Forgejo

License	FOSS problems	Maintenance	SSO	Users	Tested
MITPermissive license. Preserve the copyright notice. Applies only to the covered code — your surrounding project can stay under any license.	—	Active	✅	Unlimited	✅

Evaluation

What it is

Forgejo is a self-hosted git forge — a GitHub alternative for hosting code repositories, issues, pull requests, and CI/CD pipelines. It's a community fork of Gitea, governed independently and fully FOSS. The interface and feature set are very close to GitHub.

Why it could be useful

The obvious use is version control for code, but it's also useful as the backbone for anything that benefits from git — documentation sites, configuration files, static site content. Coolify can deploy directly from a Forgejo repository, making it a natural pairing: push to Forgejo, Coolify rebuilds and deploys automatically. It also acts as a web-based editor for non-technical contributors who can edit markdown files through the browser without needing a local git setup.

Why not to go for it

It adds operational overhead — another service to maintain, back up, and keep updated. If the only use case is deploying a Docusaurus site and there's no active software development happening, it may be more than needed. GitHub or a simple direct deploy from a local machine might be a lighter alternative. That said, having a self-hosted git forge in place also lowers the barrier to further development — it's a foundation that makes it easier to build and deploy new things over time.

Setup

1. Add DNS records pointing code.<domain> to the server:

   • A record: code → <ipv4>
   • AAAA record: code → <ipv6>

2. In Coolify, go to New Resource → Service, search for Forgejo, set the domain on the forgejo container (inside the container settings), then deploy.

3. Open https://code.<domain> and complete the initial setup wizard.

Authentik SSO

4. In Authentik, go to Applications → Providers → Create, choose OAuth2/OpenID Provider. Set a name, leave Client Type as Confidential, and add the redirect URI https://code.<domain>/user/oauth2/authentik/callback. Save and note the Client ID and Secret.

5. Go to Applications → Applications → Create and link it to the provider from step 4. Note the application slug. Set the icon field to the base64 data URI:

data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij48cmVjdCB3aWR0aD0iNjQiIGhlaWdodD0iNjQiIGZpbGw9IiMxYTFhMmUiIHJ4PSI4Ii8+PHRleHQgeD0iNTAlIiB5PSI1MCUiIGZvbnQtZmFtaWx5PSJBcmlhbCwgc2Fucy1zZXJpZiIgZm9udC13ZWlnaHQ9ImJvbGQiIGZvbnQtc2l6ZT0iMjgiIGZpbGw9IndoaXRlIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBkb21pbmFudC1iYXNlbGluZT0iY2VudHJhbCI+Uko8L3RleHQ+PC9zdmc+

6. In Forgejo, go to Site Administration → Authentication Sources → Add Authentication Source:

Field	Value
Type	OAuth2
Provider	OpenID Connect
Name	authentik
Client ID	from Authentik provider
Client Secret	from Authentik provider
Auto Discovery URL	https://auth.<domain>/application/o/<slug>/.well-known/openid-configuration

7. Set the following environment variables on the Forgejo container in Coolify to enable auto-registration:

Variable	Value
FORGEJO__service__DISABLE_REGISTRATION	false
FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION	true
FORGEJO__oauth2_client__ENABLE_AUTO_REGISTRATION	true
FORGEJO__oauth2_client__REGISTER_EMAIL_CONFIRM	false
FORGEJO__oauth2_client__UPDATE_AVATAR	true

Restart the container after saving.

8. To disable password login and OpenID entirely (Authentik SSO only), add these variables and restart. Requires Forgejo 15+:

Variable	Value
FORGEJO__service__ENABLE_INTERNAL_SIGNIN	false
FORGEJO__service__ENABLE_BASIC_AUTHENTICATION	false
FORGEJO__openid__ENABLE_OPENID_SIGNIN	false
FORGEJO__service__SHOW_REGISTRATION_BUTTON	false

On first login, Forgejo shows a registration or account linking step after the Authentik redirect — this is part of the OAuth flow, not open registration.

note

The Coolify service template ships an outdated image. Set the image tag to 15 in the compose before deploying.