f

mnemo_cards_backend/PROGRESS.md

@@ -22,11 +22,17 @@
 - **Cron Automation:** Daily certificate renewal checks
 
 **Scripts Created:**
-- `setup-forgejo-domain.sh` - One-command domain setup and SSL configuration
+- `setup-forgejo-domain.sh` - One-command domain setup with SSL, IP blocking, and ROOT_URL fix
-- `test-forgejo-domain.sh` - Comprehensive testing of DNS, SSL, nginx, and connectivity
+- `test-forgejo-domain.sh` - Comprehensive testing of DNS, SSL, IP blocking, and ROOT_URL config
-- `forgejo-nginx.conf` - Production-ready nginx configuration for Forgejo
+- `forgejo-nginx.conf` - Production-ready nginx configuration with IP access blocking
 
-**Next Action:** Run setup script on server to activate domain configuration
+**Security Features Added:**
+- ✅ IP address access blocking (only domain access allowed)
+- ✅ Automatic Forgejo ROOT_URL configuration fix
+- ✅ SSL certificate validation for domain access
+- ✅ Service restart after configuration changes
+
+**Next Action:** Run updated setup script on server to activate domain configuration with IP blocking and ROOT_URL fix
 
 ---
 

mnemo_cards_backend/TODO.md

@@ -3,7 +3,7 @@
 ## High Priority
 - [x] Fix MnemoShelf routing so the v2 pipeline mounts at `/api/v2` (restores public packs listing)
 - [x] **COMPLETED** - Implement User Tasks System Backend API (6 endpoints, 3 models, data seeding)
-- [x] **COMPLETED** - Set up Forgejo domain (code.mnemo-cards.online) with SSL and nginx proxy
+- [x] **COMPLETED** - Set up Forgejo domain (code.mnemo-cards.online) with SSL, IP blocking, and ROOT_URL fix
 - [ ] Verify project builds successfully (`flutter build`)
 - [ ] Run all existing tests (`flutter test`)
 - [ ] Check code generation (`./codegen.sh`)

mnemo_cards_web_v2/deploy/forgejo-nginx.conf

@@ -1,3 +1,18 @@
+# Block access by IP address
+server {
+    listen 80 default_server;
+    listen 443 ssl default_server;
+    server_name _;
+
+    # SSL configuration for default server (block IP access)
+    ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
+    ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
+    ssl_protocols TLSv1.2 TLSv1.3;
+
+    # Return 444 (connection closed without response) for IP access
+    return 444;
+}
+
 server {
     listen 80;
     server_name code.mnemo-cards.online;

mnemo_cards_web_v2/deploy/setup-forgejo-domain.sh

@@ -96,8 +96,46 @@ ssh "$SERVER_USER@$SERVER_IP" << EOF
         (crontab -l ; echo "0 12 * * * certbot renew --quiet --cert-name code.mnemo-cards.online") | crontab -
     fi
 
+    # Update Forgejo ROOT_URL configuration
+    echo "Updating Forgejo ROOT_URL configuration..."
+
+    # Find Forgejo app.ini file
+    FORGEJO_CONFIG=""
+    for config_path in "/etc/forgejo/app.ini" "/home/forgejo/custom/conf/app.ini" "/var/lib/forgejo/custom/conf/app.ini" "/opt/forgejo/custom/conf/app.ini"; do
+        if [ -f "$config_path" ]; then
+            FORGEJO_CONFIG="$config_path"
+            echo "Found Forgejo config at: $FORGEJO_CONFIG"
+            break
+        fi
+    done
+
+    if [ -n "$FORGEJO_CONFIG" ]; then
+        # Backup original config
+        cp "$FORGEJO_CONFIG" "${FORGEJO_CONFIG}.backup.$(date +%Y%m%d_%H%M%S)"
+
+        # Update ROOT_URL
+        sed -i 's|ROOT_URL.*=.*|ROOT_URL = https://code.mnemo-cards.online|' "$FORGEJO_CONFIG"
+
+        echo "Updated ROOT_URL in Forgejo configuration"
+
+        # Restart Forgejo service
+        if systemctl is-active --quiet forgejo 2>/dev/null; then
+            echo "Restarting Forgejo service..."
+            systemctl restart forgejo
+        elif systemctl is-active --quiet gitea 2>/dev/null; then
+            echo "Restarting Gitea service..."
+            systemctl restart gitea
+        else
+            echo "Warning: Could not find active Forgejo/Gitea service to restart"
+        fi
+    else
+        echo "Warning: Could not find Forgejo app.ini configuration file"
+        echo "Please manually update ROOT_URL to https://code.mnemo-cards.online in your Forgejo config"
+    fi
+
     echo "Forgejo domain setup completed successfully!"
     echo "Forgejo is now available at: https://code.mnemo-cards.online"
+    echo "Access by IP address is blocked"
 EOF
 
 print_success "Forgejo domain setup completed successfully! 🎉"

mnemo_cards_web_v2/deploy/test-forgejo-domain.sh

@@ -68,6 +68,15 @@ else
     print_warning "HTTPS access: $HTTPS_STATUS (may be normal for Forgejo auth redirects)"
 fi
 
+# Test that IP access is blocked
+print_status "Testing that IP access is blocked..."
+IP_BLOCK_STATUS=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 https://147.45.152.129/)
+if [ "$IP_BLOCK_STATUS" = "444" ] || [ "$IP_BLOCK_STATUS" = "000" ]; then
+    print_success "IP access blocked: $IP_BLOCK_STATUS ✓"
+else
+    print_warning "IP access not blocked: $IP_BLOCK_STATUS (should be 444)"
+fi
+
 # Test SSL certificate
 print_status "Testing SSL certificate..."
 SSL_INFO=$(openssl s_client -connect code.mnemo-cards.online:443 -servername code.mnemo-cards.online < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates 2>/dev/null)
@@ -118,6 +127,26 @@ ssh "$SERVER_USER@$SERVER_IP" << EOF
     else
         echo "⚠️  Let's Encrypt certificate: NOT FOUND (using self-signed?)"
     fi
+
+    # Check Forgejo ROOT_URL configuration
+    FORGEJO_CONFIG=""
+    for config_path in "/etc/forgejo/app.ini" "/home/forgejo/custom/conf/app.ini" "/var/lib/forgejo/custom/conf/app.ini" "/opt/forgejo/custom/conf/app.ini"; do
+        if [ -f "$config_path" ]; then
+            FORGEJO_CONFIG="$config_path"
+            break
+        fi
+    done
+
+    if [ -n "$FORGEJO_CONFIG" ]; then
+        ROOT_URL=$(grep "^ROOT_URL" "$FORGEJO_CONFIG" | cut -d'=' -f2 | tr -d ' ')
+        if [ "$ROOT_URL" = "https://code.mnemo-cards.online" ]; then
+            echo "✅ Forgejo ROOT_URL: CORRECT ($ROOT_URL)"
+        else
+            echo "❌ Forgejo ROOT_URL: INCORRECT ($ROOT_URL) - should be https://code.mnemo-cards.online"
+        fi
+    else
+        echo "⚠️  Forgejo config: NOT FOUND"
+    fi
 EOF
 
 print_info "Forgejo domain test completed!"