id: 0609d89ff61e436b993746ca7b11a2e8
parent_id: 0c1e140a415f4f4187e5acec77e7485c
item_type: 1
item_id: a69d84030b1742ffb63ff3248a02cb92
item_updated_time: 1787986566538
title_diff: "[]"
body_diff: "[{\"diffs\":[[0,\" policy \"],[1,\"and jail/privilege model \"],[0,\"added 20\"]],\"start1\":148,\"start2\":148,\"length1\":16,\"length2\":41},{\"diffs\":[[0,\"6-08-29.\"],[1,\"\\\n>\"],[0,\" Mission\"]],\"start1\":190,\"start2\":190,\"length1\":16,\"length2\":18},{\"diffs\":[[0,\" Hetzner\"],[-1,\"\\\n>\"],[0,\" machine\"]],\"start1\":219,\"start2\":219,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\", set up the\"],[1,\"\\\n>\"],[0,\" container p\"]],\"start1\":256,\"start2\":256,\"length1\":24,\"length2\":26},{\"diffs\":[[0,\"e proxy,\"],[-1,\"\\\n>\"],[0,\" Forgejo\"]],\"start1\":297,\"start2\":297,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"tionally\"],[1,\"\\\n>\"],[0,\" Jenkins\"]],\"start1\":332,\"start2\":332,\"length1\":16,\"length2\":18},{\"diffs\":[[0,\"the real\"],[-1,\"\\\n>\"],[0,\" topolog\"]],\"start1\":374,\"start2\":374,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"basement\"],[1,\"\\\n>\"],[0,\" server \"]],\"start1\":405,\"start2\":405,\"length1\":16,\"length2\":18},{\"diffs\":[[0,\"anonical\"],[-1,\"\\\n>\"],[0,\" git hub\"]],\"start1\":453,\"start2\":453,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\"nkins on\"],[1,\"\\\n>\"],[0,\" bare re\"]],\"start1\":480,\"start2\":480,\"length1\":16,\"length2\":18},{\"diffs\":[[0,\"c mirror\"],[-1,\"\\\n>\"],[0,\" for som\"]],\"start1\":529,\"start2\":529,\"length1\":18,\"length2\":16},{\"diffs\":[[0,\" only.\\\n\\\n\"],[1,\"**Forgejo jail & privilege model (DECIDED 2026-08-29):** Forgejo runs as an\\\nUNPRIVILEGED `forgejo` user inside a service jail (Bastille or plain\\\njail.conf; ZFS dataset per jail if ZFS). Host root/doas only manages the\\\njail; root inside the jail only for pkg administration; the daemon never\\\nruns as root. Jail networking = IP alias on the LAN interface (own address,\\\ngit-SSH on its port 22, no VNET needed); jail.conf hardening: restrictive\\\ndevfs_ruleset, allow.raw_sockets=0, exec_clean, autostart. Rationale: the\\\nbox also runs Jenkins and the SSH path for ALL canonical repos — containment\\\nlimits compromise blast radius to one jail. Install: check `pkg search\\\nforgejo` / ports first (www/gitea exists for sure); worst case build from\\\nsource (Go compiles natively). Jenkins: host for now, own jail later if\\\nwanted.\\\n\\\n\"],[0,\"## FreeB\"]],\"start1\":2521,\"start2\":2521,\"length1\":16,\"length2\":834},{\"diffs\":[[0,\"ejo \"],[-1,\"native binary in a jail\"],[1,\"service jail per the privilege model above\"],[0,\"; import\"],[1,\"\\\n     \"],[0,\" bar\"]],\"start1\":5425,\"start2\":5425,\"length1\":39,\"length2\":64},{\"diffs\":[[0,\"pos; set\"],[-1,\"\\\n     \"],[0,\" push mi\"]],\"start1\":5493,\"start2\":5493,\"length1\":22,\"length2\":16},{\"diffs\":[[0,\"keyfob +\"],[1,\"\\\n     \"],[0,\" super-m\"]],\"start1\":5542,\"start2\":5542,\"length1\":16,\"length2\":22},{\"diffs\":[[0,\" private\"],[-1,\"\\\n     \"],[0,\" → Hetzn\"]],\"start1\":5569,\"start2\":5569,\"length1\":22,\"length2\":16}]"
metadata_diff: {"new":{},"deleted":[]}
encryption_cipher_text: 
encryption_applied: 0
updated_time: 2026-08-29T06:59:34.506Z
created_time: 2026-08-29T06:59:34.506Z
is_locked: 0
type_: 13