highpost

I just starred this project on GitHub and I will be trying it out.

But I have to say that it hits the trifecta of annoyance:

  - written with the help of an AI (I hate the pejorative use of the term vibe-coded)
  - written in Rust
  - non-GPL

(clutches pearls)

Forgejo is an open-source GitHub clone written in Go. I wanted to run Forgejo on an old Mac mini at home and make it remotely accessible through Tailscale. So, I built Forgejo Appliance: an opinionated blueprint based on an OrbStack VM running on macOS with Ubuntu Server, PostgreSQL and the tsbridge reverse proxy.

I think of Forgejo Appliance as an open-source black box. It makes the Forgejo service available through a web interface, but beyond that, it’s pretty opaque. The VM is designed to be ephemeral (torn down and rebuilt for updates). Internally, it’s a group of three server apps tied together with UNIX sockets. This avoids the DNS and security headaches of exposing local TCP/IP ports. Like a managed cloud app, you can’t even connect to it with SSH.

It wasn’t all fun and games. Navigating through the host and guest restrictions felt like threading a needle:

  - The macOS Security Framework restricts Keychain access to local shell sessions.
  - Let’s Encrypt has a strict rate limit for certificate requests, which makes tearing down and rebuilding ephemeral VMs difficult.
  - TLS certificates are usually managed as small directories of files. To persist them across ephemeral boots, I tar-ed, compressed, and base64-encoded the whole directory into a small string and stuffed it directly into Apple Keychain.
  - When testing isn’t going well, you can easily stack up ghost Tailscale nodes and trigger MagicDNS collisions.

Forgejo Appliance stores its secrets in Apple Keychain, uses Google Workspace SMTP for notifications, and uses BorgBackup with rsync.net for remote backups. The end result is secure (thank you, Tailscale) and reliable.

We went to Peace Arch Park several times during COVID to visit relatives in Canada. And then I noticed the tents on the eastern edge of the park. What's that all about? I called it the End Zone. Couples separated by the border would meet there. One park ranger said he saw things he couldn't unsee...

That was ... easy.

The macOS app manages the host Tailscale service, while this example demonstrates how to connect with a *macOS container* using Tailscale SSH based on the Tailscale service under userspace networking mode. This gives the container its own dedicated Tailnet IP and identity without needing to port-forward through the host.

edit: For example, I can create a container on my MacBook to run an application. A colleague *in my Tailnet* can then connect to this container to interact with that application from a coffeeshop or airliner while not exposing the rest of my MacBook.

you can be both.

I wish them the very best, but I don't understand why it doesn't handle OpenDocument Format (ODF) natively.