Install Pando

Gitea or Forgejo

gitea Clone from a Gitea or Forgejo server, Codeberg included, with an access token, an OAuth2 application, or a deploy key, optionally limited to one owner.

Setup

  1. Choose how Pando signs in

    Settings method, host

  2. Create an access token

    1. Open Settings → Applications. On Forgejo, choose New access token.
    2. Enter a Token name. Under Repository and organization access, choose All (public, private, and limited).
    3. Under Select permissions, set these:
      PermissionAccess
      repositoryRead
      userRead
    4. Choose Generate token and copy the token.

    Open Applications: https://<Host>/user/settings/applications

    Settings token, username · Only when method is token

  3. Create an OAuth2 application

    1. Open Settings → Applications.
    2. Under Create a new OAuth2 application, enter an Application name.
    3. Set Redirect URIs to your Pando address plus /api/v1/sources/callback.
    4. Leave Confidential client checked and choose Create application.
    5. Copy the Client ID and Client secret.

    Open Applications: https://<Host>/user/settings/applications

    Settings client_id, client_secret · Only when method is oauth

  4. Add a deploy key

    1. Run ssh-keygen -t ed25519 -f pando-deploy -N "".
    2. In the repository, open Settings → Deploy keys → Add deploy key (Add SSH key on Gitea).
    3. Enter a Title, paste pando-deploy.pub into Content, and add the key.
    4. Paste pando-deploy below.
    5. Run ssh-keyscan with the host's name, on a machine you trust, and paste its output below.

    Settings ssh_private_key, ssh_passphrase, known_hosts · Only when method is ssh

  5. Choose an owner

    Settings scope

Settings (12)
methodHow Pando signs inRequired
  • token Access token — An access token with Read on repository and user. Repositories can be picked from a list.
  • oauth OAuth2 application — Authorize once in the browser. Needs an address the host can send you back to.
  • ssh Deploy key — An SSH key added to the repository as a deploy key. Repositories are entered by address.

one of the values above · Default token

hostHostRequired

The host repositories are on. Change it for a self-managed server.

string · For example git.example.com

scopeOwner

Limit the connection to one user's or organization's repositories, such as acme. Empty is every repository the credential can read.

string · For example acme

usernameUsername

The token's account. Empty is oauth2.

string · For example oauth2 · Used when method is token

tokenAccess tokenCredential

Needs Read on repository and user.

string · Used when method is token

client_idOAuth2 client ID

The client ID of an OAuth2 application created under Settings → Applications, with Pando's callback as its redirect URI.

string · Used when method is oauth

client_secretOAuth2 client secretCredential

Required.

string · Used when method is oauth

ssh_private_keySSH private keyCredential

The private half of a deploy key or access key added to the repository. Pando reads the repository with it and never writes.

string · Used when method is ssh

ssh_passphraseKey passphraseCredential

Only if the key has one.

string · Used when method is ssh

known_hostsKnown hosts

The host's public key, as ssh-keyscan <host> prints it.

string · Used when method is ssh

api_urlAPI addressAdvanced

Where the host's API is, if not where Pando would look for it.

string · Default https://<host>/api/v1

ca_bundleCertificate authorityAdvanced

PEM certificates to trust for a self-managed host on a private certificate authority, beside the system's.

string · Default The system's trusted certificates

Presets

  • Codeberg Create an access token on Codeberg under Settings → Applications, with Read on repository and user.