From 58e70821dd091702a2c21aa7985ca29f1f86b697 Mon Sep 17 00:00:00 2001
From: s-prechtl <stefan@tague.at>
Date: Tue, 24 Mar 2026 10:00:02 +0100
Subject: [PATCH] feat: hope for the best

---
 hosts/hitsugibune/forgejo.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/hosts/hitsugibune/forgejo.nix b/hosts/hitsugibune/forgejo.nix
index 62f3393..811de32 100644
--- a/hosts/hitsugibune/forgejo.nix
+++ b/hosts/hitsugibune/forgejo.nix
@@ -32,7 +32,14 @@ in
         HTTP_PORT = 3000;
       };
       # You can temporarily allow registration to create an admin user.
-      service.DISABLE_REGISTRATION = true; 
+      service = {
+        DISABLE_REGISTRATION = false;
+        ALLOW_ONLY_EXTERNAL_REGISTRATION = true; # only SSO, no local signups
+      };
+      oauth2_client = {
+        ENABLE_AUTO_REGISTRATION = true; # auto-create account on first SSO login
+        ACCOUNT_LINKING = "auto";        # auto-link if email already exists
+      };
       # Add support for actions, based on act: https://github.com/nektos/act
       actions = {
         ENABLED = true;