Make Gitea + deploy flow HTTPS-only via single N0 PAT (sandbox-safe)#1
Closed
schlunsen wants to merge 1 commit into
Closed
Make Gitea + deploy flow HTTPS-only via single N0 PAT (sandbox-safe)#1schlunsen wants to merge 1 commit into
schlunsen wants to merge 1 commit into
Conversation
Adds an Authentication section documenting the one-token flow: use a N0 Personal Access Token (Bearer) for all n0 API calls, and mint the Gitea token via POST /workspaces/<id>/gitea/token/ instead of web UI, admin SSH, or email/password login. Enforces HTTPS git remotes and forbids SSH so the skill runs inside the Claude Desktop / Claude Code sandbox. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the skill documentation to describe a sandbox-safe, HTTPS-only workflow that uses a single N0 Personal Access Token (PAT) for all N0 API interactions and mints short-lived Gitea credentials via the N0 API (no SSH, no interactive login).
Changes:
- Added an “Authentication (single token, HTTPS-only)” section documenting
$N0_API_BASE+$N0_API_TOKENand minting a Gitea token viaPOST /workspaces/<id>/gitea/token/. - Replaced
/auth/login+ JWT examples with PAT Bearer-token examples across the import/deploy flow. - Tightened guidance around HTTPS git remotes and marked SSH-based registry credential troubleshooting as admin-only/non-sandbox.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| GITEA_TOKEN=$(echo "$GITEA" | python3 -c "import json,sys; print(json.load(sys.stdin)['data']['token'])") | ||
| GITEA_USER=$(echo "$GITEA" | python3 -c "import json,sys; print(json.load(sys.stdin)['data']['username'])") | ||
| GITEA_URL=$(echo "$GITEA" | python3 -c "import json,sys; print(json.load(sys.stdin)['data']['gitea_url'])") | ||
| GITEA_HOST=$(echo "$GITEA_URL" | sed -e 's#^https\?://##' -e 's#/$##') |
| -H "Authorization: Bearer $N0_API_TOKEN") | ||
| GITEA_TOKEN=$(echo "$GITEA" | python3 -c "import json,sys; print(json.load(sys.stdin)['data']['token'])") | ||
| GITEA_USER=$(echo "$GITEA" | python3 -c "import json,sys; print(json.load(sys.stdin)['data']['username'])") | ||
| GITEA_HOST=$(echo "$GITEA" | python3 -c "import json,sys; print(json.load(sys.stdin)['data']['gitea_url'])" | sed -e 's#^https\?://##' -e 's#/$##') |
Comment on lines
+1661
to
1664
| # HTTPS remote with the Gitea token embedded — NEVER use an SSH remote (git@...) | ||
| git init && git add -A && git commit -m "Initial commit" | ||
| git remote add origin "https://<username>:${GITEA_TOKEN}@${GITEA_HOST}/clovrlabs/my-app.git" | ||
| git remote add origin "https://${GITEA_USER}:${GITEA_TOKEN}@${GITEA_HOST}/clovrlabs/my-app.git" | ||
| git push -u origin main --force |
Comment on lines
+1703
to
1704
| # Visit the app (host matches your platform domain, e.g. apps.nzero.pro) | ||
| open "https://my-app.apps.privateprompt.tech" |
| All credentials come from the single N0 PAT — no email/password, no web UI, no SSH. | ||
| See "Authentication (single token, HTTPS-only)" near the top. | ||
|
|
||
| **N0 API token**: use `$N0_API_TOKEN` (a `clovr_pat_...` PAT) as `Authorization: Bearer $N0_API_TOKEN` on every call. Do NOT use `/auth/login`. |
schlunsen
added a commit
that referenced
this pull request
Jul 4, 2026
* Make Gitea + deploy flow HTTPS-only via single N0 PAT (sandbox-safe)
Adds an Authentication section documenting the one-token flow: use a N0
Personal Access Token (Bearer) for all n0 API calls, and mint the Gitea
token via POST /workspaces/<id>/gitea/token/ instead of web UI, admin SSH,
or email/password login. Enforces HTTPS git remotes and forbids SSH so the
skill runs inside the Claude Desktop / Claude Code sandbox.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* Field notes from downhill-havoc deploy: stale :latest on redeploy, full-URL imports, runner caveats
- Warn that redeploys don't repull an unchanged :latest tag (k3s containerd
tag cache); document the commit-SHA pin + re-import + redeploy flow
- Prefer full Gitea URL for definition imports: short org/repo form can fail
with a misleading 'No n0-app.json found' (seen on prod app.nzero.pro)
- Mark the 'Import into k3s' CI step as conditional: containerized runners
have no k3s binary and fail with exit 127
- Add troubleshooting rows: stale-version-after-redeploy, short-form import
error, and Actions runs misreported as failed after the job succeeded
- Document minting a Gitea token via POST /workspaces/{ws}/gitea/token/
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Collaborator
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
POST /workspaces/<id>/gitea/token/(requiresgitea:writescope) instead of web UI,gitea admin ... generate-access-token(SSH), or email/password login/auth/loginJWT +$N0_TOKEN/$API/$TOKENusage with$N0_API_BASE+$N0_API_TOKENhttps://<user>:<token>@host/...) and explicitly forbids SSH remotesWhy
This makes the skill run cleanly inside the Claude Desktop / Claude Code sandbox (outbound HTTPS only, no SSH keys, no interactive login), which is required for the new one-click "Build an app with Claude" onboarding in N0.
🤖 Generated with Claude Code