From dd23f08878946a4c81f65d15ad55df8ee272871b Mon Sep 17 00:00:00 2001
From: Adam Moussa <adam@seahavenind.com>
Date: Tue, 29 Sep 2026 19:59:54 -0400
Subject: [PATCH] fix(terraform): restore the dump app.ini with the database

INTERNAL_TOKEN, JWT_SECRET, and LFS_JWT_SECRET live in that file. A restore that keeps the generated file cannot decrypt the dumped secrets.
---
 README.md              | 10 ++++++++++
 terraform/user_data.sh |  6 ++++++
 2 files changed, 16 insertions(+)

diff --git a/README.md b/README.md
index 2e3dfc5..fce3b30 100644
--- a/README.md
+++ b/README.md
@@ -147,6 +147,11 @@ if [ ! -s /var/lib/forgejo/data/forgejo.db ]; then
   echo "Restore did not produce /var/lib/forgejo/data/forgejo.db" >&2
   exit 1
 fi
+if [ -f /var/lib/forgejo/.restore/app.ini ]; then
+  cp /var/lib/forgejo/.restore/app.ini /etc/forgejo/app.ini
+  chown root:forgejo /etc/forgejo/app.ini
+  chmod 660 /etc/forgejo/app.ini
+fi
 chown -R forgejo:forgejo /var/lib/forgejo
 systemctl start forgejo
 rm -rf /var/lib/forgejo/.restore
@@ -189,6 +194,11 @@ if [ ! -s /var/lib/forgejo/data/forgejo.db ]; then
   echo "Restore did not produce /var/lib/forgejo/data/forgejo.db" >&2
   exit 1
 fi
+if [ -f /var/lib/forgejo/.restore/app.ini ]; then
+  cp /var/lib/forgejo/.restore/app.ini /etc/forgejo/app.ini
+  chown root:forgejo /etc/forgejo/app.ini
+  chmod 660 /etc/forgejo/app.ini
+fi
 chown -R forgejo:forgejo /var/lib/forgejo
 systemctl start forgejo
 rm -rf /var/lib/forgejo/.restore
diff --git a/terraform/user_data.sh b/terraform/user_data.sh
index 6514584..ceafffc 100644
--- a/terraform/user_data.sh
+++ b/terraform/user_data.sh
@@ -136,6 +136,12 @@ if [ ! -f /var/lib/forgejo/data/forgejo.db ]; then
     if [ -d "$RESTORE_DIR/custom" ]; then
       cp -a "$RESTORE_DIR"/custom/. /var/lib/forgejo/custom/
     fi
+    # The dump's app.ini carries INTERNAL_TOKEN, JWT_SECRET, and LFS_JWT_SECRET.
+    if [ -f "$RESTORE_DIR/app.ini" ]; then
+      cp "$RESTORE_DIR/app.ini" /etc/forgejo/app.ini
+      chown root:forgejo /etc/forgejo/app.ini
+      chmod 660 /etc/forgejo/app.ini
+    fi
     chown -R forgejo:forgejo /var/lib/forgejo
     rm -rf "$RESTORE_DIR"
     if [ ! -s /var/lib/forgejo/data/forgejo.db ]; then