Rockachopa/Timmy-time-dashboard
1
0
Fork 2
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

[URGENT] Disable Gitea registration + require sign-in to view #988

New Issue
Closed
opened 2026-03-22 19:12:49 +00:00 by perplexity · 1 comment
perplexity commented 2026-03-22 19:12:49 +00:00
Collaborator
Copy Link

Parent

  • #971 — Urgent: falsework and security and gitea database robustness

Objective

Close the two highest-risk gaps in the Gitea instance immediately.

Changes to custom/conf/app.ini

[service]
DISABLE_REGISTRATION = true
ALLOW_ONLY_EXTERNAL_REGISTRATION = false
SHOW_REGISTRATION_BUTTON = false

[service]
REQUIRE_SIGNIN_VIEW = true

Acceptance Criteria

  • Registration page returns error or is hidden
  • /explore redirects to login when not authenticated
  • Existing accounts still work
  • Restart Gitea service after config change

Risk

Without this, automated bots can create accounts and access all repositories.

## Parent - #971 — Urgent: falsework and security and gitea database robustness ## Objective Close the two highest-risk gaps in the Gitea instance immediately. ## Changes to `custom/conf/app.ini` ```ini [service] DISABLE_REGISTRATION = true ALLOW_ONLY_EXTERNAL_REGISTRATION = false SHOW_REGISTRATION_BUTTON = false [service] REQUIRE_SIGNIN_VIEW = true ``` ## Acceptance Criteria - [ ] Registration page returns error or is hidden - [ ] `/explore` redirects to login when not authenticated - [ ] Existing accounts still work - [ ] Restart Gitea service after config change ## Risk Without this, automated bots can create accounts and access all repositories.
claude was assigned by Rockachopa 2026-03-22 21:44:39 +00:00
Rockachopa commented 2026-03-22 22:39:33 +00:00
Owner
Copy Link

PR #997 created.

Added deploy/gitea/app.ini (hardened config reference) and scripts/harden_gitea.sh (automated hardening script). The script backs up the existing config, patches all four [service] settings (DISABLE_REGISTRATION, ALLOW_ONLY_EXTERNAL_REGISTRATION, SHOW_REGISTRATION_BUTTON, REQUIRE_SIGNIN_VIEW), restarts Gitea, and verifies the changes. Supports both bare-metal (systemd) and Docker deployments.

To apply on the server:

sudo bash scripts/harden_gitea.sh --config /path/to/app.ini
PR #997 created. Added `deploy/gitea/app.ini` (hardened config reference) and `scripts/harden_gitea.sh` (automated hardening script). The script backs up the existing config, patches all four `[service]` settings (DISABLE_REGISTRATION, ALLOW_ONLY_EXTERNAL_REGISTRATION, SHOW_REGISTRATION_BUTTON, REQUIRE_SIGNIN_VIEW), restarts Gitea, and verifies the changes. Supports both bare-metal (systemd) and Docker deployments. To apply on the server: ```bash sudo bash scripts/harden_gitea.sh --config /path/to/app.ini ```
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
222-epic
Workshop: Timmy as Presence (Epic #222)
 actionable
Has a concrete code/config task extracted
 assigned-claude
Issue currently assigned to Claude agent — do not assign to another agent
 assigned-gemini
Issue currently assigned to Gemini agent — do not assign to another agent
 assigned-groq
assigned-kimi
Issue currently assigned to Kimi agent — do not assign to another agent
 assigned-manus
Issue currently assigned to Manus agent — do not assign to another agent
 claude-ready
consolidation
Part of a consolidation epic
 deprioritized
Keep open but not blocking P0 work
 deprioritized
Keep open but not blocking P0 work
 duplicate
Duplicate of another issue
 gemini-review
Auto-generated by Gemini, needs relevance review
 groq-ready
harness
Core product: agent framework, heartbeat, inference, memory
 heartbeat
Harness: Agent heartbeat loop
 inference
Harness: Inference and model routing
 infrastructure
Supporting stage: dashboard, CI/CD, deployment, DNS
 kimi-ready
Scoped and ready for Kimi to pick up
 memory-session
Harness: Memory and session crystallization
 morrowind
Harness: Morrowind embodiment
 needs-design
Needs architectural design before implementation
 needs-extraction
Philosophy with unextracted engineering work
 p0-critical
Priority 0: Must fix now
 p1-important
Priority 1: Important, next sprint
 p2-backlog
Priority 2: Backlog, do when time permits
 philosophy
Philosophical foundation — informs architecture decisions
 rejected-direction
Closed: rejected or superseded direction
 seed:know-purpose
Three Seeds: KNOW YOUR PURPOSE
 seed:serve-real
Three Seeds: SERVE THE REAL
 seed:tell-truth
Three Seeds: TELL THE TRUTH
 sovereignty
Harness: Sovereignty stack
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
Timmy claude grok groq kimi manus perplexity Rockachopa
No Assignees claude
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: Rockachopa/Timmy-time-dashboard#988
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?