feat(forgejo): upgrade to 16.0.2 and pin trusted proxies explicitly #790

Merged

coilysiren merged 1 commit from aos/claude/forgejo-16 into main

2026-08-12 04:29:35 +00:00

coilyco-ops commented

2026-08-12 00:46:49 +00:00

Member

Refs #620, which already derived the decision boundary and the validation list. This does not re-derive them.

Change

Two lines in deploy/forgejo.yml:

15.0.2-rootless -> 16.0.2-rootless, not #620s 16.0.1, since 16.0.2` shipped 2026-07-30.
FORGEJO__security__REVERSE_PROXY_TRUSTED_PROXIES: 10.42.0.0/16, new.

Why the trusted-proxy line is here

Forgejo 16 removes the rootless image default REVERSE_PROXY_TRUSTED_PROXIES = * (upstream PR 12782). This deployment sets nothing in the manifest, and the running pods app.inihas no[security] reverse-proxy entry either, so it inherits that default today. After the upgrade it would silently fall back to loopback-only, Traefiks forwarded headers would stop being trusted, and every client IP in logs and IP-keyed behaviour would become the proxy`s address.

Setting it explicitly is also correct on 15, where it narrows the inherited wildcard rather than changing behaviour. So it is safe whether or not the image line lands with it.

Breaking changes checked

Trusted proxies - applies, handled above.
Mirror redirects (upstream PR 13129) - git mirror HTTP operations no longer follow redirects. This applies to Forgejos own pull mirrors. The GitHub mirror here is an external push driven by scripts/forgejo_github_mirror_sync.py`, so it is unaffected. Worth a confirming look at any repo with a Forgejo-side mirror configured.
Centralised git hooks - backwards compatible. Upstream offers an optional cleanup guide for existing repositories, which is follow-up rather than a gate.

Backup state

restic-backup.timer is active and its last run succeeded 2026-08-11 04:46, snapshot 0db62842, 94361 files and 95.848 GiB to rest:http://ser8:8000/kai-server. The script does pg_dump -Fc of the Forgejo database and discovers PVCs from the live k3s inventory, refusing partial snapshots.

#733`s remaining-work list is stale on steps 1 to 3: the apply, the first backup, and the timer are all done and green.

What is genuinely not done is #733 step 4, the restore drill (#599). Backups complete, but no restore has ever been proven. That is the real risk in this upgrade: 16 runs irreversible database migrations, so the rollback path is "restore the snapshot", and that path is untested.

Suggested sequence

Trigger a fresh restic-backup run and confirm it reports ok, rather than relying on yesterday`s.
Merge this, apply, watch the migration logs.
Validate per #620: migrations, PostgreSQL, ingress, SSH and HTTP git, OAuth, packages and OCI, Actions, runners, API.
Confirm the new endpoints answer: aosguard ops forgejo action-run-job list and action-job logs, which currently 404.
Unblock #621 and #622, and close #786.

Rollback

Restore image: 15.0.2-rootless and roll back the database from the pre-upgrade snapshot. The image alone is not sufficient once migrations have run. This is the untested path noted above.

🤖 Generated with Claude Code

Refs #620, which already derived the decision boundary and the validation list. This does not re-derive them. ## Change Two lines in `deploy/forgejo.yml`: * `15.0.2-rootless` -> `16.0.2-rootless`, not #620`s `16.0.1`, since `16.0.2` shipped 2026-07-30. * `FORGEJO__security__REVERSE_PROXY_TRUSTED_PROXIES: 10.42.0.0/16`, new. ## Why the trusted-proxy line is here Forgejo 16 removes the rootless image default `REVERSE_PROXY_TRUSTED_PROXIES = *` (upstream PR 12782). This deployment sets nothing in the manifest, and the running pod`s `app.ini` has no `[security]` reverse-proxy entry either, so it inherits that default today. After the upgrade it would silently fall back to loopback-only, Traefik`s forwarded headers would stop being trusted, and every client IP in logs and IP-keyed behaviour would become the proxy`s address. Setting it explicitly is also correct on 15, where it narrows the inherited wildcard rather than changing behaviour. So it is safe whether or not the image line lands with it. ## Breaking changes checked * **Trusted proxies** - applies, handled above. * **Mirror redirects** (upstream PR 13129) - git mirror HTTP operations no longer follow redirects. This applies to Forgejo`s own pull mirrors. The GitHub mirror here is an external push driven by `scripts/forgejo_github_mirror_sync.py`, so it is unaffected. Worth a confirming look at any repo with a Forgejo-side mirror configured. * **Centralised git hooks** - backwards compatible. Upstream offers an optional cleanup guide for existing repositories, which is follow-up rather than a gate. ## Backup state `restic-backup.timer` is active and its last run succeeded 2026-08-11 04:46, snapshot `0db62842`, 94361 files and 95.848 GiB to `rest:http://ser8:8000/kai-server`. The script does `pg_dump -Fc` of the Forgejo database and discovers PVCs from the live k3s inventory, refusing partial snapshots. **#733`s remaining-work list is stale** on steps 1 to 3: the apply, the first backup, and the timer are all done and green. **What is genuinely not done is #733 step 4, the restore drill (#599).** Backups complete, but no restore has ever been proven. That is the real risk in this upgrade: 16 runs irreversible database migrations, so the rollback path is "restore the snapshot", and that path is untested. ## Suggested sequence 1. Trigger a fresh `restic-backup` run and confirm it reports ok, rather than relying on yesterday`s. 2. Merge this, apply, watch the migration logs. 3. Validate per #620: migrations, PostgreSQL, ingress, SSH and HTTP git, OAuth, packages and OCI, Actions, runners, API. 4. Confirm the new endpoints answer: `aosguard ops forgejo action-run-job list` and `action-job logs`, which currently 404. 5. Unblock #621 and #622, and close #786. ## Rollback Restore `image: 15.0.2-rootless` and roll back the database from the pre-upgrade snapshot. The image alone is not sufficient once migrations have run. This is the untested path noted above. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

coilyco-ops added 1 commit

2026-08-12 00:46:49 +00:00

feat(forgejo): upgrade to 16.0.2 and pin trusted proxies explicitly

TruffleHog / Scan for secrets (pull_request) Successful in 4m20s

Details

CI / lint (pull_request) Successful in 5m50s

Details

6b1bc5992a

Forgejo 16 serves the Actions job and run log APIs that 15 has no route
for, which is what makes CI failures diagnosable. aosguard already speaks
them: the guardfile carries `logs action-job` and `logs action-run`
annotated "(Forgejo 16)", and the installed binary exposes both. They 404
today only because the server is 15.

16.0.2 rather than #620's 16.0.1, since 16.0.2 shipped 2026-07-30.

## The trusted-proxy breaking change

Forgejo 16 removes the rootless image's default
`REVERSE_PROXY_TRUSTED_PROXIES = *`. This deployment set nothing, in the
manifest or in app.ini, so it inherited that default and would silently
fall back to loopback-only after the upgrade. Traefik's forwarded headers
would stop being trusted and every client IP would become the proxy's.

The value is now explicit at the cluster pod CIDR. It is correct on 15
too, where it narrows the inherited wildcard rather than changing
behaviour, so it is safe to land before the image moves.

## Not affected

The mirror change, which stops git mirror HTTP operations following
redirects, applies to Forgejo's own pull mirrors. The GitHub mirror here
is an external push from scripts/forgejo_github_mirror_sync.py.

Refs #620

Co-authored-by: Kai Siren <coilysiren@gmail.com>
Co-authored-by: Claude <noreply@anthropic.com>

coilyco-ops requested review from coilysiren

2026-08-12 00:46:49 +00:00

coilyco-ops referenced this pull request

2026-08-12 01:27:14 +00:00

Upgrade Forgejo from 15 LTS to 16.0.1 #620