Description

Forgejo integration in Sztab requires repositories to be accessed over HTTPS. Sztabina (the Go microservice that probes git repos for Sztab) intentionally rejects non-HTTPS Git URLs to prevent credentials (username / token) from being transmitted in cleartext.

Currently, Forgejo is exposed only via HTTP in the development / test setup. As a result:

• Repository creation and cloning work
• Default branch discovery fails
• Downstream PR and commit introspection cannot function

To complete Forgejo support, an HTTPS reverse proxy must be placed in front of Forgejo.

This is an infrastructure task, not a functional defect in Forgejo or Sztabina.

Root Cause

• Sztabina enforces HTTPS-only Git URLs by design
• Forgejo is running on plain HTTP (port 3000)
• No TLS termination exists in the current Docker Compose setup

Proposed Solution

I prefer to use Caddy as the lightweight reverse proxy:

• Terminate TLS at Caddy
• Forward traffic to Forgejo on port 3000
• Configure Forgejo ROOT_URL to HTTPS
• Use self-signed for local testing

Acceptance Criteria

• Forgejo accessible via HTTPS
• git clone https://… works for Forgejo repositories
• Sztabina successfully resolves default branch via HTTPS Git URL
• No credentials transmitted over HTTP
• Existing HTTP access either disabled or redirected to HTTPS

Notes

This task completes Forgejo readiness for:

• Repository discovery
• Default branch probing
• Upcoming pull request and commit features

Forgejo is functional now; but without TLS, it cannot be used in production.