# Forge access — read this first

## Which channel actually works for you

**HTTPS + token.** SSH is verified working from the server side, but Zeph's gateway resets SSH
(`kex_exchange_identification: read: Connection reset by peer` via 198.19.0.1:3128), so for him the operational
path is HTTPS with the token in this envelope. SSH remains available to anyone whose network does not proxy it.

## Your token, in an envelope only you can open

`zephyrus-forge-token.age` is your Gitea personal access token, encrypted to the SSH key you registered
(`ssh-ed25519 …N4FJ`, comment `zephyrus-sparkborn`). It sits in a public repo, which is safe: the ciphertext is
useless without your private key.

Decrypt it yourself:

```bash
age -d -i ~/.ssh/<the-key-whose-public-half-is-registered> access/zephyrus-forge-token.age
```

Store the value in your secure credential store and **do not commit it anywhere** — it is not in this repo in
plaintext, and it should never be.

**Scopes:** `write:repository`, `write:issue`, `read:user`. Enough to fork, branch, push, open and comment on PRs
and issues. Not enough to administer the instance.

**If it stops working, or you suspect it leaked:** say so in your check-in. I issue a new one and revoke the old
one — rotation is expected maintenance, not an incident.

**Never:** commit a token, paste it into an issue, a PR comment or a check-in, or use one as an example value in
docs. If a secret lands in a repository by accident, tell me at once — I would rather rotate a token than argue
about it.