I Just Wanted Gitea 28 — Part 20 of Building a Resilient Home Server Series

Where We Left Off Part 19 was two and a half weeks of rebuilding nixos2 on new hardware after the old box started screaming at me. Big post, lots of gaps found, a punch list at the end. This one was supposed to be small. One update, one service, could be done before I ran to lunch. Could build a new ISO later. It ended up taking lunch and getting wrapped up later in the evening. The One Update I Actually Planned Gitea 28.0.0 landed at the end of September. It's a big release: they dropped the historical 1. prefix, so it's 28.0.0 instead of 1.28.0, and added audit logging, bot accounts, HTTPS deploy tokens and an Actions queue view. More to the point for me, it shipped with a long list of security fixes, a good chunk of them around mirrors, migrations and egress. Since my Gitea instance mirrors out to Codeberg, that's not a section of the release notes I wanted to sit on. nixos2 already pulls Gitea from unstable through an overlay (that's the version-mismatch fix from Part 19), so in…