project initialisation

.dockerignore

@@ -0,0 +1,45 @@
+# This file excludes paths from the Docker build context.
+#
+# By default, Docker's build context includes all files (and folders) in the
+# current directory. Even if a file isn't copied into the container it is still sent to
+# the Docker daemon.
+#
+# There are multiple reasons to exclude files from the build context:
+#
+# 1. Prevent nested folders from being copied into the container (ex: exclude
+#    /assets/node_modules when copying /assets)
+# 2. Reduce the size of the build context and improve build time (ex. /build, /deps, /doc)
+# 3. Avoid sending files containing sensitive information
+#
+# More information on using .dockerignore is available here:
+# https://docs.docker.com/engine/reference/builder/#dockerignore-file
+
+.dockerignore
+
+# Ignore git, but keep git HEAD and refs to access current commit hash if needed:
+#
+# $ cat .git/HEAD | awk '{print ".git/"$2}' | xargs cat
+# d0b8727759e1e0e7aa3d41707d12376e373d5ecc
+.git
+!.git/HEAD
+!.git/refs
+
+# Common development/test artifacts
+/cover/
+/doc/
+/test/
+/tmp/
+.elixir_ls
+
+# Mix artifacts
+/_build/
+/deps/
+*.ez
+
+# Generated on crash by the VM
+erl_crash.dump
+
+# Static artifacts - These should be fetched and built inside the Docker image
+/assets/node_modules/
+/priv/static/assets/
+/priv/static/cache_manifest.json

.gitignore

@@ -0,0 +1,40 @@
+# The directory Mix will write compiled artifacts to.
+/_build/
+
+# If you run "mix test --cover", coverage assets end up here.
+/cover/
+
+# The directory Mix downloads your dependencies sources to.
+/deps/
+
+# Where 3rd-party dependencies like ExDoc output generated docs.
+/doc/
+
+# Ignore .fetch files in case you like to edit your project deps locally.
+/.fetch
+
+# If the VM crashes, it generates a dump, let's ignore it too.
+erl_crash.dump
+
+# Also ignore archive artifacts (built via "mix archive.build").
+*.ez
+
+# Temporary files, for example, from tests.
+/tmp/
+
+# Ignore package tarball (built via "mix hex.build").
+phx_db-*.tar
+
+# Ignore assets that are produced by build tools.
+/priv/static/assets/
+
+# Ignore digested assets cache.
+/priv/static/cache_manifest.json
+
+# In case you use Node.js/npm, you want to ignore these.
+npm-debug.log
+/assets/node_modules/
+
+# Ignore .env file containing credentials.
+.env
+

.kamal/hooks/docker-setup.sample

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo "Docker set up on $KAMAL_HOSTS..."

.kamal/hooks/post-app-boot.sample

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo "Booted app version $KAMAL_VERSION on $KAMAL_HOSTS..."

.kamal/hooks/post-deploy.sample

@@ -0,0 +1,14 @@
+#!/bin/sh
+
+# A sample post-deploy hook
+#
+# These environment variables are available:
+# KAMAL_RECORDED_AT
+# KAMAL_PERFORMER
+# KAMAL_VERSION
+# KAMAL_HOSTS
+# KAMAL_ROLE (if set)
+# KAMAL_DESTINATION (if set)
+# KAMAL_RUNTIME
+
+echo "$KAMAL_PERFORMER deployed $KAMAL_VERSION to $KAMAL_DESTINATION in $KAMAL_RUNTIME seconds"

.kamal/hooks/post-proxy-reboot.sample

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo "Rebooted kamal-proxy on $KAMAL_HOSTS"

.kamal/hooks/pre-app-boot.sample

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo "Booting app version $KAMAL_VERSION on $KAMAL_HOSTS..."

.kamal/hooks/pre-build.sample

@@ -0,0 +1,51 @@
+#!/bin/sh
+
+# A sample pre-build hook
+#
+# Checks:
+# 1. We have a clean checkout
+# 2. A remote is configured
+# 3. The branch has been pushed to the remote
+# 4. The version we are deploying matches the remote
+#
+# These environment variables are available:
+# KAMAL_RECORDED_AT
+# KAMAL_PERFORMER
+# KAMAL_VERSION
+# KAMAL_HOSTS
+# KAMAL_ROLE (if set)
+# KAMAL_DESTINATION (if set)
+
+if [ -n "$(git status --porcelain)" ]; then
+  echo "Git checkout is not clean, aborting..." >&2
+  git status --porcelain >&2
+  exit 1
+fi
+
+first_remote=$(git remote)
+
+if [ -z "$first_remote" ]; then
+  echo "No git remote set, aborting..." >&2
+  exit 1
+fi
+
+current_branch=$(git branch --show-current)
+
+if [ -z "$current_branch" ]; then
+  echo "Not on a git branch, aborting..." >&2
+  exit 1
+fi
+
+remote_head=$(git ls-remote $first_remote --tags $current_branch | cut -f1)
+
+if [ -z "$remote_head" ]; then
+  echo "Branch not pushed to remote, aborting..." >&2
+  exit 1
+fi
+
+if [ "$KAMAL_VERSION" != "$remote_head" ]; then
+  echo "Version ($KAMAL_VERSION) does not match remote HEAD ($remote_head), aborting..." >&2
+  exit 1
+fi
+
+exit 0

.kamal/hooks/pre-connect.sample

@@ -0,0 +1,47 @@
+#!/usr/bin/env ruby
+
+# A sample pre-connect check
+#
+# Warms DNS before connecting to hosts in parallel
+#
+# These environment variables are available:
+# KAMAL_RECORDED_AT
+# KAMAL_PERFORMER
+# KAMAL_VERSION
+# KAMAL_HOSTS
+# KAMAL_ROLE (if set)
+# KAMAL_DESTINATION (if set)
+# KAMAL_RUNTIME
+
+hosts = ENV["KAMAL_HOSTS"].split(",")
+results = nil
+max = 3
+
+elapsed = Benchmark.realtime do
+  results = hosts.map do |host|
+    Thread.new do
+      tries = 1
+
+      begin
+        Socket.getaddrinfo(host, 0, Socket::AF_UNSPEC, Socket::SOCK_STREAM, nil, Socket::AI_CANONNAME)
+      rescue SocketError
+        if tries < max
+          puts "Retrying DNS warmup: #{host}"
+          tries += 1
+          sleep rand
+          retry
+        else
+          puts "DNS warmup failed: #{host}"
+          host
+        end
+      end
+
+      tries
+    end
+  end.map(&:value)
+end
+
+retries = results.sum - hosts.size
+nopes = results.count { |r| r == max }
+
+puts "Prewarmed %d DNS lookups in %.2f sec: %d retries, %d failures" % [ hosts.size, elapsed, retries, nopes ]

.kamal/hooks/pre-deploy.sample

@@ -0,0 +1,109 @@
+#!/usr/bin/env ruby
+
+# A sample pre-deploy hook
+#
+# Checks the Github status of the build, waiting for a pending build to complete for up to 720 seconds.
+#
+# Fails unless the combined status is "success"
+#
+# These environment variables are available:
+# KAMAL_RECORDED_AT
+# KAMAL_PERFORMER
+# KAMAL_VERSION
+# KAMAL_HOSTS
+# KAMAL_COMMAND
+# KAMAL_SUBCOMMAND
+# KAMAL_ROLE (if set)
+# KAMAL_DESTINATION (if set)
+
+# Only check the build status for production deployments
+if ENV["KAMAL_COMMAND"] == "rollback" || ENV["KAMAL_DESTINATION"] != "production"
+  exit 0
+end
+
+require "bundler/inline"
+
+# true = install gems so this is fast on repeat invocations
+gemfile(true, quiet: true) do
+  source "https://rubygems.org"
+
+  gem "octokit"
+  gem "faraday-retry"
+end
+
+MAX_ATTEMPTS = 72
+ATTEMPTS_GAP = 10
+
+def exit_with_error(message)
+  $stderr.puts message
+  exit 1
+end
+
+class GithubStatusChecks
+  attr_reader :remote_url, :git_sha, :github_client, :combined_status
+
+  def initialize
+    @remote_url = `git config --get remote.origin.url`.strip.delete_prefix("https://github.com/")
+    @git_sha = `git rev-parse HEAD`.strip
+    @github_client = Octokit::Client.new(access_token: ENV["GITHUB_TOKEN"])
+    refresh!
+  end
+
+  def refresh!
+    @combined_status = github_client.combined_status(remote_url, git_sha)
+  end
+
+  def state
+    combined_status[:state]
+  end
+
+  def first_status_url
+    first_status = combined_status[:statuses].find { |status| status[:state] == state }
+    first_status && first_status[:target_url]
+  end
+
+  def complete_count
+    combined_status[:statuses].count { |status| status[:state] != "pending"}
+  end
+
+  def total_count
+    combined_status[:statuses].count
+  end
+
+  def current_status
+    if total_count > 0
+      "Completed #{complete_count}/#{total_count} checks, see #{first_status_url} ..."
+    else
+      "Build not started..."
+    end
+  end
+end
+
+
+$stdout.sync = true
+
+puts "Checking build status..."
+attempts = 0
+checks = GithubStatusChecks.new
+
+begin
+  loop do
+    case checks.state
+    when "success"
+      puts "Checks passed, see #{checks.first_status_url}"
+      exit 0
+    when "failure"
+      exit_with_error "Checks failed, see #{checks.first_status_url}"
+    when "pending"
+      attempts += 1
+    end
+
+    exit_with_error "Checks are still pending, gave up after #{MAX_ATTEMPTS * ATTEMPTS_GAP} seconds" if attempts == MAX_ATTEMPTS
+
+    puts checks.current_status
+    sleep(ATTEMPTS_GAP)
+    checks.refresh!
+  end
+rescue Octokit::NotFound
+  exit_with_error "Build status could not be found"
+end

.kamal/hooks/pre-proxy-reboot.sample

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+echo "Rebooting kamal-proxy on $KAMAL_HOSTS..."

.kamal/secrets

@@ -0,0 +1,27 @@
+# Secrets defined here are available for reference under registry/password, env/secret, builder/secrets,
+# and accessories/*/env/secret in config/deploy.yml. All secrets should be pulled from either
+# password manager, ENV, or a file. DO NOT ENTER RAW CREDENTIALS HERE! This file needs to be safe for git.
+
+# Option 1: Read secrets from the environment
+
+# Option 2: Read secrets via a command
+# RAILS_MASTER_KEY=$(cat config/master.key)
+
+# Option 3: Read secrets via kamal secrets helpers
+# These will handle logging in and fetching the secrets in as few calls as possible
+# There are adapters for 1Password, LastPass + Bitwarden
+#
+# SECRETS=$(kamal secrets fetch --adapter 1password --account my-account --from MyVault/MyItem KAMAL_REGISTRY_PASSWORD RAILS_MASTER_KEY)
+# KAMAL_REGISTRY_PASSWORD=$(kamal secrets extract KAMAL_REGISTRY_PASSWORD $SECRETS)
+# RAILS_MASTER_KEY=$(kamal secrets extract RAILS_MASTER_KEY $SECRETS)
+PASSWORD_MANAGER_ADAPTER=$(cat .env | grep PASSWORD_MANAGER_ADAPTER | cut -d '=' -f 2)
+PASSWORD_MANAGER_ACCOUNT=$(cat .env | grep PASSWORD_MANAGER_ACCOUNT | cut -d '=' -f 2)
+
+SECRETS=$(kamal secrets fetch --adapter ${PASSWORD_MANAGER_ADAPTER} --account ${PASSWORD_MANAGER_ACCOUNT} GHCR_TOKEN FORGEJO_APP_DB_PASSWORD FORGEJO_APP_DB_NAME FORGEJO_APP_DB_USER)
+KAMAL_REGISTRY_PASSWORD=$(kamal secrets extract GHCR_TOKEN ${SECRETS})
+FORGEJO__database__NAME=$(kamal secrets extract FORGEJO_APP_DB_NAME ${SECRETS})
+FORGEJO__database__USER=$(kamal secrets extract FORGEJO_APP_DB_USER ${SECRETS})
+FORGEJO__database__PASSWD=$(kamal secrets extract FORGEJO_APP_DB_PASSWORD ${SECRETS})
+POSTGRES_DB=$(kamal secrets extract FORGEJO_APP_DB_NAME ${SECRETS})
+POSTGRES_USER=$(kamal secrets extract FORGEJO_APP_DB_USER ${SECRETS})
+POSTGRES_PASSWORD=$(kamal secrets extract FORGEJO_APP_DB_PASSWORD ${SECRETS})

Dockerfile

@@ -0,0 +1 @@
+FROM codeberg.org/forgejo/forgejo:10.0.3

config/deploy.yml

@@ -0,0 +1,52 @@
+service: forgejo
+image: arndttouby/forgejo
+
+servers:
+  web:
+    - 142.132.178.134
+
+proxy:
+  ssl: true
+  host: git.touby.eu
+  app_port: 3000
+  healthcheck:
+    path: /
+
+registry:
+  server: ghcr.io
+  username: arndttouby
+  password:
+    - KAMAL_REGISTRY_PASSWORD
+
+builder:
+  arch: arm64
+  context: .
+
+env:
+  clear:
+    USER_UID: 1000
+    USER_GID: 1000
+    FORGEJO__database__DB_TYPE: postgres
+    FORGEJO__database__HOST: forgejo-db
+  secret:
+    - FORGEJO__database__NAME
+    - FORGEJO__database__USER
+    - FORGEJO__database__PASSWD
+
+volumes:
+  - forgejo:/data
+  - /etc/timezone:/etc/timezone:ro
+  - /etc/localtime:/etc/localtime:ro
+
+accessories:
+  db:
+    image: postgres:17
+    host: 142.132.178.134
+    port: 5432:5432
+    env:
+      secret:
+        - POSTGRES_DB
+        - POSTGRES_USER
+        - POSTGRES_PASSWORD
+    directories:
+      - postgresql/data:/var/lib/postgresql/data

docker-compose.yml

@@ -0,0 +1,43 @@
+networks:
+  forgejo:
+    external: false
+
+services:
+  server:
+    build:
+      context: .
+    container_name: forgejo
+    env_file:
+      - .env
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - FORGEJO__database__DB_TYPE=postgres
+      - FORGEJO__database__HOST=db
+      - FORGEJO__database__NAME=$DB_NAME
+      - FORGEJO__database__USER=$DB_USER
+      - FORGEJO__database__PASSWD=$DB_PASSWORD
+    restart: always
+    networks:
+      - forgejo
+    volumes:
+      - ./forgejo:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - ${APP_PORTS}
+      - "222:22"
+    depends_on:
+      - db
+
+  db:
+    image: postgres:17
+    restart: always
+    environment:
+      - POSTGRES_USER=$DB_USER
+      - POSTGRES_PASSWORD=$DB_PASSWORD
+      - POSTGRES_DB=$DB_NAME
+    networks:
+      - forgejo
+    volumes:
+      - ./postgres:/var/lib/postgresql/data

forgejo/git/.ssh/environment

@@ -0,0 +1 @@
+GITEA_CUSTOM=/data/gitea

forgejo/gitea/conf/app.ini

@@ -0,0 +1,62 @@
+APP_NAME = Forgejo: Beyond coding. We forge.
+RUN_MODE = prod
+
+[repository]
+ROOT = /data/git/repositories
+
+[repository.local]
+LOCAL_COPY_PATH = /data/gitea/tmp/local-repo
+
+[repository.upload]
+TEMP_PATH = /data/gitea/uploads
+
+[server]
+APP_DATA_PATH = /data/gitea
+DOMAIN = localhost
+SSH_DOMAIN = localhost
+HTTP_PORT = 3000
+ROOT_URL = 
+DISABLE_SSH = false
+SSH_PORT = 22
+SSH_LISTEN_PORT = 22
+LFS_START_SERVER = false
+
+[database]
+PATH = /data/gitea/gitea.db
+DB_TYPE = postgres
+HOST = db
+NAME = forgejo
+USER = forgejo
+PASSWD = asldkfjqer?1234§asdlfkHH123
+LOG_SQL = false
+
+[indexer]
+ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
+
+[session]
+PROVIDER_CONFIG = /data/gitea/sessions
+
+[picture]
+AVATAR_UPLOAD_PATH = /data/gitea/avatars
+REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars
+
+[attachment]
+PATH = /data/gitea/attachments
+
+[log]
+MODE = console
+LEVEL = info
+ROOT_PATH = /data/gitea/log
+
+[security]
+INSTALL_LOCK = false
+SECRET_KEY = 
+REVERSE_PROXY_LIMIT = 1
+REVERSE_PROXY_TRUSTED_PROXIES = *
+
+[service]
+DISABLE_REGISTRATION = false
+REQUIRE_SIGNIN_VIEW = false
+
+[lfs]
+PATH = /data/git/lfs

forgejo/ssh/ssh_host_ecdsa_key

@@ -0,0 +1,9 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS
+1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQR9PMuWDx9knoN0mDO9KzU55gk5fwdB
+Uau7v/06C/XRix4FSAZdkBeXwHTk+AscmTHB79IebZoUYtAkrtUp/wNvAAAAsL/0NEu/9D
+RLAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBH08y5YPH2Seg3SY
+M70rNTnmCTl/B0FRq7u//ToL9dGLHgVIBl2QF5fAdOT4CxyZMcHv0h5tmhRi0CSu1Sn/A2
+8AAAAgVZhJE1cPAPx+lyVaJm4uyx9EhlAjSaxpGFQuE2E4FvAAAAARcm9vdEBlNjc3ZDMz
+ODVjZDABAgMEBQYH
+-----END OPENSSH PRIVATE KEY-----

forgejo/ssh/ssh_host_ecdsa_key.pub

@@ -0,0 +1 @@
+ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBH08y5YPH2Seg3SYM70rNTnmCTl/B0FRq7u//ToL9dGLHgVIBl2QF5fAdOT4CxyZMcHv0h5tmhRi0CSu1Sn/A28= root@e677d3385cd0

forgejo/ssh/ssh_host_ed25519_key

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACAJnhYgyHfN1RKzJx66sgmDW67LnKNOoUbbGkiDupJMmwAAAJjSSyFo0ksh
+aAAAAAtzc2gtZWQyNTUxOQAAACAJnhYgyHfN1RKzJx66sgmDW67LnKNOoUbbGkiDupJMmw
+AAAEB3yPjw3dn9yU7xYLJzRCoI9EqjG5rYV0qtFZvb5i38XwmeFiDId83VErMnHrqyCYNb
+rsuco06hRtsaSIO6kkybAAAAEXJvb3RAZTY3N2QzMzg1Y2QwAQIDBA==
+-----END OPENSSH PRIVATE KEY-----

forgejo/ssh/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAmeFiDId83VErMnHrqyCYNbrsuco06hRtsaSIO6kkyb root@e677d3385cd0

forgejo/ssh/ssh_host_rsa_key

@@ -0,0 +1,38 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEA8R07M7Dc0e4CBJVLQAXKQfL1ZXPp9/Xx97EEquk6rBLfQVrBssYH
+O6GTFWVArLzXill9opbOrvnk1VjW89OUhIQLEXcxqOAQkbdUxGuafS2obn9ZgdhS08yPN8
+NawfK/6+p9m05UU3eOgFFq5OmJs+TIoG1quLvR0+vrXhAB8QWivjKqWwkujj0/uR7Xs7XH
+/hFvk+DXM61cpU8nUTErCPxk6RqLRivGE7IO6isyu3dt1I/YakLrmuKm77ApLz0W+zebM2
+6A9PDoChsY6hVtgOUJ0HXyMb63ib3vwTpiFhvUFwLbyDy2bXbpG3mdyigu3UILSPHH4x7X
+5pk8LOhPNvgNX620rpDw+lklhuAzN2QajyQml7vKHfS/x7NeuMw95V7+gm+ozdADIFiORO
+aVBxU02y1jE/YIaTcBsCuHxbvV+ETofxMg73brfUeYwDnttKJ+rNgv+GPZKoP6B/NrfyU6
+0ge0OeRcNF+vj+qZI94QC4O5Ae1z9aNdbk5vmHudAAAFiO/6hrfv+oa3AAAAB3NzaC1yc2
+EAAAGBAPEdOzOw3NHuAgSVS0AFykHy9WVz6ff18fexBKrpOqwS30FawbLGBzuhkxVlQKy8
+14pZfaKWzq755NVY1vPTlISECxF3MajgEJG3VMRrmn0tqG5/WYHYUtPMjzfDWsHyv+vqfZ
+tOVFN3joBRauTpibPkyKBtari70dPr614QAfEFor4yqlsJLo49P7ke17O1x/4Rb5Pg1zOt
+XKVPJ1ExKwj8ZOkai0YrxhOyDuorMrt3bdSP2GpC65ripu+wKS89Fvs3mzNugPTw6AobGO
+oVbYDlCdB18jG+t4m978E6YhYb1BcC28g8tm126Rt5ncooLt1CC0jxx+Me1+aZPCzoTzb4
+DV+ttK6Q8PpZJYbgMzdkGo8kJpe7yh30v8ezXrjMPeVe/oJvqM3QAyBYjkTmlQcVNNstYx
+P2CGk3AbArh8W71fhE6H8TIO92631HmMA57bSifqzYL/hj2SqD+gfza38lOtIHtDnkXDRf
+r4/qmSPeEAuDuQHtc/WjXW5Ob5h7nQAAAAMBAAEAAAF/UInRju+UKH8kM4Iw/xAtAk464O
+6jR7Ncfjh1O0AsnxbfdgRdzZ+PAcztmpBZRASHEyA5BMoX/MIs57VIMBeX9THQvZocC58V
+uQR0vOqV/EBZYQlfuwi06yjmD3RA69czSnjPXZQxFrBVx7GbPQYmxUKRIuzvnZqlTmqa7g
+RYiUs9Mr7MCijNGBF762lSwj28UAAC+QPnoXbQL09WmNeHbQ5PXZn3FkunWzwVuTTHCaC5
+c6WY2EdLWXQ9haf/6QF1GxLy42573T7UOnsMYooafW8EQLKyNfST4sU9CBe6vDoyRuvlht
+Un59qOnKjrmxS9/aXVbBJAoPF99oyUFph3GZcL8XmZApljSPZHcZAvSRyvFE0HueYrBd2t
+eV1gOFkoSZxArKnaSo5XfW3Lzg5EIz5QIvH5aOtAG4EC38TKHcjjWKzK3k+AIc2f6f7zAF
+TpV4GCvl5d2wba4kUoM5I/gMBYKpDQgc3tXTLMcDL4o2FLqKP++RnpJCseIbkWqhkAAADB
+AOxEQ8E/X0FJ+/VaHsmhnP5PP+PDpWoi0fH8MAVEU0btFmEMcy2t7vt6f84l/PqMzqQ/Un
+J8fyJSLBz8KuEBIQgbTVUgPouDWxZ7rJsFEFl+lHdEPf+PKahwpE4AwRywXm1Qz84TwbxD
+qLtjDm9Nf+n/GncuelnJqbPfawaxPp4bAPdQlMSoxd5lbOM/vlC05kn54TXIrd+QUVvcjq
+arrZsPkvfXOGyneHE528YnZF38hcSRkFF4rvplzad5d93gbgAAAMEA+VV0BeD7wwNP8crZ
+WxKVWIbKh8o8jQkeHajBhLgeKK7rXdtUjkjFPtLCGjs5rbrlNoTe9UaknWOO2a9+hjTqBF
+/IuseqK2Y+KSmVMY6NXbMTrGB9EjCCwPVCfPzafXBfk1/oYTFJxL05sWOemVDZg2aIDYCp
+JFwmGQr6Ez5QcU1R73kjw+zyN3ubGd0patN6dP96259w3EkaNwAmcfY+/fIa7MiMZ36acf
+lrINb6Op/qMR+viokmhdVzDpREMAnpAAAAwQD3j4T8umqvOmOtCZnziYaiAJD7eVx19bT7
+2DihO7ynvJcYYyHzcs63yiYcEpCByDtuC4ADaEEAydth03vyqZzHy50b8RLcY7TpA9H6n+
+uoZ4Wwc24i2wlMbkNberLzcbC4+kwgbPE49hc9ZDPKZLqdWZKKQV5iQMSwWbiSpOBtjJ46
+pTflSaT3ApB+yFPBwmBpDEXSy24kcUpI7M430o6vCL4iCDiasXBIGZUtHUztiXmGnWGelv
+AniiM2L1XDn5UAAAARcm9vdEBlNjc3ZDMzODVjZDABAg==
+-----END OPENSSH PRIVATE KEY-----

forgejo/ssh/ssh_host_rsa_key.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDxHTszsNzR7gIElUtABcpB8vVlc+n39fH3sQSq6TqsEt9BWsGyxgc7oZMVZUCsvNeKWX2ils6u+eTVWNbz05SEhAsRdzGo4BCRt1TEa5p9Lahuf1mB2FLTzI83w1rB8r/r6n2bTlRTd46AUWrk6Ymz5MigbWq4u9HT6+teEAHxBaK+MqpbCS6OPT+5Hteztcf+EW+T4NczrVylTydRMSsI/GTpGotGK8YTsg7qKzK7d23Uj9hqQuua4qbvsCkvPRb7N5szboD08OgKGxjqFW2A5QnQdfIxvreJve/BOmIWG9QXAtvIPLZtdukbeZ3KKC7dQgtI8cfjHtfmmTws6E82+A1frbSukPD6WSWG4DM3ZBqPJCaXu8od9L/Hs164zD3lXv6Cb6jN0AMgWI5E5pUHFTTbLWMT9ghpNwGwK4fFu9X4ROh/EyDvdut9R5jAOe20on6s2C/4Y9kqg/oH82t/JTrSB7Q55Fw0X6+P6pkj3hALg7kB7XP1o11uTm+Ye50= root@e677d3385cd0

postgres/PG_VERSION

@@ -0,0 +1 @@
+17