Enter git-forgeHEADmaster

A small self-hosted git forge: HTTP push and pull, cgit browsing,
local and OIDC accounts, TOTP, scoped push tokens, per-repo
permissions, issues, a wiki, and outbound mail.

It does not reimplement git. git-http-backend and cgit run as CGI
behind its own listener, which authorises every request before
exec'ing either. One binary, one data directory, one listener: no
database, no JavaScript, and state is JSON in a git repo with a
working tree.

1 files changed, 30 insertions, 0 deletions

diff --git a/Containerfile b/Containerfile
new file mode 100644
index 0000000..1cb79e7
--- /dev/null
+++ b/Containerfile
@@ -0,0 +1,30 @@
+# git-forge: one binary, one data directory, one listener. Strictly Alpine,
+# both stages, so there is one distribution to reason about.
+
+FROM alpine:3.23 AS build
+RUN apk add --no-cache go
+WORKDIR /src
+COPY go.mod go.sum ./
+RUN go mod download
+COPY . .
+# Static, so the runtime image needs neither Go nor libc.
+RUN CGO_ENABLED=0 go build -trimpath -ldflags "-s -w" -o /git-forge .
+
+FROM alpine:3.23
+# git-daemon is not the daemon here: in Alpine that subpackage is where
+# git-http-backend lives, and without it every clone and push answers 500.
+# tini reaps what git leaves: a detached gc is reparented to PID 1 and would
+# otherwise stay a zombie.
+RUN apk add --no-cache git git-daemon cgit highlight ca-certificates tini
+COPY --from=build /git-forge /usr/local/bin/git-forge
+
+# Non-root, and the datadir is credential material, so 0700 and one owner.
+RUN adduser -D -H -u 1000 forge \
+	&& install -d -o forge -g forge -m 0700 /var/lib/git-forge
+USER forge
+ENV HOME=/tmp
+
+EXPOSE 8080
+VOLUME /var/lib/git-forge
+HEALTHCHECK --interval=30s --timeout=5s CMD wget -qO- http://127.0.0.1:8080/healthz || exit 1
+ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/git-forge"]