Forgejo on Andrew's Memory Blog

Uploading to the webserver from Forgejo

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 08 Apr 2026 23:14:09 -0700

To get Hugo up to the webserver, I had to scp the files up there using my keyfile. For that, I started with the image that I gave the docker tag, which is one of the default Forgejo images.

Setting up variables
#

First I set up a bunch of variables:

WEBSERVER_SSH_USERNAME: my username on the webserver
WEBSERVER_SSH_HOST: the hostname of the webserver I upload to
WEBSERVER_HTML_DIR: the directory where the webserver files get sent

Setting up secrets
#

I ended up with two secrets:

SSH_PRIV_KEY: my private key
SSH_KNOWN_HOSTS: I also needed to set up my ~/.ssh/known_hosts so that I wouldn’t get errors when connecting via scp. I temporarily threw away my existing deploy.yaml and built a new one that did a little (very little) ssh using sftp:

.forgejo/workflows/deploy.yaml

on: [push]
 deployscp:
 runs-on: docker
 steps:
 - run: |
 echo dir > ftpbatch
 echo bye >> ftpbatch
 - name: setup ssh
 run: |
 mkdir -p ~/.ssh
 chmod 0700 ~/.ssh
 echo "${{ secrets.SSH_PRIV_KEY }}" > ~/.ssh/id_rsa_webserver
 chmod 0600 ~/.ssh/id_rsa_webserver
 ssh-keyscan ${{ vars.WEBSERVER_SSH_HOST }} >> ~/.ssh/known_hosts
 cat ~/.ssh/known_hosts
 - name: push public
 run: |
 echo about to sftp
 sftp -i ~/.ssh/id_rsa_webserver -b ./ftpbatch ${{ vars.WEBSERVER_SSH_USERNAME }}@${{ vars.WEBSERVER_SSH_HOST }}
 echo did sftp

The first time I ran that, I copied the output of the cat ~/.ssh/known_hosts line into the secret SSH_KNOWN_HOSTS. Then I updated deploy.yaml to use the secret instead:

.forgejo/workflows/deploy.yaml

on: [push]
 deployscp:
 runs-on: docker
 steps:
 - run: |
 echo dir > ftpbatch
 echo bye >> ftpbatch
 - name: setup ssh
 run: |
 mkdir -p ~/.ssh
 chmod 0700 ~/.ssh
 echo "${{ secrets.SSH_PRIV_KEY }}" > ~/.ssh/id_rsa_webserver
 chmod 0600 ~/.ssh/id_rsa_webserver
 echo "${{ secrets.SSH_KNOWN_HOST }}" > ~/.ssh/known_hosts
 chmod 0600 ~/.ssh/known_hosts
 - name: push public
 run: |
 echo about to sftp
 sftp -i ~/.ssh/id_rsa_webserver -b ./ftpbatch ${{ vars.WEBSERVER_SSH_USERNAME }}@${{ vars.WEBSERVER_SSH_HOST }}
 echo did sftp

I was hoping that Forgejo would preserve the line separators that I pasted into the secret dialog. It did! Nice!

Add Hugo back to the build and really upload
#

With a working sftp (and presumably a working ssh) and a good private key, I could add the hugo step back. It packages up the build, then the docker image retrieves the build and uploads the important bit. Here’s the whole enchilada:

.forgejo/workflows/deploy.yaml

on: [push]
jobs:
 buildhugo:
 runs-on: hugo
 steps:
 - run: hugo version
 - uses: actions/checkout@v4
 with:
 submodules: 'recursive'
 - name: run hugo
 run: hugo --gc --minify
 - name: fix up RSS
 run: cp ./public/index.xml ./public/rss.xml
 - name: stash public files
 uses: https://code.forgejo.org/forgejo/upload-artifact@v4
 with:
 name: public
 path: ./public/ 

 deployscp:
 runs-on: docker
 needs: buildhugo
 steps:
 - name: grab public files
 uses: https://code.forgejo.org/forgejo/download-artifact@v4
 - name: setup ssh
 run: |
 mkdir -p ~/.ssh
 chmod 0700 ~/.ssh
 echo "${{ secrets.SSH_PRIV_KEY }}" > ~/.ssh/id_rsa_webserver
 chmod 0600 ~/.ssh/id_rsa_webserver
 echo "${{ secrets.SSH_KNOWN_HOST }}" > ~/.ssh/known_hosts
 chmod 0600 ~/.ssh/known_hosts
 - name: push public
 run: |
 ssh -i ~/.ssh/id_rsa_webserver ${{ vars.WEBSERVER_SSH_USERNAME }}@${{ vars.WEBSERVER_SSH_HOST }} 'rm -rf /home/${{ vars.WEBSERVER_SSH_USERNAME }}/${{ vars.WEBSERVER_HTML_DIR }}/*'
 scp -r -i ~/.ssh/id_rsa_webserver ./public/* ${{ vars.WEBSERVER_SSH_USERNAME }}@${{ vars.WEBSERVER_SSH_HOST }}:/home/${{ vars.WEBSERVER_SSH_USERNAME }}/${{ vars.WEBSERVER_HTML_DIR }}/

This makes it look easy. It wasn’t. I was nervous about the process, and started with echo ssh -i ~/... and echo scp -r -i ~/... instead of actually running the ssh and scp commands. I made sure things looked right in the Actions window on the Forgejo server before I did the scp for real, and it took me a couple more deep breaths before I did the ssh (which does a rm -rf).

Ultimately, I had to run things 70 times — I counted — before I got a working deploy. Lots of echo and ls -al to make sure I was oriented. And probably a third of the commits were fixes for this error:

Workflow was not executed due to an error that blocked the execution attempt.
Unable to parse supported events in workflow: yaml: line 25: found a tab character where an indentation space is expected

I really need to set my Emacs up so it uses only spaces for yaml files. Esc-X untabify was my best friend.

Now, I have a website that updates automatically when I push the code. Not when I commit — I’m still trying to remember that git push origin after publishing. I think I’ll commit this and do that now.

Running Hugo from the runner on Forgejo

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Wed, 08 Apr 2026 22:33:06 -0700

I’m taking a shortcut here. With the benefit of foresight which is really hindsight, I set my runner up to run Hugo already with the label hugo. So this is really about the automation I used to do the build. I started with attempts to install Hugo using apk add with the Docker image. That was a side quest that led nowhere.

Then when I decided to split things up, it took me a while to find the right image. The official Hugo Docker image luckily it includes Node.js so it can run the checkout and upload-artifact actions.

However, you can’t do everything on the Hugo image. That means the build has to be split up into two parts. This part is only for running Hugo. Luckily, when it runs, Hugo can store the files it built (./public/) in an artifact, so it’s not too hard to get them later for uploading.

You also need to check out the right thing. For Hugo with Blowfish installed, that means checking out submodules.

If you want to avoid the shortcut and do what I really did, check out the Forgejo Actions quick start guide and build a “hello world” action first.

This is the file I ended up creating in my local repo:

.forgejo/workflows/deploy.yaml

on: [push]
jobs:
 buildhugo:
 runs-on: hugo
 steps:
 - run: hugo version
 - uses: actions/checkout@v4
 with:
 submodules: 'recursive'
 - name: run hugo
 run: hugo --gc --minify
 - name: fix up RSS
 run: cp ./public/index.xml ./public/rss.xml
 - name: stash public files
 uses: https://code.forgejo.org/forgejo/upload-artifact@v4
 with:
 name: public
 path: ./public/

This checks out the git repo with submodules, runs hugo --gc --minify on that, copies index.xml to rss.xml because I started with Astro and didn’t want to have to migrate everyone’s links, then uploads the ./public/ directory with the name public to Forgejo’s artifact repo.

Once you’ve done that, you can:

git add .forgejo/workflows/deploy.yaml
git commit
git push origin

That triggers the automation that will (first time) download the Hugo image, then build the website, then stash it in an artifact called public.

But that’s only half the story for deploy.yaml. Read about uploading to the webserver here.

Setting up a Forgejo runner for Hugo and others

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 02 Apr 2026 22:16:05 -0700

I spent a lot of time messing around because I thought the runner was the thing that ran my actions. Nope, it’s the thing that runs the Docker image that builds your images. That makes life easier. Here’s how I set up mine:

Get the runner token
#

You need the runner token to configure a runner. So do that first. You need to be an admin to set up the runner.

Under the profile menu on the far right, click on “Site administration.”
Under “Admin settings” expand Actions to click on “Runners”

Over on the right, click the “Create a new runner” button. This opens a dialog with a token in it. Copy that token to a text editor.

Setting up a runner
#

I spent a lot of time messing around because I thought the runner was the thing that ran my actions. Nope, it’s the thing that runs the Docker image that builds your images. That makes life easier.

Make a directory for the runner, put the Dockerfile in it, and grab the image. These instructions look at lot like the ones at the OCI image installation instructions on the Forgejo website.

cd /data/shared/forgejo
mkdir runner
cd runner
wget https://code.forgejo.org/forgejo/runner/raw/branch/main/Dockerfile
docker run --rm data.forgejo.org/forgejo/runner:11 forgejo-runner --version

Create a setup.sh in runner/ that looks like this. (Make sure to update the chown line to use the UID and GID you specified in the Forgejo docker-compose.yaml):

setup.sh

#!/usr/bin/env bash
cd /data/shared/forgejo/runner
set -e

mkdir -p data/.cache
chown -R 2000:2000 data
chmod 775 data/.cache
chmod g+s data/.cache

Edit the Dockerfile to use your user info. Look for the USER line and put in your UID and GID:

USER 2000:2000

Run setup.sh

bash ./setup.sh

Create a docker-compose.yaml. Based on the Forgejo instructions, it should look like this (but remember to change the user: to your UID and GID). Yeah, I know it should be a different UID and GID but I’m lazy:

docker-compose.yaml

version: '3.8'

services:
 docker-in-docker:
 image: docker:dind
 container_name: 'docker_dind'
 privileged: 'true'
 command: ['dockerd', '-H', 'tcp://0.0.0.0:2375', '--tls=false']
 restart: 'unless-stopped'

 runner:
 image: 'data.forgejo.org/forgejo/runner:11'
 links:
 - docker-in-docker
 depends_on:
 docker-in-docker:
 condition: service_started
 container_name: 'runner'
 environment:
 DOCKER_HOST: tcp://docker-in-docker:2375
 # User without root privileges, but with access to `./data`.
 user: 2000:2000
 volumes:
 - ./data:/data
 restart: 'unless-stopped'

 command: '/bin/sh -c "while : ; do sleep 1 ; done ;"'
# command: '/bin/sh -c "sleep 5; forgejo-runner daemon --config config.yml"'

Fire up the runner and attach to the shell in the runner image.

docker compose up -d
docker exec -it runner /bin/sh

From within the Docker image shell, run:

forgejo-runner generate-config > config.yml
forgejo-runner register

This will run a script. I used the following values. For the runner labels, what they really want is the label followed by a colon followed by the URL of the docker image, with each entry separated by commas. Since I wanted my runner to run Hugo, I added a label for hugo and a pointer to the Hugo image as well as a “docker” label which is one of the defaults:


INFO Enter the Forgejo instance URL (for example, https://next.forgejo.org/):
http://myforgejoserver.acornwall.net:3000

INFO Enter the runner token:
d41d8cd98f00b204e9800998ecf8427e32d6c11747e037155210

INFO Enter the runner name (if set empty, use hostname: 3b586057879f):
runner

INFO Enter the runner labels, leave blank to use the default labels (comma-separated, for example, ubuntu-20.04:docker://node:20-bookworm,ubuntu-18.04:docker://node:20-bookworm):
hugo:docker://ghcr.io/gohugoio/hugo:v0.152.2,docker:docker://data.forgejo.org/oci/node:20-bullseye

All that creates a .runner file in the Docker image, which gets mapped to the data directory that setup.sh created.
Now, shut the image down.

docker compose down

Next, edit the docker-compose.yaml. Comment out the command that just spins, and uncomment the command that does the thing:

docker-compose.yaml

...
# command: '/bin/sh -c "while : ; do sleep 1 ; done ;"'
 command: '/bin/sh -c "sleep 5; forgejo-runner daemon --config config.yml"'

Bring the runner back up:

docker compose up -d

If you did everything right, you should see a runner show up under Admin settings - Actions - Runners.

Getting the runner to restart on reboot
#

Another bout with systemd, ‘cause we’d like this to start on reboot as well.

/etc/systemd/system/forgejo-runner.service

[Unit]
Description=Forgejo Runner
After=forgejo.service
Requires=forgejo.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/bash -c "/usr/bin/docker compose -f /data/shared/forgejo/runner/docker-compose.yaml up --detach"
ExecStop=/bin/bash -c "/usr/bin/docker compose -f /data/shared/forgejo/runner/docker-compose.yaml down"

[Install]
WantedBy=multi-user.target

And then the requisite:

/usr/bin/docker compose -f /data/shared/forgejo/runner/docker-compose.yaml down
sudo systemctl start forgejo-runner
sudo systemctl status forgejo-runner
sudo systemctl stop forgejo-runner
sudo systemctl enable forgejo-runner
sudo systemctl start forgejo-runner

Installing a minimal Forgejo via Docker on Ubuntu 24.04

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Thu, 02 Apr 2026 20:54:05 -0700

I’ve been wanting to play with Forgejo for a while. It’s the open source DevOps platform behind Codeberg and I like the idea of self-hosted automation. I wanted a minimal one — I didn’t need mail but I wanted automation on push.

If you know Docker (the current version of Docker) you’ll find it pretty easy to install. Here’s how to do it.

Pull Forgejo from Docker
#

Ubuntu 24.04 doesn’t come with the new Docker, or sqlite3. So:

sudo apt install docker-compose-v2 sqlite3

Grab the Docker image:

docker pull codeberg.org/forgejo/forgejo:14

Create a docker-compose.yaml based on the one at forgejo.org/docs/next/admin/installation/docker/. I changed three places the USER_UID, USER_GID, and the path to the volume (I used a hard-coded one rather than ./forgejo. The file I ended up with was:

docker-compose.yaml

networks:
 forgejo:
 external: false

services:
 server:
 image: codeberg.org/forgejo/forgejo:14
 container_name: forgejo
 environment:
 - USER_UID=2000
 - USER_GID=2000
 restart: always
 networks:
 - forgejo
 volumes:
 - /data/shared/forgejo/forjego:/data ← was ./forgejo:/data
 - /etc/localtime:/etc/localtime:ro
 ports:
 - '3000:3000'
 - '222:22'

Bring the image up:

docker compose up -d

Open a browser on the host’s port 3000 (which I’ll call myforgejoserver.acornwall.net:3000) to initialize Forgejo.
In the browser, leave everything as default except the server domain and base URL. That means I’m using the default sqlite

I skipped email settings and server/third-party service settings, and entered the administrator account settings, then clicked Install Forgejo:

Next I restarted Forgejo and made sure that the settings stuck. If you have the storage volume wrong in the docker-compose.yaml, as I did the first time, you get to enter everything again after fixing it.

docker compose down
docker compose up -d

Creating a Git Repo Into Forgejo
#

Once things were set up, I could log in and create a repo in Forgejo. Here’s what I did.

Navigate to the + dropdown and click “New repository”.
Fill out the form. I called my repo “andrewmemory” and set my user as the owner. I checked “Make repostitory private.” I also checked “Initialize repository” which lead to some issues later, but hey, it looked good at the time. I added both “Emacs” and “Hugo” to .gitignore — I didn’t realize I could do both the first time I tried. I went with CC-BY-NC-ND-4.0 for the license. Then I clicked “Create repository.”

There, the repo is created!

Verifying your public key
#

Once the repo was created on Forgejo, I needed to add my private cert to Forgejo. That meant clicking the dropdown on the right with my avatar, clicking “Settings,” then navigating to “SSH / GPG keys”. From there I could click “Add key” under SSH Keys. I pasted my public key in there. Then click “Add key.”
Once you’ve done that, you’ve got something like this. Click “Verify”:
After clicking verify, you’re presented with a token and a string to paste into a terminal. Copy the string, paste it into the terminal, but edit the filename if your private key is not id_ed25519.

echo -n 'ee2cd80b5f8f4e95800ddca4d92053998bc3f8e7a9cc1dd60fe30e7ad83b87d6' | ssh-keygen -Y sign -n myforgejoserver.acornwall.net -f ~/.ssh/id_rsa

Running that command will dump a wad into your terminal that looks like this:

-----BEGIN SSH SIGNATURE-----
U1mIU0lHAAAAAQA
...
+wrNHO9W
-----END SSH SIGNATURE-----

Copy the whole wad including the BEGIN and END parts, then paste that into the section that says “Armored SSH signature” and press the “Verify” button.
If you’ve done everything right your key is now verified.

Connecting the old repo
#

Finally, I could start moving my website (which is in a git repo on disk) into Forgejo. That wasn’t terrible, although it took me a couple of tries because I wasn’t sure how to do it. Here’s what I did.

cd andrewmemory-hugo
git remote rm origin # It took me a couple of tries, so I had to remove the old origin
git remote add origin ssh://git@myforgejoserver.acornwall.net:222/andrew/andrewmemory
git pull --allow-unrelated origin main

This resulted in a bunch of merge conflicts in .gitignore that I manually took care of. Once that was done, I could:

git push --set-upstream origin main

Setting Forgejo to restart after reboot
#

This is all groovy, but next time I install Linux patches, I’m going to have to reboot my machine. So I created a systemd (boo) service to do that.

/etc/systemd/system/forgejo.service

[Unit]
Description=Forgejo
After=docker.service
Requires=docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/bash -c "/usr/bin/docker-compose -f /data/shared/forgejo/docker-compose.yaml up --detach"
ExecStop=/bin/bash -c "/usr/bin/docker-compose -f /data/shared/forgejo/docker-compose.yaml down"

[Install]
WantedBy=multi-user.target

Then, I made sure it worked and enabled it on boot:

sudo systemctl start forgejo
sudo systemctl status forgejo
sudo systemctl stop forgejo
sudo systemctl enable forgejo
sudo systemctl start forgejo

Ok, Forgejo is set up!

Website automation with Forgejo

andrewmemoryblog@gmail.com (Andrew's Memory Blog) — Sun, 29 Mar 2026 21:54:05 -0700

If you see this, then my Forgejo web automation is working.

It took a few steps:

Forgejo on Andrew's Memory Blog

Uploading to the webserver from Forgejo

Setting up variables #

Setting up secrets #

Add Hugo back to the build and really upload #

Running Hugo from the runner on Forgejo

Setting up a Forgejo runner for Hugo and others

Get the runner token #

Setting up a runner #

Getting the runner to restart on reboot #

Installing a minimal Forgejo via Docker on Ubuntu 24.04

Pull Forgejo from Docker #

Creating a Git Repo Into Forgejo #

Verifying your public key #

Connecting the old repo #

Setting Forgejo to restart after reboot #

Website automation with Forgejo

Setting up variables
#

Setting up secrets
#

Add Hugo back to the build and really upload
#

Get the runner token
#

Setting up a runner
#

Getting the runner to restart on reboot
#

Pull Forgejo from Docker
#

Creating a Git Repo Into Forgejo
#

Verifying your public key
#

Connecting the old repo
#

Setting Forgejo to restart after reboot
#