Pin
Verify Forgejo’s ED25519 SSH host fingerprint against the independently supplied SHA256 value before trust is stored.
01 / REPRODUCIBLE WORKFLOW
One deliberate path from source to public proof.
Clone
Use the repository-scoped deploy identity to clone the canonical SSH URL into a dedicated, Nginx-readable working tree.
Change
Create feature/forgejo-demo-webserver-05; redesign HTML/CSS and add complete deployment and security documentation.
Commit + push
Commit as the Ai-Admin controller identity, push the named branch, and verify local and remote object IDs match.
Publish
Serve that branch’s working tree through an isolated Nginx vhost with HTTP redirected to Let’s Encrypt HTTPS.
02 / MACHINE ROLES
Separated responsibilities, visible provenance.
forgejo.ai.34a.xyz
Controller Forgejo service and authoritative Git remote in the ai-controller-0.02 namespace.
webserver-05 · 209.97.173.36
Least-privilege clone, checked-out feature branch, dedicated Nginx vhost, TLS termination, and public validation.
03 / SECURITY MODEL
Repository access is narrow; web access is public.
SSH trust
StrictHostKeyChecking yes, a dedicated known-hosts file, and pinned ED25519 fingerprint SHA256:tWKoxIQTFY7y55+mNm0ab07Fwn3XwcntoRKFtGoH77s.
Deploy identity
A local system account owns a mode 0600 private key outside the document root. The key is scoped by Forgejo to this repository; no password or private material is published.
Registration lockdown
Forgejo’s public registration route was checked and reports “Registration is disabled.” Account creation remains administrator-controlled.
Web boundary
Only static repository content is served. Dotfiles are denied, directory listing is off, security headers are set, and unrelated vhosts remain untouched.
04 / VALIDATION RESULTS
Verified at both ends.
- GitExact branch checked out; clean working tree; remote branch object matches local HEAD.PASS
- Change setMultiple tracked files changed: public page, visual system, workflow guide, and security policy.PASS
- WebNginx configuration test passed; safe reload retained active service; HTTP redirects to HTTPS.PASS
- TLSHostname and trusted Let’s Encrypt chain verified; automated renewal timer and dry run checked.PASS
Upstream source: MDN beginner-html-site-styled · Forgejo remote: ai-controller-0.02/beginner-html-site-styled