chore: publish 3.6.4+1.27.2-rootless release

Merge pull request 'chore: upgrade gitea to 1.27.2-rootless, postgres to 15.19' (#63 ) from upgrade-2f64ddf into master
Reviewed-on: #63
2026-08-17 14:42:26 -04:00 · 2026-08-17 18:38:42 +00:00 · 2026-08-14 02:36:09 +00:00 · 2026-08-10 12:57:05 -04:00 · 2026-08-10 16:54:41 +00:00 · 2026-08-10 16:52:09 +00:00
7 changed files with 18 additions and 12 deletions
@@ -8,8 +8,9 @@ COMPOSE_FILE="$COMPOSE_FILE:compose.mariadb.yml"
 # COMPOSE_FILE="$COMPOSE_FILE:compose.sqlite3.yml"
 # COMPOSE_FILE="$COMPOSE_FILE:compose.postgres.yml"

-# Enable to use forgejo instead of gitea
-# COMPOSE_FILE="$COMPOSE_FILE:compose.forgejo.yml"
+# Enable Git LFS on plain gitea (not needed with forgejo, which bundles it).
+# Mounts the lfs_jwt_secret secret and sets GITEA_LFS_START_SERVER=true.
+# COMPOSE_FILE="$COMPOSE_FILE:compose.lfs.yml"
 # SECRET_LFS_JWT_SECRET_VERSION=v1 # length=43

 GITEA_DOMAIN=git.example.com
@@ -1,4 +1,4 @@
-export APP_INI_VERSION=v21
+export APP_INI_VERSION=v23
 export DOCKER_SETUP_SH_VERSION=v1
 export PG_BACKUP_VERSION=v1

@@ -61,7 +61,7 @@ SSH_LISTEN_PORT = {{ env "GITEA_SSH_PORT" }}
 SSH_PORT = {{ env "GITEA_SSH_PORT" }}
 START_SSH_SERVER = true
 LFS_START_SERVER = {{ env "GITEA_LFS_START_SERVER" }}
-{{ if eq (env "FORGE") "forgejo" }}
+{{ if (eq (env "GITEA_LFS_START_SERVER") "true") }}
 LFS_JWT_SECRET = {{ secret "lfs_jwt_secret" }}
 {{ end }}

@@ -1,12 +1,12 @@
-version: '3.8'
+version: "3.8"

 services:
  app:
-    image: codeberg.org/forgejo/forgejo:12.0.2-rootless
    environment:
-    - FORGE=forgejo
+      - GITEA_LFS_START_SERVER=true
    secrets:
-    - lfs_jwt_secret
+      - lfs_jwt_secret
+
 secrets:
  lfs_jwt_secret:
    name: ${STACK_NAME}_lfs_jwt_secret_${SECRET_LFS_JWT_SECRET_VERSION}
@@ -10,7 +10,7 @@ services:
    secrets:
      - db_password
  db:
-    image: postgres:15.13
+    image: postgres:15.19
    deploy:
      labels:
        backupbot.backup.pre-hook: "/pg_backup.sh backup"
@@ -3,7 +3,7 @@ version: "3.8"

 services:
  app:
-    image: "gitea/gitea:1.24.2-rootless"
+    image: "gitea/gitea:1.27.2-rootless"
    configs:
      - source: app_ini
        target: /etc/gitea/app.ini
@@ -15,7 +15,6 @@ services:
      - jwt_secret
      - secret_key
    environment:
-      - FORGE=gitea
      - GITEA_ALLOW_ONLY_EXTERNAL_REGISTRATION
      - GITEA_APP_NAME
      - GITEA_AUTO_WATCH_NEW_REPOS
@@ -88,7 +87,7 @@ services:
        - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolalloworiginlist=https://${GITEA_CORS_ALLOW_DOMAIN}"
        - "traefik.http.middlewares.${STACK_NAME}_cors.headers.accesscontrolmaxage=100"
        - "traefik.http.middlewares.${STACK_NAME}_cors.headers.addvaryheader=true"
-        - coop-cloud.${STACK_NAME}.version=3.5.3+1.24.2-rootless
+        - coop-cloud.${STACK_NAME}.version=3.6.4+1.27.2-rootless


 networks:
@@ -0,0 +1,6 @@
+Forgejo support has been moved to its own recipe.  Make the move by:
+
+* Getting the recipe locally with `abra recipe fetch forgejo`
+* Changing the recipe's TYPE with `abra application config FORGEJO_DOMAIN`
+* Redeploy the app with `abra application undeploy` and `abra
+  application deploy`
Author	SHA1	Message	Date
trav	4c70df77e8	chore: publish 3.6.4+1.27.2-rootless release continuous-integration/drone/push Build is failing Details continuous-integration/drone/tag Build is passing Details	2026-08-17 14:42:26 -04:00
trav	8992d2fc8b	Merge pull request 'chore: upgrade gitea to 1.27.2-rootless, postgres to 15.19' (#63 ) from upgrade-2f64ddf into master continuous-integration/drone/push Build is failing Details Reviewed-on: #63	2026-08-17 18:38:42 +00:00
autonomic-bot	2f64ddfa16	chore: upgrade gitea to 1.27.2-rootless, postgres to 15.19	2026-08-14 02:36:09 +00:00
notplants	97fe2bf213	chore: publish 3.6.3+1.27.1-rootless release continuous-integration/drone/push Build is failing Details continuous-integration/drone/tag Build is passing Details	2026-08-10 12:57:05 -04:00
notplants	fe536b276b	Merge pull request 'fix: bump APP_INI_VERSION to v23' (#62 ) from fix-app-ini-version into master continuous-integration/drone/push Build is failing Details Reviewed-on: #62	2026-08-10 16:54:41 +00:00
autonomic-bot	852717d212	fix: bump APP_INI_VERSION to v23 app.ini.tmpl changed in "BREAKING CHANGE: remove forgejo" but the config version stayed at v22. Swarm configs are immutable, so upgrading an existing deployment aborts: FATA failed to update config <stack>_app_ini_v22: Error response from daemon: rpc error: code = InvalidArgument desc = only updates to Labels are allowed Bumping to v23 makes Swarm create a new config object instead of mutating v22; the orphaned v22 can be pruned after rollout.	2026-08-10 16:52:09 +00:00
notplants	1f987b4ab3	chore: publish 3.6.2+1.27.1-rootless release continuous-integration/drone/push Build is failing Details continuous-integration/drone/tag Build is passing Details	2026-08-10 12:32:49 -04:00
notplants	a8d2231e74	Merge pull request 'chore: upgrade gitea to 1.27.1-rootless' (#61 ) from upgrade-7561bed into master continuous-integration/drone/push Build is failing Details Reviewed-on: #61	2026-08-10 16:32:05 +00:00
autonomic-bot	096cc70fd9	chore: upgrade gitea to 1.27.1-rootless Fixes two critical Gitea CVEs, both CVSS 9.8, both remediated in 1.27.1: - CVE-2026-60004: RCE via POST /api/v1/repos/{owner}/{repo}/diffpatch — a patch submitted twice triggers an add/add conflict that writes an executable post-index-change hook into $GIT_DIR/hooks/, which git then runs as the Gitea service account. Affects 1.17-1.27.0; public PoC. - CVE-2026-59774: unauthenticated arbitrary file read via Org-mode #+INCLUDE accepting absolute paths through the markup renderer (affects 1.22.1-1.27.0), escalating to RCE by reading config/tokens. Based on current upstream main, so it includes the BREAKING CHANGE: remove forgejo work; the previous branch predated it and was verified against a tree that would not have deployed. Version label left at 3.6.0+1.24.2-rootless per upgrade-PR convention (operator runs abra recipe release).	2026-08-10 16:27:26 +00:00
notplants	37ebd22ba4	Merge pull request 'BREAKING CHANGE: remove forgejo' (#58 ) from remove-forgejo into master continuous-integration/drone/push Build is failing Details Reviewed-on: #58 Reviewed-by: 3wordchant <3+3wordchant@noreply.git.coopcloud.tech>	2026-07-07 21:11:52 +00:00
notplants	4c330eb4a4	Merge branch 'master' into remove-forgejo	2026-07-07 21:11:31 +00:00
fauno	57e224c5b0	doc: release notes	2026-06-25 16:48:12 -03:00
notplants	0ab323d24a	Merge pull request 'chore: upgrade gitea to 1.26.2-rootless, postgres to 15.18' (#60 ) from upgrade-273d214 into master continuous-integration/drone/push Build is failing Details Reviewed-on: #60	2026-06-22 19:41:31 +00:00
notplants	2f7f1b6bfe	chore: upgrade gitea to 1.26.2-rootless, postgres to 15.18	2026-06-22 19:29:08 +00:00
fauno	6a0339d3f2	BREAKING CHANGE: remove forgejo	2026-06-16 18:33:21 -03:00
notplants	ce4de9e645	Merge pull request 'feat: support Git LFS on plain gitea' (#57 ) from lfs into master continuous-integration/drone/push Build is failing Details Reviewed-on: #57 Reviewed-by: ammaratef45 <ammaratef45@proton.me>	2026-06-15 21:08:52 +00:00
notplants	357926f26e	feat: support Git LFS on plain gitea continuous-integration/drone/tag Build is passing Details Add an opt-in compose.lfs.yml that mounts the lfs_jwt_secret secret and enables GITEA_LFS_START_SERVER for plain gitea (forgejo already bundles LFS). Emit LFS_JWT_SECRET in app.ini whenever the LFS server is on so the JWT secret is stable across redeploys instead of being regenerated on every restart (app.ini is a read-only config mount). Bump version 3.5.2 -> 3.6.0.	2026-06-15 19:33:03 +00:00