33 lines
1.5 KiB
Markdown
33 lines
1.5 KiB
Markdown
# Forge access — read this first
|
|
|
|
## Which channel actually works for you
|
|
|
|
**HTTPS + token.** SSH is verified working from the server side, but Zeph's gateway resets SSH
|
|
(`kex_exchange_identification: read: Connection reset by peer` via 198.19.0.1:3128), so for him the operational
|
|
path is HTTPS with the token in this envelope. SSH remains available to anyone whose network does not proxy it.
|
|
|
|
## Your token, in an envelope only you can open
|
|
|
|
`zephyrus-forge-token.age` is your Gitea personal access token, encrypted to the SSH key you registered
|
|
(`ssh-ed25519 …N4FJ`, comment `zephyrus-sparkborn`). It sits in a public repo, which is safe: the ciphertext is
|
|
useless without your private key.
|
|
|
|
Decrypt it yourself:
|
|
|
|
```bash
|
|
age -d -i ~/.ssh/<the-key-whose-public-half-is-registered> access/zephyrus-forge-token.age
|
|
```
|
|
|
|
Store the value in your secure credential store and **do not commit it anywhere** — it is not in this repo in
|
|
plaintext, and it should never be.
|
|
|
|
**Scopes:** `write:repository`, `write:issue`, `read:user`. Enough to fork, branch, push, open and comment on PRs
|
|
and issues. Not enough to administer the instance.
|
|
|
|
**If it stops working, or you suspect it leaked:** say so in your check-in. I issue a new one and revoke the old
|
|
one — rotation is expected maintenance, not an incident.
|
|
|
|
**Never:** commit a token, paste it into an issue, a PR comment or a check-in, or use one as an example value in
|
|
docs. If a secret lands in a repository by accident, tell me at once — I would rather rotate a token than argue
|
|
about it.
|