It’s in German. Nonetheless, there is certainly a shortage of forgejo/gitea instances with an onion service so hopefully this encourages people to fill the gap.

The git clone command assumes everyone has unlimited fixed-rate Internet. I have no Internet. Sometimes I’m on a friend’s measured rate uplink with a tight quota. So I cannot be blindly fetching a repository that blows copious amounts of quota.

Fuck surprises. They suck. How do I inform myself of the consequences of git clone before running it?

HTTP has a useful facility: the content-length: header. So this gives a way to get the size of a single web object before fetching:

curl -L --head "$url" | grep -i content-length

If git count-objects were sophisticated enough, it could perhaps theoretically get a tree of objects without their contents and perform the above header check on each object.

The only viable option is apparently to run git clone in a remote shell account just for the purpose of running git count-objects, then delete the clone and rerun the clone op locally if the size is acceptible.

Any better ideas?

I need a repo that should not be publicly findable with explore. Does this mean the repo necessarily must be private? When it’s private, I cannot simply give an URL to friends to browse. IIUC, they must create an account, tell me their username, then I must add their username as a collaborator. That’s way overkill.

I just want to give out an URL that will reach the content when visited. It should not be discoverable by the general public but we are not talking state secrets. It must be hassle-free for read-only access. When browsing to a private repo (when logged out), it gives a 404 error.

update: A hack comes to mind: I could create a 2nd account on the same server, make that account a collaborator, then share the password to that acct with friends.

The link goes to my findings, which are simply a count of CTAN listings.

The gitea user settings have a “hide email address” tickbox. Then it suggests using username@noreply.gitea-instance.tld as the email address for commits.

What happens when someone uses the address? It seems a gitea admin could have an mail server on noreply.gitea-instance.tld, which could do anything the admin wants, such as:

• forward the mail to the users secret address (though the “noreply” string would be deceptive in this case)
• refuse all msgs on connect
• accept msgs then auto-reply with a msg
• accept then blackhole msgs
• have no mail server at all

Is that the case? There is no universal expectation of what happens with email in that case?

This bug report shows the initial discussion.. though it does not answer my question.

There are two common methods for starting a new repository: using git init or git clone. This post demonstrates the former.

Preconditions:

• SSH, git, and Tor are installed
• a Tor SOCKS proxy listens on port 9050 (i.e. SocksPort 9050 in /etc/tor/torrc)
• (optional) You have an HTTP proxy such as privoxy listening on port 8118

Create an accout and a repository on a gitea instance. The following parameters are placeholders assumed for these instructions:

forge: gitea
instance: git.platypush.tech (many choices)
repo name: tuneInTurnOffDropOut
username: timLeary

Locally, make a new directory and go there. CLI steps from there:

$ git init
$ git config http.proxy http://127.0.0.1:8118/; # optional; only useful if you later want/need to switch to HTTP and you run an HTTP proxy over Tor
$ git config credential.helper store; # optional; only useful to store your creds if you later want/need to forgo SSH keys
$ git config user.name timLeary

Visit your settings (e.g. https://git.platypush.tech/user/settings), ☑ Hide email address, and see what special address is supplied. Use that in the next step.

(update) some gitea servers have this tickbox but they do not mention a special email address. 🤷

$ git config user.email timLeary@noreply.git.platypush.tech; # get this from account settings, or use an email address of your choice

Visit your new repo (e.g. https://git.platypush.tech/timLeary/tuneInTurnOffDropOut) which will show a “quick guide” because it’s an empty repo. Highlight “SSH“ to see the SSH username to the left of the “@”. Remember that for the next step.

$ git remote add origin forgejo@platy:timLeary/tuneInTurnOffDropOut.git; # ⚠ Do not use the gitea-suggested parameter verbatim; just grab the git API username (generally “git” or “forgejo”) from the previous step to prefix into this format. “platy” is an arbitrary string of your choice.
$ git checkout -b main; # “master” is a popular historic variation to “main”, but main is the woke gitea default so we’ll run with it
$ printf '%s\n' 'Put a blurb about the project here.' > README.md
$ git add README.md
$ git commit -m "first commit"
$ ssh-keygen -t rsa -N '' -C 'timLeary at platypush' -f ~/.ssh/id_rsa_platypush-timLeary; # the "-C $comment" parameter is optional
$ wl-copy < ~/.ssh/id_rsa_platypush-timLeary.pub; # Use your preferred way to get the pubkey in your clipboard. wl-copy is the Wayland-specific way to do that.

git.platypush.tech → settings → SSH/GPG Keys → Manage SSH Key → add key → (paste from clipboard)

$ ssh-keygen -l -f ~/.ssh/id_rsa_platypush-timLeary; # optional check; compare the local sha256 fingerprint to that in platypush/timLeary web account settings
$ cat >> ~/.ssh/config <<eof
host platy
     hostname     git.platypush.tech
     ForwardX11   no
     ProxyCommand connect -4 -S 127.0.0.1:9050 \$(tor-resolve %h 127.0.0.1:9050) %p
     IdentityFile /home/$(whoami)/.ssh/id_rsa_platypush-timLeary
eof

$ git push -u origin main

Note that the host value in ~/.ssh/config is any identifier you want. But it must match the token between @ and : in the git remote add origin command. I chose platy in the example.

Benefits

The beauty of this configuration is that you never need to prefix your git commands with torsocks going forward. All cloud ops will automatically tunnel over Tor. In fact, using torsocks would fail with this config.

Drawbacks

• Probably does not work on gitea onion instances (ouch!)
• Some gitea instances refuse SSH and/or Tor connections, but they are opaque about it. In those cases you get error messages that lie. Switching to HTTP is the workaround.

Onion workaround (update: tested and fails)

How can this be done for onion hosts? Would this work?:

$ sudo tee -a /etc/tor/torrc <<< 'mapaddress 192.168.1.25 hsdtecd4h2b5z732pvkg2yw3746epap4qusgvjjze6nhmfcdpz2suiad.onion'
$ cat >> ~/.ssh/config <<eof
host nogafam-onion
     hostname     192.168.1.25
     ForwardX11   no
     ProxyCommand connect -4 -S 127.0.0.1:9050 %h %p
     IdentityFile /home/$(whoami)/.ssh/id_rsa_nogafam
eof

Or is there a better way?

(note that nogafam.es is not a good example for testing because they block SSH deliberately)

update: the above stanza does not work.

Improvements?

Any feedback for improvements is welcome.

I need to start a project in the cloud for collaboration. Normally gitea would be the answer. But there are some binary blobs, like images (logos, icons, etc).

I think most ppl just say “fuck it, I will put these binary objects that do not need version control under version control, just to get them in the same place”.

Is there a smarter approach?