forgejo: fix admin creation and reverse-proxy handling from review

Review of the initial chart turned up one blocker and several correctness gaps:

- `just create-admin` could never work. `admin user create` does not prompt; it
  exits with "must set either password or random-password flag". With the
  installer locked and registration disabled that recipe was the only way into
  the instance, so first login was impossible. Use --random-password, which
  prints the generated password once, rather than passing one on the command
  line where it would reach shell history and ps.

- SSH_DOMAIN advertised code.f3s.buetow.org, but that name resolves to the
  OpenBSD gateways (443 only) and *.f3s.lan points at the CARP storage VIP, not
  a k3s node. Every clone URL Forgejo rendered would have been unreachable.
  Advertise r0.lan.buetow.org, which actually answers on the NodePort.

- No REVERSE_PROXY_TRUSTED_PROXIES, so behind relayd -> Traefik every request
  was attributed to the Traefik pod IP: real client IPs absent from the audit
  trail and per-IP rate limiting defeated, on an internet-facing instance.

- Pin both PVCs with volumeName. The 1Gi config claim also matched the 20Gi
  data PV, leaving the choice to the binder's smallest-sufficient heuristic.

README: add the gogios task to the frontends deploy (the new host otherwise
gets no TLS/HTTP checks); drop the false claim that pushing alone deploys the
Application, since nothing watches f3s/argocd-apps/; keep .nfs-sentinel at 0644
instead of sweeping it into a recursive 0750; note that the real certificate is
only issued on the gateway holding the DNS master IP.

Still not activated. Re-verified: helm template renders, and all 9 objects pass
kubectl apply --dry-run=server.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

1 files changed, 9 insertions, 2 deletions

diff --git a/f3s/forgejo/Justfile b/f3s/forgejo/Justfile
index ee78a62..e7c4cad 100644
--- a/f3s/forgejo/Justfile
+++ b/f3s/forgejo/Justfile
@@ -34,10 +34,17 @@ restart:
     @echo "Restarting forgejo..."
     kubectl rollout restart -n {{NAMESPACE}} deployment/forgejo
 
-# One-time after the first successful start. Prompts for the password.
+# One-time after the first successful start. This is the ONLY way in: the web
+# installer is locked and registration is disabled.
+# `admin user create` does not prompt -- without --password or --random-password
+# it exits with "must set either password or random-password flag". Use a
+# generated password (printed once, to stdout) rather than passing one on the
+# command line where it would land in shell history and ps output.
 create-admin username="paul" email="paul.buetow@gmail.com":
+    @echo "The generated password is printed below -- copy it now, it is shown only once."
     kubectl exec -n {{NAMESPACE}} -it deploy/forgejo -- \
-        forgejo admin user create --admin --username {{username}} --email {{email}}
+        forgejo admin user create --admin --username {{username}} --email {{email}} \
+        --random-password
 
 # Open a shell as the git user inside the running instance.
 shell: