From 4e32bed8a6fbc15f2aa3a221adb52fd089bf54be Mon Sep 17 00:00:00 2001
From: John <me@johnnynator.dev>
Date: Sun, 4 Oct 2026 19:14:54 +0200
Subject: [PATCH] gitea: disable non oauth signing/registration

---
 roles/gitea/templates/gitea.conf.j2 | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/roles/gitea/templates/gitea.conf.j2 b/roles/gitea/templates/gitea.conf.j2
index 39765b8..a2727f7 100644
--- a/roles/gitea/templates/gitea.conf.j2
+++ b/roles/gitea/templates/gitea.conf.j2
@@ -17,11 +17,15 @@ HOST = /tmp/
 NAME = gitea
 USER = _gitea
 PASSWD =
+[admin]
+EXTERNAL_USER_DISABLE_FEATURES = manage_mfa
 [security]
 INSTALL_LOCK = true
 SECRET_KEY = {{ gitea_secret_key }}
 INTERNAL_TOKEN = {{ gitea_internal_token }}
 [camo]
+[oauth2_client]
+ENABLE_AUTO_REGISTRATION = true
 [oauth2]
 ENABLED = true
 JWT_SECRET = {{ gitea_jwt_secret }}
@@ -49,6 +53,8 @@ REPLY_TO_ADDRESS = git+%{token}@cosmosim.dev
 COOKIE_SECURE = true
 [git]
 [service]
+ENABLE_PASSWORD_SIGNIN_FORM = false
+ENABLE_PASSKEY_AUTHENTICATION = false
 REGISTER_EMAIL_CONFIRM = true
 ENABLE_NOTIFY_MAIL = true
 DISABLE_REGISTRATION = true