elektrine/elektrine
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
elektrine/.forgejo
History
Exact
maxfield f14db3a229
All checks were successful
Deploy Docker Images / Build, push, and deploy (push) Successful in 22m59s
Details
fix(security): close audit findings across DNS, auth, mail, and deploy 
Prove DNS zone ownership with per-zone TXT tokens and reserved operator
domains, harden auth/mail/VPN/edge paths against the remaining audit
findings, and tighten deploy/config hygiene so self-host defaults and CI
cannot reintroduce the same failure modes.
2026-08-09 01:09:14 -04:00
..
workflows fix(security): close audit findings across DNS, auth, mail, and deploy 2026-08-09 01:09:14 -04:00
README.md Initial commit 2026-07-30 01:36:18 -04:00

README.md

Forgejo Actions

Workflows in this directory run on the self-hosted Forgejo instance (https://git.elektrine.com) via forgejo-runner.

Workflow Purpose
smoke.yml Minimal runner health check
ci.yml Quality gate (format, compile, credo, tests)
docker-deploy.yml Build image + SSH deploy (port of .github/workflows/docker-deploy.yml)

Runner

  • Host: Forgejo droplet (git.elektrine.com)
  • Path: /opt/forgejo-runner
  • Labels: ubuntu-latest, ubuntu-22.04, docker

Repo secrets / variables

Set under Settings → Actions on elektrine/elektrine:

Secrets

  • DEPLOY_SSH_KEY — private key for production deploy (required)

  • REGISTRY_USERNAME / REGISTRY_TOKEN — optional Forgejo package credentials for optional registry push and Haraka image pulls. Legacy aliases GHCR_USERNAME / GHCR_TOKEN still work.

    The main Elektrine app image is built on the runner and transferred over SSH (docker save → rsync → docker load). Production deploy no longer requires a registry pull of the app image, which avoids unauthorized: authRequired.Verify on git.elektrine.com.

Variables

  • DEPLOY_HOST, DEPLOY_USER, DEPLOY_SSH_HOST_KEY
  • Optional: DEPLOY_PORT, DEPLOY_PATH, DEPLOY_BRANCH
  • Optional: REGISTRY (default git.elektrine.com), IMAGE_NAME, DOCKER_BUILD_*_DOMAIN

GitHub Actions under .github/workflows/ remain for the GitHub remote until you cut over production deploys fully.