feat(forgejo): v16 pre-flight — reverse-proxy trust + image pin (#73) #74

Sammanfogat

supernaut sammanfogade 6 incheckningar från forgejo-v16-upgrade in i main

2026-07-17 13:34:43 +00:00

supernaut kommenterad

2026-07-17 11:46:49 +00:00

Ägare

Pre-flight config for the v16 upgrade (#73), per the verified upgrade plan:

BC1 (mandatory): [security] REVERSE_PROXY_TRUSTED_PROXIES = 10.89.0.0/24 (the inspected gitborg podman bridge subnet) + REVERSE_PROXY_LIMIT = 1. v16 removed the * default — without this every request would appear to originate from Caddy (broken client IPs in audit logs / rate limiting).
Image pin: forgejo_image_tag: 15.0.4 → 16.0.0 (exact released tag, 2026-07-16) + stale :15 comment refs in vault.example.yml.

Runner v12.12.0 is confirmed compatible (v16 vendors exactly that module version). Apply happens in a maintenance window (backup → flush-queues → apply → doctor → verify); rollback is restore-from-backup — the schema migration is irreversible-forward.

Closes #73 is intentionally NOT used — the issue stays open until post-upgrade verification passes.

Pre-flight config for the v16 upgrade (#73), per the verified upgrade plan: - **BC1 (mandatory):** `[security] REVERSE_PROXY_TRUSTED_PROXIES = 10.89.0.0/24` (the inspected `gitborg` podman bridge subnet) + `REVERSE_PROXY_LIMIT = 1`. v16 removed the `*` default — without this every request would appear to originate from Caddy (broken client IPs in audit logs / rate limiting). - **Image pin:** `forgejo_image_tag: 15.0.4 → 16.0.0` (exact released tag, 2026-07-16) + stale `:15` comment refs in `vault.example.yml`. Runner v12.12.0 is confirmed compatible (v16 vendors exactly that module version). Apply happens in a maintenance window (backup → flush-queues → apply → doctor → verify); rollback is restore-from-backup — the schema migration is irreversible-forward. Closes #73 is intentionally NOT used — the issue stays open until post-upgrade verification passes.

supernaut lade till 2 incheckningar

2026-07-17 11:46:49 +00:00

feat(forgejo): trust caddy reverse proxy for v16 (#73 ) f0d9d18ea9

feat(forgejo): pin image to 16.0.0 (#73 )

ci / ci (pull_request) Successful in 2m4s

Detaljer

6b2135913d

supernaut lade till 2 incheckningar

2026-07-17 11:50:07 +00:00

docs(runbook): expand forgejo upgrade procedure for v16 (#73 ) 901483df6a

chore(local): bump preview forgejo image to 16 (#73 )

ci / ci (pull_request) Successful in 1m32s

Detaljer

13ccacfd36

supernaut lade till 1 incheckning

2026-07-17 12:27:26 +00:00

build: update forgejo runner to v12.13.0

ci / ci (pull_request) Successful in 2m9s

Detaljer

952ffe0073

supernaut ändrade titeln från ~~forgejo v16 pre-flight: reverse-proxy trust + image pin (#73)~~ till feat(forgejo): v16 pre-flight — reverse-proxy trust + image pin (#73)

2026-07-17 12:29:11 +00:00

supernaut lade till 1 incheckning

2026-07-17 12:57:30 +00:00

build: update node-exporter to 1.12.1

ci / ci (pull_request) Successful in 1m36s

Detaljer

6eb6ef0c2c