From da25d78c21b53f0320511b36cd337df11537588e Mon Sep 17 00:00:00 2001
From: ryuuseijin <ryuuseijin@fastmail.com>
Date: Mon, 17 Aug 2026 23:01:01 +0800
Subject: [PATCH] better prompts

---
 README.md     |  7 ++++---
 fly.toml.tmpl |  2 +-
 setup.sh      | 16 ++++++++++++++++
 3 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/README.md b/README.md
index 9a3af18..8dad2cc 100644
--- a/README.md
+++ b/README.md
@@ -13,8 +13,9 @@ Install and authenticate the [Fly CLI](https://fly.io/docs/flyctl/install/), the
 The script prompts for:
 
 - A globally unique Fly app name
-- A Fly region
+- A [Fly region](https://fly.io/docs/reference/regions/)
 - The initial Forgejo admin username and email
+- Whether visitors must sign in before viewing Forgejo
 - Whether to enable Caddy HTTP basic auth and, if enabled, its single username and password
 
 It creates the Fly app, writes the generated `fly.toml`, stores credentials as Fly secrets, and deploys Forgejo with a 10 GB persistent volume. The Forgejo admin password is generated securely and printed before and after deployment. Save it when displayed.
@@ -25,10 +26,10 @@ The app is available at `https://<appname>.fly.dev/`. Registration is disabled,
 
 Two independent settings restrict access by default:
 
-- Forgejo's `GITEA__service__REQUIRE_SIGNIN_VIEW` is set to `true`, so anonymous visitors cannot view Forgejo content.
+- Forgejo's `GITEA__service__REQUIRE_SIGNIN_VIEW` prevents anonymous visitors from viewing Forgejo content when enabled during setup.
 - Caddy basic auth is enabled when both `CADDY_BASIC_AUTH_USERNAME` and `CADDY_BASIC_AUTH_PASSWORD` are set. The setup script can configure them for you. Git HTTP endpoints and the package API remain outside Caddy authentication so Git and package clients can authenticate directly with Forgejo.
 
-To make the instance publicly viewable, both controls must be disabled: leave the Caddy credentials unset and change `GITEA__service__REQUIRE_SIGNIN_VIEW` to `false` in the generated `fly.toml`, then run `fly deploy`.
+To make the instance publicly viewable, answer no to both access-control prompts during setup. For an existing instance, leave the Caddy credentials unset, change `GITEA__service__REQUIRE_SIGNIN_VIEW` to `false` in the generated `fly.toml`, then run `fly deploy`.
 
 To enable or change Caddy authentication later:
 
diff --git a/fly.toml.tmpl b/fly.toml.tmpl
index e341f99..cdb7db2 100644
--- a/fly.toml.tmpl
+++ b/fly.toml.tmpl
@@ -22,7 +22,7 @@ swap_size_mb = 1024
   GITEA__server__ROOT_URL = 'https://__APP_NAME__.fly.dev/'
   GITEA__server__START_SSH_SERVER = 'false'
   GITEA__service__DISABLE_REGISTRATION = 'true'
-  GITEA__service__REQUIRE_SIGNIN_VIEW = 'true'
+  GITEA__service__REQUIRE_SIGNIN_VIEW = '__REQUIRE_SIGNIN_VIEW__'
   GITEA__session__COOKIE_NAME = 'forgejo_session'
   GITEA__session__SAME_SITE = 'strict'
 
diff --git a/setup.sh b/setup.sh
index 68cdd04..63b7820 100755
--- a/setup.sh
+++ b/setup.sh
@@ -38,6 +38,7 @@ case "$app_name" in
         ;;
 esac
 
+printf 'Available Fly regions: https://fly.io/docs/reference/regions/\n'
 prompt primary_region 'Fly primary region' 'nrt'
 case "$primary_region" in
     *[!a-z0-9]*)
@@ -63,6 +64,20 @@ if [[ "$admin_email" != *@* ]]; then
     exit 1
 fi
 
+require_signin_view=true
+read -r -p 'Force visitors to sign in before viewing Forgejo? [Y/n]: ' force_forgejo_login
+case "$force_forgejo_login" in
+    ''|y|Y|yes|YES)
+        ;;
+    n|N|no|NO)
+        require_signin_view=false
+        ;;
+    *)
+        printf 'Please answer yes or no.\n' >&2
+        exit 1
+        ;;
+esac
+
 caddy_username=
 caddy_password=
 read -r -p 'Enable Caddy HTTP basic auth? [y/N]: ' enable_caddy_auth
@@ -100,6 +115,7 @@ admin_password="$(openssl rand -base64 24 | tr -d '\n')"
 sed \
     -e "s/__APP_NAME__/$app_name/g" \
     -e "s/__PRIMARY_REGION__/$primary_region/g" \
+    -e "s/__REQUIRE_SIGNIN_VIEW__/$require_signin_view/g" \
     "$template" > "$config"
 
 printf '\nGenerated Forgejo admin credentials:\n'