DOMAIN
+PROTOCOL=smtps
+SMTP_PORT=587
+SMTP_ADDR=$MAILER_ADDRESS
+USER=$MAILER_USERNAME
+PASSWD=$MAILER_PASSWORD
+
+[repository.pull-request]
+DEFAULT_MERGE_STYLE=squash
+
+[repository.signing]
+DEFAULT_TRUST_MODEL=committer
+
+[oauth2]
+JWT_SECRET=$FORGEJO_OAUTH2_JWT_SECRET
diff --git a/config/forgejo/init/config.sh b/config/forgejo/init/config.sh
new file mode 100644
index 0000000000000000000000000000000000000000..f00645f743c6ab861bc3a8b77374ed0a918453a8
--- /dev/null
+++ b/config/forgejo/init/config.sh
@@ -0,0 +1,20 @@
+#!/bin/sh
+set -e
+
+FORGEJO_OPENID_SECRET="$(cat /shared-keys/forgejo)"
+
+openid_args="--provider=openidConnect \
+--name=snow \
+--key=forgejo \
+--secret=$FORGEJO_OPENID_SECRET \
+--auto-discover-url=https://auth.$HOME_DOMAIN/realms/master/.well-known/openid-configuration \
+--scopes=openid email profile groups"
+
+forgejo migrate
+
+if ! forgejo admin auth add-oauth $openid_args; then
+  id=$(forgejo admin auth list | awk '$2=="snow" {print $1}')
+  if [ -n "$id" ]; then
+    forgejo admin auth update-oauth --id="$id" $openid_args
+  fi
+fi
diff --git a/config/forgejo/init/entry.sh b/config/forgejo/init/entry.sh
new file mode 100644
index 0000000000000000000000000000000000000000..cde6fac7be682581928de11357e6d31a9d035931
--- /dev/null
+++ b/config/forgejo/init/entry.sh
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -e
+
+mkdir -p /custom/conf
+envsubst </custom/init/app.ini >/custom/conf/app.ini
+chmod 444 /custom/conf/app.ini
+
+CADDY_IP="$(getent hosts caddy | awk '{print $1}')"
+echo "${CADDY_IP} auth.${HOME_DOMAIN}" >>/etc/hosts
+
+/usr/bin/entrypoint echo meow >/dev/null
+su git -c "bash /custom/init/config.sh"
+
+exec /usr/bin/entrypoint /usr/bin/s6-svscan /etc/s6
diff --git a/config/forgejo/public/assets/css/theme-clover.css b/config/forgejo/public/assets/css/theme-clover.css
index f29c74736dc2ff9f85b66028cd5418dd4f054919..6c1b32e4ca2c0fc089a1174965d7a843e4782449 100755
--- a/config/forgejo/public/assets/css/theme-clover.css
+++ b/config/forgejo/public/assets/css/theme-clover.css
@@ -2,32 +2,32 @@
 @import "theme-forgejo-dark.css" (prefers-color-scheme: dark);
 
 @font-face {
-  font-family: 'Name Mono';
-  src: url('../font/ATNameMono-Regular.woff2') format('woff2');
+  font-family: "Name Mono";
+  src: url("../font/nm.woff2") format("woff2");
   font-weight: 400;
   font-style: normal;
   font-display: swap;
 }
 
 @font-face {
-  font-family: 'Name Mono';
-  src: url('../font/ATNameMono-Bold.woff2') format('woff2');
+  font-family: "Name Mono";
+  src: url("../font/nmb.woff2") format("woff2");
   font-weight: 700;
   font-style: normal;
   font-display: swap;
 }
 
 @font-face {
-  font-family: 'Name Mono';
-  src: url('../font/ATNameMono-Italic.woff2') format('woff2');
+  font-family: "Name Mono";
+  src: url("../font/nmi.woff2") format("woff2");
   font-weight: 400;
   font-style: italic;
   font-display: swap;
 }
 
 @font-face {
-  font-family: 'Name Sans';
-  src: url('../font/ATNameSansVariable-Regular.woff2') format('woff2') tech(variations);
+  font-family: "Name Sans";
+  src: url("../font/nsv.woff2") format("woff2") tech(variations);
   font-weight: 100 900;
   font-style: normal;
   font-display: swap;
@@ -35,8 +35,8 @@
 }
 
 @font-face {
-  font-family: 'Name Sans';
-  src: url('../font/ATNameSansVariable-Italic.woff2') format('woff2') tech(variations);
+  font-family: "Name Sans";
+  src: url("../font/nsvi.woff2") format("woff2") tech(variations);
   font-weight: 100 900;
   font-style: italic;
   font-display: swap;
@@ -44,9 +44,14 @@
 }
 
 :root {
-  --fonts-proportional: 'Name Sans', -apple-system, BlinkMacSystemFont, 'Segoe UI', 'Noto Sans', Helvetica, Arial, sans-serif !important;
-  --fonts-monospace: 'Name Mono', 'SF Mono', Monaco, 'Cascadia Code', 'Roboto Mono', Consolas, 'Courier New', monospace !important;
-  --fonts-emoji: 'Apple Color Emoji', 'Segoe UI Emoji', 'Noto Color Emoji' !important;
+  --fonts-proportional:
+    "Name Sans", -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans",
+    Helvetica, Arial, sans-serif !important;
+  --fonts-monospace:
+    "Name Mono", "SF Mono", Monaco, "Cascadia Code", "Roboto Mono", Consolas,
+    "Courier New", monospace !important;
+  --fonts-emoji:
+    "Apple Color Emoji", "Segoe UI Emoji", "Noto Color Emoji" !important;
   --steel-900: oklch(0.15 0.08 320);
   --steel-850: oklch(0.18 0.07 320);
   --steel-800: oklch(0.21 0.06 320);
@@ -65,24 +70,24 @@
   --steel-150: oklch(0.90 0.04 320);
   --steel-100: oklch(0.95 0.01 320);
 
-  --zinc-900: oklch(calc(0.15 * 1.05) calc(0.08/1.5) 320);
-  --zinc-850: oklch(calc(0.18 * 1.05) calc(0.07/1.5) 320);
-  --zinc-800: oklch(calc(0.21 * 1.05) calc(0.06/1.5) 320);
-  --zinc-750: oklch(calc(0.24 * 1.05) calc(0.06/1.5) 320);
-  --zinc-700: oklch(calc(0.27 * 1.05) calc(0.04/1.5) 320);
-  --zinc-650: oklch(calc(0.30 * 1.05) calc(0.05/1.5) 320);
-  --zinc-600: oklch(calc(0.35 * 1.05) calc(0.04/1.5) 320);
-  --zinc-550: oklch(calc(0.40 * 1.05) calc(0.03/1.5) 320);
-  --zinc-500: oklch(calc(0.45 * 1.05) calc(0.02/1.5) 320);
-  --zinc-450: oklch(calc(0.50 * 1.05) calc(0.03/1.5) 320);
-  --zinc-400: oklch(calc(0.55 * 1.05) calc(0.04/1.5) 320);
-  --zinc-350: oklch(calc(0.60 * 1.05) calc(0.04/1.5) 320);
-  --zinc-300: oklch(calc(0.65 * 1.05) calc(0.06/1.5) 320);
-  --zinc-250: oklch(calc(0.70 * 1.05) calc(0.06/1.5) 320);
-  --zinc-200: oklch(calc(0.75 * 1.05) calc(0.07/1.5) 320);
-  --zinc-150: oklch(calc(0.90 * 1.05) calc(0.04/1.5) 320);
-  --zinc-100: oklch(calc(0.95 * 1.05) calc(0.01/1.5) 320);
-  --zinc-50: oklch(calc(0.95 * 1.05) calc(0.01/1.5) 320);
+  --zinc-900: oklch(calc(0.15 * 1.05) calc(0.08 / 1.5) 320);
+  --zinc-850: oklch(calc(0.18 * 1.05) calc(0.07 / 1.5) 320);
+  --zinc-800: oklch(calc(0.21 * 1.05) calc(0.06 / 1.5) 320);
+  --zinc-750: oklch(calc(0.24 * 1.05) calc(0.06 / 1.5) 320);
+  --zinc-700: oklch(calc(0.27 * 1.05) calc(0.04 / 1.5) 320);
+  --zinc-650: oklch(calc(0.30 * 1.05) calc(0.05 / 1.5) 320);
+  --zinc-600: oklch(calc(0.35 * 1.05) calc(0.04 / 1.5) 320);
+  --zinc-550: oklch(calc(0.40 * 1.05) calc(0.03 / 1.5) 320);
+  --zinc-500: oklch(calc(0.45 * 1.05) calc(0.02 / 1.5) 320);
+  --zinc-450: oklch(calc(0.50 * 1.05) calc(0.03 / 1.5) 320);
+  --zinc-400: oklch(calc(0.55 * 1.05) calc(0.04 / 1.5) 320);
+  --zinc-350: oklch(calc(0.60 * 1.05) calc(0.04 / 1.5) 320);
+  --zinc-300: oklch(calc(0.65 * 1.05) calc(0.06 / 1.5) 320);
+  --zinc-250: oklch(calc(0.70 * 1.05) calc(0.06 / 1.5) 320);
+  --zinc-200: oklch(calc(0.75 * 1.05) calc(0.07 / 1.5) 320);
+  --zinc-150: oklch(calc(0.90 * 1.05) calc(0.04 / 1.5) 320);
+  --zinc-100: oklch(calc(0.95 * 1.05) calc(0.01 / 1.5) 320);
+  --zinc-50: oklch(calc(0.95 * 1.05) calc(0.01 / 1.5) 320);
 
   --color-primary: #00896e;
   --color-primary-contrast: #000;
@@ -100,27 +105,63 @@
   --color-primary-light-5: color-mix(in srgb, var(--color-primary) 50%, black);
   --color-primary-light-6: color-mix(in srgb, var(--color-primary) 40%, black);
   --color-primary-light-7: color-mix(in srgb, var(--color-primary) 30%, black);
-  --color-primary-alpha-10: color-mix(in srgb, var(--color-primary) 10%, transparent);
-  --color-primary-alpha-20: color-mix(in srgb, var(--color-primary) 20%, transparent);
-  --color-primary-alpha-30: color-mix(in srgb, var(--color-primary) 30%, transparent);
-  --color-primary-alpha-40: color-mix(in srgb, var(--color-primary) 40%, transparent);
-  --color-primary-alpha-50: color-mix(in srgb, var(--color-primary) 50%, transparent);
-  --color-primary-alpha-60: color-mix(in srgb, var(--color-primary) 60%, transparent);
-  --color-primary-alpha-70: color-mix(in srgb, var(--color-primary) 70%, transparent);
-  --color-primary-alpha-80: color-mix(in srgb, var(--color-primary) 80%, transparent);
-  --color-primary-alpha-90: color-mix(in srgb, var(--color-primary) 90%, transparent);
+  --color-primary-alpha-10: color-mix(
+    in srgb,
+    var(--color-primary) 10%,
+    transparent
+  );
+  --color-primary-alpha-20: color-mix(
+    in srgb,
+    var(--color-primary) 20%,
+    transparent
+  );
+  --color-primary-alpha-30: color-mix(
+    in srgb,
+    var(--color-primary) 30%,
+    transparent
+  );
+  --color-primary-alpha-40: color-mix(
+    in srgb,
+    var(--color-primary) 40%,
+    transparent
+  );
+  --color-primary-alpha-50: color-mix(
+    in srgb,
+    var(--color-primary) 50%,
+    transparent
+  );
+  --color-primary-alpha-60: color-mix(
+    in srgb,
+    var(--color-primary) 60%,
+    transparent
+  );
+  --color-primary-alpha-70: color-mix(
+    in srgb,
+    var(--color-primary) 70%,
+    transparent
+  );
+  --color-primary-alpha-80: color-mix(
+    in srgb,
+    var(--color-primary) 80%,
+    transparent
+  );
+  --color-primary-alpha-90: color-mix(
+    in srgb,
+    var(--color-primary) 90%,
+    transparent
+  );
 }
 
 @media (prefers-color-scheme: dark) {
   :root {
     --is-dark-theme: true;
-    --color-primary: #45F0CE;
+    --color-primary: #45f0ce;
   }
 }
 
 .warning {
   --color-primary: #c35b06;
-  @media (prefers-color-scheme:dark) {
+  @media (prefers-color-scheme: dark) {
     --color-primary: #ff9843;
   }
   --color-primary-contrast: #000;
@@ -138,13 +179,50 @@
   --color-primary-light-5: color-mix(in srgb, var(--color-primary) 50%, black);
   --color-primary-light-6: color-mix(in srgb, var(--color-primary) 40%, black);
   --color-primary-light-7: color-mix(in srgb, var(--color-primary) 30%, black);
-  --color-primary-alpha-10: color-mix(in srgb, var(--color-primary) 10%, transparent);
-  --color-primary-alpha-20: color-mix(in srgb, var(--color-primary) 20%, transparent);
-  --color-primary-alpha-30: color-mix(in srgb, var(--color-primary) 30%, transparent);
-  --color-primary-alpha-40: color-mix(in srgb, var(--color-primary) 40%, transparent);
-  --color-primary-alpha-50: color-mix(in srgb, var(--color-primary) 50%, transparent);
-  --color-primary-alpha-60: color-mix(in srgb, var(--color-primary) 60%, transparent);
-  --color-primary-alpha-70: color-mix(in srgb, var(--color-primary) 70%, transparent);
-  --color-primary-alpha-80: color-mix(in srgb, var(--color-primary) 80%, transparent);
-  --color-primary-alpha-90: color-mix(in srgb, var(--color-primary) 90%, transparent);
-}
\ No newline at end of file
+  --color-primary-alpha-10: color-mix(
+    in srgb,
+    var(--color-primary) 10%,
+    transparent
+  );
+  --color-primary-alpha-20: color-mix(
+    in srgb,
+    var(--color-primary) 20%,
+    transparent
+  );
+  --color-primary-alpha-30: color-mix(
+    in srgb,
+    var(--color-primary) 30%,
+    transparent
+  );
+  --color-primary-alpha-40: color-mix(
+    in srgb,
+    var(--color-primary) 40%,
+    transparent
+  );
+  --color-primary-alpha-50: color-mix(
+    in srgb,
+    var(--color-primary) 50%,
+    transparent
+  );
+  --color-primary-alpha-60: color-mix(
+    in srgb,
+    var(--color-primary) 60%,
+    transparent
+  );
+  --color-primary-alpha-70: color-mix(
+    in srgb,
+    var(--color-primary) 70%,
+    transparent
+  );
+  --color-primary-alpha-80: color-mix(
+    in srgb,
+    var(--color-primary) 80%,
+    transparent
+  );
+  --color-primary-alpha-90: color-mix(
+    in srgb,
+    var(--color-primary) 90%,
+    transparent
+  );
+}
+
diff --git a/config/forgejo/templates/.gitignore b/config/forgejo/templates/.gitignore
new file mode 100644
index 0000000000000000000000000000000000000000..e69de29bb2d1d6434b8b29ae775ad8c2e48c5391
diff --git a/config/keycloak/init.py b/config/keycloak/init.py
index aceb961c72bfbed5dd77790adf303dbe7599931c..42b8a8307f6185a9d98bc2b7ead4f71c9ad62253 100755
--- a/config/keycloak/init.py
+++ b/config/keycloak/init.py
@@ -126,6 +126,42 @@ def configure():
         else:
             logger.info(f"Group {group_name} already exists, skipping")
 
+    Path("/shared").mkdir(parents=True, exist_ok=True)
+
+    # forgejo
+    client_id = kc_admin.create_client(
+        {
+            "protocol": "openid-connect",
+            "clientId": "forgejo",
+            "name": "Forgejo",
+            "description": "",
+            "publicClient": False,
+            "authorizationServicesEnabled": False,
+            "serviceAccountsEnabled": False,
+            "implicitFlowEnabled": False,
+            "directAccessGrantsEnabled": False,
+            "standardFlowEnabled": True,
+            "frontchannelLogout": True,
+            "attributes": {
+                "saml_idp_initiated_sso_url_name": "",
+                "standard.token.exchange.enabled": False,
+                "oauth2.device.authorization.grant.enabled": False,
+                "oidc.ciba.grant.enabled": False,
+                "pkce.code.challenge.method": "",
+                "dpop.bound.access.tokens": "false",
+                "post.logout.redirect.uris": "*",
+            },
+            "alwaysDisplayInConsole": False,
+            "rootUrl": "",
+            "baseUrl": "",
+            "redirectUris": ["*"],
+        },
+        skip_exists=True,
+    )
+    client_data = kc_admin.get_client(client_id)
+    _ = Path("/shared/forgejo").write_text(client_data["secret"])
+
+    # forward auth
     client_id = kc_admin.create_client(
         {
             "protocol": "openid-connect",
@@ -156,9 +192,7 @@ def configure():
         skip_exists=True,
     )
     client_data = kc_admin.get_client(client_id)
-    fw_secret_path = Path("/shared/forward-auth")
-    fw_secret_path.parent.mkdir(parents=True, exist_ok=True)
-    _ = fw_secret_path.write_text(client_data["secret"])
+    _ = Path("/shared/forward-auth").write_text(client_data["secret"])
 
 
 def main():