better prompts

README.md

@@ -13,8 +13,9 @@ Install and authenticate the [Fly CLI](https://fly.io/docs/flyctl/install/), the
 The script prompts for:
 
 - A globally unique Fly app name
-- A Fly region
+- A [Fly region](https://fly.io/docs/reference/regions/)
 - The initial Forgejo admin username and email
+- Whether visitors must sign in before viewing Forgejo
 - Whether to enable Caddy HTTP basic auth and, if enabled, its single username and password
 
 It creates the Fly app, writes the generated `fly.toml`, stores credentials as Fly secrets, and deploys Forgejo with a 10 GB persistent volume. The Forgejo admin password is generated securely and printed before and after deployment. Save it when displayed.
@@ -25,10 +26,10 @@ The app is available at `https://<appname>.fly.dev/`. Registration is disabled,
 
 Two independent settings restrict access by default:
 
-- Forgejo's `GITEA__service__REQUIRE_SIGNIN_VIEW` is set to `true`, so anonymous visitors cannot view Forgejo content.
+- Forgejo's `GITEA__service__REQUIRE_SIGNIN_VIEW` prevents anonymous visitors from viewing Forgejo content when enabled during setup.
 - Caddy basic auth is enabled when both `CADDY_BASIC_AUTH_USERNAME` and `CADDY_BASIC_AUTH_PASSWORD` are set. The setup script can configure them for you. Git HTTP endpoints and the package API remain outside Caddy authentication so Git and package clients can authenticate directly with Forgejo.
 
-To make the instance publicly viewable, both controls must be disabled: leave the Caddy credentials unset and change `GITEA__service__REQUIRE_SIGNIN_VIEW` to `false` in the generated `fly.toml`, then run `fly deploy`.
+To make the instance publicly viewable, answer no to both access-control prompts during setup. For an existing instance, leave the Caddy credentials unset, change `GITEA__service__REQUIRE_SIGNIN_VIEW` to `false` in the generated `fly.toml`, then run `fly deploy`.
 
 To enable or change Caddy authentication later:
 

fly.toml.tmpl

@@ -22,7 +22,7 @@ swap_size_mb = 1024
   GITEA__server__ROOT_URL = 'https://__APP_NAME__.fly.dev/'
   GITEA__server__START_SSH_SERVER = 'false'
   GITEA__service__DISABLE_REGISTRATION = 'true'
-  GITEA__service__REQUIRE_SIGNIN_VIEW = 'true'
+  GITEA__service__REQUIRE_SIGNIN_VIEW = '__REQUIRE_SIGNIN_VIEW__'
   GITEA__session__COOKIE_NAME = 'forgejo_session'
   GITEA__session__SAME_SITE = 'strict'
 

setup.sh

@@ -38,6 +38,7 @@ case "$app_name" in
         ;;
 esac
 
+printf 'Available Fly regions: https://fly.io/docs/reference/regions/\n'
 prompt primary_region 'Fly primary region' 'nrt'
 case "$primary_region" in
     *[!a-z0-9]*)
@@ -63,6 +64,20 @@ if [[ "$admin_email" != *@* ]]; then
     exit 1
 fi
 
+require_signin_view=true
+read -r -p 'Force visitors to sign in before viewing Forgejo? [Y/n]: ' force_forgejo_login
+case "$force_forgejo_login" in
+    ''|y|Y|yes|YES)
+        ;;
+    n|N|no|NO)
+        require_signin_view=false
+        ;;
+    *)
+        printf 'Please answer yes or no.\n' >&2
+        exit 1
+        ;;
+esac
+
 caddy_username=
 caddy_password=
 read -r -p 'Enable Caddy HTTP basic auth? [y/N]: ' enable_caddy_auth
@@ -100,6 +115,7 @@ admin_password="$(openssl rand -base64 24 | tr -d '\n')"
 sed \
     -e "s/__APP_NAME__/$app_name/g" \
     -e "s/__PRIMARY_REGION__/$primary_region/g" \
+    -e "s/__REQUIRE_SIGNIN_VIEW__/$require_signin_view/g" \
     "$template" > "$config"
 
 printf '\nGenerated Forgejo admin credentials:\n'