forge
ExploreLog in

Tahinli/forge

public
0 watching
★ 0
4.6 KiB
1# forge example configuration. Copy to forge.toml and adjust.
2# Development defaults; production values belong in /etc/forge/forge.toml.
3
4# SQLite/Turso database file.
5database = "./data/forge.db"
6# Root for repos, instance key, gitconfig, hooks and sockets.
7data_dir = "./data"
8# HTTP listen address for the web UI and smart-HTTP.
9listen = "127.0.0.1:7660"
10# Public base URL used in links and clone URLs.
11base_url = "http://127.0.0.1:7660"
12# Separate origin for raw user content (Milestone 2).
13user_content_base_url = "http://127.0.0.1:7661"
14# Listener for raw user files. It is served on a separate origin, so in production
15# user_content_base_url should use a separate registrable domain (not a subdomain of
16# base_url), which keeps user-uploaded content from running with the main site's cookies.
17user_content_listen = "127.0.0.1:7661"
18# SSH listen address for git over SSH.
19ssh_listen = "0.0.0.0:2222"
20# Host and port shown in SSH clone URLs.
21ssh_public_host = "127.0.0.1"
22ssh_public_port = 2222
23# Self-registration: "closed" | "invite" | "open".
24registration = "closed"
25# Proxies whose X-Forwarded-For is trusted for client IPs (login and git throttling). Addresses or CIDRs.
26# Set to ["127.0.0.1"] when running behind a local reverse proxy. Empty: the TCP peer is the client.
27trusted_proxies = []
28
29# Outbound webhooks. Internal destinations (loopback, private, link-local, CGNAT, ...) are refused.
30# [webhooks]
31# Allow http:// hook URLs (https only by default).
32# allow_http = false
33# Exact hostnames or CIDR networks that may be reached even if they resolve to internal addresses.
34# allowed_hosts = ["hooks.internal.example", "10.20.0.0/16"]
35
36# Scheduled backups (see docs/backup.md). Empty dir disables the scheduler.
37# [backup]
38# Directory that receives the backup sets. Ship it off-site with restic or rclone.
39# dir = "/var/backups/forge"
40# Hours between full backup sets.
41# interval_hours = 24
42# Newest complete sets kept in dir. Older complete sets are deleted after a good run.
43# keep = 7
44# Optional healthchecks.io style URL: pinged with /start, then the URL on success or /fail on error.
45# The URL may hold a token, so the admin page shows only its host.
46# healthcheck_url = ""
47# Days between git fsck of every repo and the database integrity check.
48# fsck_interval_days = 7
49
50# Release settings.
51# [releases]
52# Largest accepted release asset, in MiB.
53# max_asset_mb = 512
54
55# Standby replication (see docs/backup.md). Empty target disables it. When target is set,
56# identity_file and known_hosts_file are required.
57# [replication]
58# [user@]host:/absolute/base of the standby account. Empty disables replication.
59# target = ""
60# SSH port of the standby host.
61# ssh_port = 22
62# Private key of the standby account (mode 0600). Required when target is set.
63# identity_file = ""
64# Pinned host keys of the standby. Required when target is set. StrictHostKeyChecking is always yes.
65# known_hosts_file = ""
66# Minutes between database snapshots shipped to the standby. Must be at least 1.
67# db_snapshot_minutes = 15
68# Minutes between reconcile passes (refs checksums, deleted repos, healthcheck). Must be at least 1.
69# reconcile_minutes = 60
70# Optional URL pinged after each reconcile pass. Empty disables it.
71# healthcheck_url = ""
72
73# Git LFS limits.
74# [lfs]
75# Largest accepted LFS object, in MiB.
76# max_object_mb = 2048
77
78# CI limits and retention.
79# [ci]
80# Whether CI runs at all. When false, pushes and pull requests create no runs.
81# enabled = true
82# Largest job log, in MiB. Past it the log is truncated.
83# max_log_mb = 16
84# Largest artifact, in MiB.
85# max_artifact_mb = 512
86# Artifacts a single job may upload.
87# max_artifacts_per_job = 50
88# Days a job log is kept.
89# log_retention_days = 90
90# Days an artifact is kept.
91# artifact_retention_days = 30
92# Hours a runner registration token stays valid.
93# registration_token_hours = 24
94
95# Security advisories (opt-in). When enabled, the forge downloads the OSV dumps for ecosystems and scans each repo's lockfiles.
96# [advisories]
97# Whether the advisory download and the lockfile scans run at all.
98# enabled = false
99# OSV ecosystems to download and scan: any of "crates.io", "npm", "Go".
100# ecosystems = ["crates.io", "npm", "Go"]
101# Hours before a downloaded dump is fetched again.
102# refresh_hours = 24
103
104# Outgoing mail transport. The SMTP server, sender and password are set on /admin/mail and stored in the database.
105# [mail]
106# smtp sends through the configured server. log writes each message to <data_dir>/mail-log/ instead, for development and tests.
107# transport = "smtp"
108
109# Organization rules.
110# [orgs]
111# Who may create organizations: "all" (any signed-in person) or "admin" (instance admins only).
112# creation = "all"