{"items":[{"cid":"bafyreigcfpdfbpgeoqpa3tu23vz2l4llzkk5kh4xcir73vonkby3dg6vbu","uri":"at://did:plc:i2fgba5nignuw4nccml33wjp/sh.tangled.string/3mlclcz7xi522","value":{"$type":"sh.tangled.string","contents":"## Today — Forgejo private, public repos mirrored to `knot1.tangled.sh`\n\nForgejo holds canonical state. A small bridge translates Forgejo webhook events into AT Proto XRPC calls and signed git pushes against the hosted knot. Forgejo image untouched.\n\n```mermaid\nflowchart LR\n user([\"author\"]) -->|git push| forgejo\n\n subgraph private[\"my forge — private\"]\n forgejo[\"Forgejo
(authoritative)\"]\n webhook[/\"webhook config
per repo or org\"/]\n forgejo --- webhook\n end\n\n webhook -->|push / create / delete
HMAC-signed| bridge\n\n subgraph bridgeBox[\"forgejo-knot-bridge — small Go service\"]\n bridge[\"event handler
user → DID mapping\"]\n keystore[(\"signing keys
per bridged DID\")]\n statedb[(\"bridge.db
repo→DID,
last-mirrored ref\")]\n bridge --- keystore\n bridge --- statedb\n end\n\n bridge -->|sh.tangled.repo.create
Service-Auth JWT| knot\n bridge -->|git push --mirror
Service-Auth Bearer| knot\n\n subgraph hosted[\"knot1.tangled.sh — hosted, third-party\"]\n knot[\"knotserver\"]\n appview[\"tangled.sh appview
(consumes firehose)\"]\n knot -.->|sh.tangled.knot.subscribeRepos
ws firehose| appview\n end\n\n plc[(\"plc.directory\")] -.->|DID document
verifies signing key| knot\n```\n\nThe bridge needs three things from the knot side: knot URL + DID, `server:member` role for the DIDs being published as, and signing keys for those DIDs. From Forgejo it needs a webhook subscription, public-repo read access, and a Forgejo-user → DID mapping.\n\n---\n\n## Tomorrow — Forgejo *is* the knot\n\nInstead of bridging Forgejo *into* a separate knotserver, teach Forgejo to *be* a knot. Same Forgejo binary, same `codeberg.org` hostname, with a module that exposes the knot lexicon surface backed by Forgejo's existing repo storage.\n\n```mermaid\nflowchart LR\n subgraph today[\"Today (above)\"]\n f1[\"Forgejo\"] -->|webhook| b1[\"bridge
(separate service)\"]\n b1 -->|XRPC + git push| k1[\"knotserver
(separate process)\"]\n end\n\n subgraph proposed[\"Forgejo as a knot\"]\n forgejo[\"Forgejo
+ knot-frontend module
(or external sidecar)\"]\n users([\"users
(unchanged web/SSH/REST)\"]) --> forgejo\n forgejo -.->|\"/xrpc/sh.tangled.*
/events firehose
Service-Auth on writes\"| world[\"AT Protocol clients
(tangled.sh appview,
knotmirror, ...)\"]\n end\n\n today -.->|same protocol surface,
different deployment| proposed\n```\n\nThe mapping is mostly mechanical — `sh.tangled.repo.{create,delete,tree,log,branches,diff,...}` lands on Forgejo's existing repo APIs in XRPC envelopes; `sh.tangled.knot.listKeys` reuses Forgejo's user SSH keys; identity reconciles via a `did` field on Forgejo's user table.\n\nNo-trivial part is `sh.tangled.knot.subscribeRepos` — an atproto-style sequenced WebSocket subscription with `cursor` resume and `ConsumerTooSlow` semantics. Forgejo's existing internal event hooks (the same ones driving its ActivityPub outbound delivery) are the natural source; you translate ref-update events into the lexicon's wire format and replay from a `tangled_firehose_events` table on reconnect.","createdAt":"2026-05-08T04:28:54+03:00","description":"Two pictures of how this goes — what I'm building now, and where I'd like to push it.","filename":"forego-knot-gist.md"}}],"total":1}

Strings