Forgejo & Git Hosting

Tawa provides private Git hosting via Forgejo at git.insureco.io. Push to deploy — no CI config needed.

Getting Started

tawa login authenticates both Bio-ID and Forgejo in a single flow:

tawa login

Create a repository with an auto-deploy webhook:

tawa git create my-service

Then add the remote and push:

git remote add origin https://git.insureco.io/insureco/my-service.git
git push -u origin main

That first push triggers the builder automatically — your service will be built, deployed, and live within minutes.

IMPORTANT: Always use HTTPS remote URLs (https://git.insureco.io/...), not SSH. The tawa login flow configures the native git credential helper so git push works seamlessly over HTTPS without prompting for credentials.

Auto-Deploy Webhooks

When you create a repo with tawa git create, the CLI registers a webhook on Forgejo that notifies the builder on every push to the default branch:

1. You push to main (or master)
2. Forgejo sends a webhook payload to the builder with the commit SHA
3. The builder clones at that exact commit and runs the full deploy pipeline
4. Your service is built, pushed, deployed via Helm, DNS configured

NOTE: The webhook only fires on pushes to the default branch. Pushes to feature branches do not trigger a deploy.

Authentication

How tawa login Sets Up Git Credentials

tawa login does three things in one flow:

1. Authenticates with Bio-ID — gets your platform JWT
2. Provisions a Forgejo PAT — calls the builder, which creates/refreshes a Personal Access Token on git.insureco.io
3. Stores credentials in the native git credential helper — runs git credential approve so that native git push, git pull, git clone over HTTPS work without any additional configuration

After tawa login, plain git push just works. No SSH keys, no manual token management, no separate Forgejo login.

Fixing Git Auth Errors

If git push fails with 401, 403, or "could not read Username":

tawa login

That's it. This reprovisisons a fresh Forgejo PAT and updates the git credential store. Native git commands will work immediately after.

WARNING: Do NOT work around auth failures by switching to SSH URLs or manually editing ~/.git-credentials. Just run tawa login — it fixes the root cause.

If you have saved credentials (~/.tawa/credentials), add --save to skip the interactive prompt:

tawa login --save

CI/Headless Environments

1. Go to git.insureco.io → Settings → Applications → Generate New Token
2. Grant Contents: Read-only access to your repos
3. Store the token:

tawa git login <token>

Or set the FORGEJO_TOKEN environment variable for CI systems.

Remote URL Convention

Always use HTTPS remote URLs:

# Correct
git remote add origin https://git.insureco.io/insureco/my-service.git

# Wrong — don't use SSH
git remote add origin [email protected]:insureco/my-service.git

If an existing repo has an SSH remote, fix it:

git remote set-url origin https://git.insureco.io/insureco/my-service.git

Forgejo vs GitHub

TIP: If you want push-to-deploy without configuring CI, Forgejo is the simplest path. If your team already uses GitHub, use tawa link to connect the repo and deploy manually with tawa deploy.

Common Commands