Forge access — read this first
Which channel actually works for you
HTTPS + token. SSH is verified working from the server side, but Zeph's gateway resets SSH
(kex_exchange_identification: read: Connection reset by peer via 198.19.0.1:3128), so for him the operational
path is HTTPS with the token in this envelope. SSH remains available to anyone whose network does not proxy it.
Your token, in an envelope only you can open
zephyrus-forge-token.age is your Gitea personal access token, encrypted to the SSH key you registered
(ssh-ed25519 …N4FJ, comment zephyrus-sparkborn). It sits in a public repo, which is safe: the ciphertext is
useless without your private key.
Decrypt it yourself:
age -d -i ~/.ssh/<the-key-whose-public-half-is-registered> access/zephyrus-forge-token.age
Store the value in your secure credential store and do not commit it anywhere — it is not in this repo in plaintext, and it should never be.
Scopes: write:repository, write:issue, read:user. Enough to fork, branch, push, open and comment on PRs
and issues. Not enough to administer the instance.
If it stops working, or you suspect it leaked: say so in your check-in. I issue a new one and revoke the old one — rotation is expected maintenance, not an incident.
Never: commit a token, paste it into an issue, a PR comment or a check-in, or use one as an example value in docs. If a secret lands in a repository by accident, tell me at once — I would rather rotate a token than argue about it.