Install

Configuration

Coolify's Forgejo service template — the compose it deploys, for reference:

docker-compose.yaml

services:
  forgejo:
    image: 'codeberg.org/forgejo/forgejo:16'
    environment:
      - SERVICE_URL_FORGEJO_3000
      - 'FORGEJO__server__ROOT_URL=${SERVICE_URL_FORGEJO}'
      - 'FORGEJO__migrations__ALLOWED_DOMAINS=${FORGEJO__migrations__ALLOWED_DOMAINS}'
      - 'FORGEJO__migrations__ALLOW_LOCALNETWORKS=${FORGEJO__migrations__ALLOW_LOCALNETWORKS-false}'
      - USER_UID=1000
      - USER_GID=1000
      - FORGEJO__database__DB_TYPE=postgres
      - FORGEJO__database__HOST=postgresql
      - 'FORGEJO__database__NAME=${POSTGRESQL_DATABASE-forgejo}'
      - FORGEJO__database__USER=$SERVICE_USER_POSTGRESQL
      - FORGEJO__database__PASSWD=$SERVICE_PASSWORD_POSTGRESQL
    volumes:
      - 'forgejo-data:/data'
      - 'forgejo-timezone:/etc/timezone:ro'
      - 'forgejo-localtime:/etc/localtime:ro'
    ports:
      - '22222:22'
    depends_on:
      postgresql:
        condition: service_healthy
    healthcheck:
      test:
        - CMD
        - curl
        - '-f'
        - 'http://127.0.0.1:3000'
      interval: 2s
      timeout: 10s
      retries: 15
  postgresql:
    image: 'postgres:16-alpine'
    volumes:
      - 'forgejo-postgresql-data:/var/lib/postgresql/data'
    environment:
      - 'POSTGRES_USER=${SERVICE_USER_POSTGRESQL}'
      - 'POSTGRES_PASSWORD=${SERVICE_PASSWORD_POSTGRESQL}'
      - 'POSTGRES_DB=${POSTGRESQL_DATABASE}'
    healthcheck:
      test:
        - CMD-SHELL
        - 'pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}'
      interval: 5s
      timeout: 20s
      retries: 10

1. Add DNS records pointing code.<domain> to the server:

   • A record: code → <ipv4>
   • AAAA record: code → <ipv6>

2. In Coolify, go to New Resource → Service, search for Forgejo, set the domain on the forgejo container (inside the container settings), then deploy.

3. Open https://code.<domain> and complete the initial setup wizard.

Authentik SSO

4. In Authentik, go to Applications → Providers → Create, choose OAuth2/OpenID Provider. Set a name, leave Client Type as Confidential, and add the redirect URI https://code.<domain>/user/oauth2/authentik/callback. Save and note the Client ID and Secret.

5. Go to Applications → Applications → Create and link it to the provider from step 4. Note the application slug. Set the icon field to the base64 data URI:

data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NCIgaGVpZ2h0PSI2NCIgdmlld0JveD0iMCAwIDY0IDY0Ij48cmVjdCB3aWR0aD0iNjQiIGhlaWdodD0iNjQiIGZpbGw9IiMxYTFhMmUiIHJ4PSI4Ii8+PHRleHQgeD0iNTAlIiB5PSI1MCUiIGZvbnQtZmFtaWx5PSJBcmlhbCwgc2Fucy1zZXJpZiIgZm9udC13ZWlnaHQ9ImJvbGQiIGZvbnQtc2l6ZT0iMjgiIGZpbGw9IndoaXRlIiB0ZXh0LWFuY2hvcj0ibWlkZGxlIiBkb21pbmFudC1iYXNlbGluZT0iY2VudHJhbCI+Uko8L3RleHQ+PC9zdmc+

6. In Forgejo, go to Site Administration → Authentication Sources → Add Authentication Source:

Field	Value
Type	OAuth2
Provider	OpenID Connect
Name	authentik
Client ID	from Authentik provider
Client Secret	from Authentik provider
Auto Discovery URL	https://auth.<domain>/application/o/<slug>/.well-known/openid-configuration

7. Set the following environment variables on the Forgejo container in Coolify to enable auto-registration:

Variable	Value
FORGEJO__service__DISABLE_REGISTRATION	false
FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION	true
FORGEJO__oauth2_client__ENABLE_AUTO_REGISTRATION	true
FORGEJO__oauth2_client__REGISTER_EMAIL_CONFIRM	false
FORGEJO__oauth2_client__UPDATE_AVATAR	true

Restart the container after saving.

8. To disable password login and OpenID entirely (Authentik SSO only), add these variables and restart. Requires Forgejo 15+:

Variable	Value
FORGEJO__service__ENABLE_INTERNAL_SIGNIN	false
FORGEJO__service__ENABLE_BASIC_AUTHENTICATION	false
FORGEJO__openid__ENABLE_OPENID_SIGNIN	false
FORGEJO__service__SHOW_REGISTRATION_BUTTON	false

On first login, Forgejo shows a registration or account linking step after the Authentik redirect — this is part of the OAuth flow, not open registration.

note

The Coolify service template ships an outdated image. Set the image tag to 15 in the compose before deploying.