diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index dd743d2..523f3d8 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -23,6 +23,7 @@ in
           SECRET_KEY = lib.mkDefault config.age.secrets.forgejo-secret-key.path;
           INTERNAL_TOKEN = lib.mkDefault config.age.secrets.forgejo-internal-token.path;
         };
+        oauth2.JWT_SECRET = config.age.secrets.forgejo-oauth2-jwt-token.path;
       };
       settings = {
         security.GLOBAL_TWO_FACTOR_REQUIREMENT = "all";
@@ -32,6 +33,19 @@ in
           DOMAIN = fqdn;
           PROTOCOL = "http+unix";
           ROOT_URL = "https://${fqdn}:443";
+          OFFLINE_MODE = true; # disable gravatar, CDN
+          LANDING_PAGE = "explore";
+        };
+        openid.ENABLE_OPENID_SIGNUP = true;
+        oauth2_client = {
+          ENABLE_AUTO_REGISTRATION = true;
+          ACCOUNT_LINKING = "login";
+          USERNAME = "nickname";
+        };
+        service = {
+          DISABLE_REGISTRATION = false;
+          ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
+          AUTO_WATCH_NEW_REPOS = false;
         };
         mailer = {
           ENABLED = true;
@@ -40,6 +54,12 @@ in
           SENDMAIL_PATH = "${pkgs.msmtp}/bin/msmtp";
           SENDMAIL_ARGS = "--";
         };
+        cors = {
+          ENABLED = false;
+          ALLOW_DOMAIN = "https://git.berlin.ccc.de";
+          ALLOW_CREDENTIALS = true;
+        };
+        metrics.ENABLED = true;
       };
       lfs.enable = true;
       dump = {
@@ -58,11 +78,11 @@ in
       };
     };
 
-    #openssh.extraConfig = ''
-    #  Match User git
-    #    AcceptEnv GIT_PROTOCOL
-    #    PerSourcePenalties no
-    #'';
+    openssh.extraConfig = ''
+      Match User forgejo
+        AcceptEnv GIT_PROTOCOL
+        PerSourcePenalties no
+    '';
 
     nginx.virtualHosts."${fqdn}" = {
       quic = true;
diff --git a/secrets/forgejo-internal-token.age b/secrets/forgejo-internal-token.age
index 01eb486..f12e1fc 100644
Binary files a/secrets/forgejo-internal-token.age and b/secrets/forgejo-internal-token.age differ
diff --git a/secrets/forgejo-oauth2-jwt-secret.age b/secrets/forgejo-oauth2-jwt-secret.age
new file mode 100644
index 0000000..9575e4a
--- /dev/null
+++ b/secrets/forgejo-oauth2-jwt-secret.age
@@ -0,0 +1,19 @@
+age-encryption.org/v1
+-> ssh-ed25519 uH+n1w KI9l4sauYEJDyxjDLmb7XpFa1p0+pBecGEvaIikdfX0
+YqsPwm2QL/04tJmnEByFa8D2sPwuwqbOUtqLCUq4Te0
+-> ssh-ed25519 EvLbWw HQIKS0fya9C0bNEt9tTzZcd1FN4ubwIRzpcWREHy0Do
+TYPC+2F8ibv0ZE51fXpG+oO7QqqAB+zpdOiy6ArRkB4
+-> ssh-ed25519 dM+fLQ 3WVonBlN4+uU0j10FQUTGTAG7MIQRyK2sf+memWx/CQ
+8/6x7MjeIdIAhaMalsBLAQ84VO2nOtapmAO7SGNzd1E
+-> ssh-ed25519 jxWM2Q bjQkARCVy2+9YnNQ6CJZ3s0GvrOIwIb7pEvupGw8cy0
+g8E4dwFNCr3q6c69XoLe/S5hUTyX80cahpHcurNYpao
+-> ssh-ed25519 /yCUCg z0gLuz8/GNf97GpRlbnFmFlsyMplMUmms+IAj8IBfTs
+nYodZX4Bm9DBZ3ojJtcOOlhIPMfxpoTpakU7o98qqeA
+-> ssh-ed25519 FGp51g D6nK7ZUod/AlAp5+76yZHVCko8Y+KH3/ZYHhKqSFc0U
+vE9T4FXxKKKIvYZwucPKpWaB/KtjAj9BNAhQJ5GBEcU
+-> ssh-ed25519 b5OiTQ G65Cax9YgCn7Xvwa5kI2scWdt4tSAForrpHEmV2lG08
+14pdLMWG4Uy5N57aKCqahsHh4SdKoCCKepT3zYZhxTs
+-> ssh-ed25519 HaNCag mA0JV8IXeHuOd92Buf0UxoH9zioZuB2/Whuxs927n0c
+C4OacOAJXCI/fIs6fCIKoDWZKg8MMZTsolHSnkP9BAc
+--- 0VQUZSYlQ/1evWAzs+XAPnQGytUFI7FJsR2w68tx8k4
+D/�x��,�j���?Qߋ�����߀��=�l}��y+
�pd#:�;��БbW�ڨ�핾5�Yxe�s&�v
\ No newline at end of file
diff --git a/secrets/forgejo-secret-key.age b/secrets/forgejo-secret-key.age
index c444ed9..fc9784b 100644
Binary files a/secrets/forgejo-secret-key.age and b/secrets/forgejo-secret-key.age differ
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 3148b96..14e5f9c 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -68,4 +68,5 @@ in
   "forgejo-runner-token-snowden-env.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
   "forgejo-runner-token-snowden.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
   "forgejo-secret-key.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
+  "forgejo-oauth2-jwt-secret.age".publicKeys = xengi ++ kaythxbye ++ [ _git ];
 }