Onboarding

Recipes for granting access to a new collaborator. Each section is end-to-end — copy, paste, hand over the credentials.

Add an SFTP user

For someone who needs to drop files via SFTP into the shared bucket.

sudo useradd -m -d /var/sftp/shared -s /sbin/nologin -G sftpusers <name>
sudo passwd <name>                         # interactive — set a strong password

Hand over:

• Host: discourse.<TAILNET>.ts.net (Tailnet) or whichever hostname they reach you at
• Port: 22
• Username: <name>
• Password: (the one you just set)
• Where files go: uploads/ inside the SFTP root — anywhere else is read-only by design.

Test from another machine:

sftp <name>@<host>
sftp> cd uploads
sftp> put localfile.txt

Verify on the host:

ls -l /var/sftp/shared/uploads/localfile.txt
# owner should be <name>:<name>, perms inherited from umask (typically 644)

See SFTP for the full chroot/permissions story.

Share a Filedrop URL

For someone who can't or won't install an SFTP client. No account creation.

echo "Drop URL: https://discourse.<TAILNET>.ts.net/drop/<DROP_TOKEN>/"

Send them that URL. They drag a file onto the page, it streams to /var/sftp/shared/uploads/. If multiple people will use the same URL, they'll see each other's filenames in uploads/ — there's no per-user isolation.

If you want a fresh URL just for them (and to invalidate later without affecting anyone else):

NEW_TOKEN=$(openssl rand -hex 16)
sudo sed -i "s|aa584cd70be711be6f0046304ecd3d12|$NEW_TOKEN|g" /opt/filedrop/nginx/nginx.conf
cd /opt/filedrop && docker compose restart nginx
echo "New URL: https://discourse.<TAILNET>.ts.net/drop/$NEW_TOKEN/"

That rotates the URL for everyone — there's only one drop URL at a time. If you want a separate URL per person, you'd need to add another location block to nginx.conf for each one.

Add a Forgejo user

Registration is disabled — admins create accounts.

Web UI (preferred):

1. Sign in to https://git.thelinuxcast.org/ as an admin.
2. Site Administration → Identity & Access → User Accounts → Create User Account.
3. Username, email, initial password, "must change password on first login" → on.
4. Hand over username + initial password out-of-band.

CLI (when web UI is unavailable):

docker exec -it forgejo forgejo admin user create \
    --username <name> \
    --email <name>@example.com \
    --password <initial-pw> \
    --must-change-password

To make them an admin: add --admin.

To reset a forgotten password:

docker exec -it forgejo forgejo admin user change-password \
    --username <name> --password <new>

Add someone to the Tailnet

For collaborators who need direct access to the box (sftp, ssh on internal ports, services not behind a tunnel).

This is done in the Tailscale admin console, not on the host:

1. Go to https://login.tailscale.com/admin/machines
2. Users → Invite users → email of the new collaborator.
3. They sign up with their own identity (Google/GitHub/etc.) — they appear under their own owner namespace in the tailnet.
4. Their devices then enroll into the same tailnet when they tailscale up.

After they enroll, their devices appear in tailscale status and can resolve discourse.<TAILNET>.ts.net.

ACLs (who can reach what within the tailnet) are also managed in the admin console — currently permissive (everyone in the tailnet can reach everyone). Tighten via the Access Controls page if needed.

Give someone shell access (admin)

For SFTP/Forgejo/Filedrop-only people, don't bother — use the recipes above. This is for someone who actually needs to run commands on the box.

sudo useradd -m -s /bin/bash <name>
sudo usermod -aG sudo <name>               # only if they need sudo
sudo mkdir -p /home/<name>/.ssh
sudo chmod 700 /home/<name>/.ssh
echo '<their-public-key>' | sudo tee /home/<name>/.ssh/authorized_keys
sudo chown -R <name>:<name> /home/<name>/.ssh
sudo chmod 600 /home/<name>/.ssh/authorized_keys

Public-key only — sshd's global PasswordAuthentication is off for everyone except the sftpusers group.

Revoking access

What	How
SFTP user	sudo userdel <name> (files in uploads/ remain — orphaned UID, fine)
Forgejo user	Web UI → admin user list → Delete (or forgejo admin user delete --username)
Filedrop URL	Rotate <DROP_TOKEN> in nginx.conf, restart nginx — kills all current links
Tailnet member	Tailscale admin console → Machines → Remove device, or Users → Suspend
Shell user	sudo userdel -r <name> (the -r removes their home dir)