Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Git Forge

Forgejo runs on Baxcalibur at https://git.desertthunder.dev.

Public repositories may be readable over HTTPS. Writes, admin access, private repositories, SSH remotes, and private LFS paths stay on the tailnet.

Tracked implementation tasks stay in TODO.md.

Current shape

AreaValue
Moduleconf/services/forgejo.nix
Hostnix-baxcalibur
Local URL127.0.0.1:3030
Public URLhttps://git.desertthunder.dev/
DatabaseLocal PostgreSQL
State/var/lib/forgejo
Public ingressCloudflare Tunnel
Private control planeTailscale
RegistrationDisabled

Access paths

PathPolicy
Public HTTPS readsCloudflare Tunnel to local Forgejo.
WritesSSH over the tailnet.
Admin/private repositoriesTailnet first.
LFS writesTailnet path to avoid Cloudflare free-tier limits.
SSH portShared system port 22, separated by SSH user.

The Cloudflare tunnel should only route the intended hostname and return 404 for unmatched hostnames.

Client model

ClientExpected path
DesktopNormal Git over SSH to Baxcalibur’s tailnet name.
Android/TermuxGit and OpenSSH over Tailscale.
Obsidian vaultRepository-local sync helper once the vault repo exists.

Use per-device SSH keys. They are easier to revoke than copied private keys when a device or Termux install is retired.

SSH remotes

Forgejo advertises SSH clone URLs with:

FieldValue
Hostnix-baxcalibur
Port22
Userforgejo

Repository remotes should look like:

git remote set-url origin forgejo@nix-baxcalibur:USER/REPO.git

If using a client-side SSH alias, keep the alias device-local and point it at the same tailnet hostname.

Checks

CheckCommand
Servicesystemctl status forgejo
Recent logsjournalctl -u forgejo -e
Tailnet SSHssh -T nix-baxcalibur-forgejo
Remote shapegit remote -v

NixOS restarts forgejo.service when generated service configuration changes. If a rebuild succeeds but the UI still shows old customization, restart the service explicitly.

References