Support plain-HTTP self-hosted forges

--host and FORGE_HOST now accept a full http://host:port URL, and a
scheme = http key is accepted under [domain] in config (settable via
forge auth login --scheme). The API base URL is built from that scheme
instead of hardcoding https, so a local Forgejo/Gitea on a private IP
without TLS is reachable.

DetectForgeType and Client.RegisterDomain accept an optional scheme
prefix on the domain argument for the same reason; the bare host is
still used as the registry key.

Author: andrew

README.md

@@ -128,6 +128,16 @@ type = gitlab
 
 This tells forge that the project uses GitLab and that `gitlab.internal.dev` is a GitLab instance, so contributors don't each need `--forge-type` or `FORGE_HOST`.
 
+For a self-hosted instance served over plain HTTP (a local Forgejo in Docker, say), add `scheme = http` to its section in `~/.config/forge/config`, use `forge auth login --scheme http`, or pass a full URL to `--host`/`FORGE_HOST`:
+
+```ini
+[172.30.0.10:3000]
+type = forgejo
+scheme = http
+```
+
+Committed `.forge` files cannot set the API scheme.
+
 Precedence from highest to lowest: CLI flags, environment variables, `.forge`, `~/.config/forge/config`, built-in defaults.
 
 ## Library

detect.go

@@ -12,13 +12,17 @@ import (
 
 // DetectForgeType probes a domain to identify which forge software it runs.
 // It checks HTTP response headers first, then falls back to API endpoints.
-// If hc is nil, http.DefaultClient is used.
+// The domain may include an http:// or https:// prefix; without one, https is
+// assumed. If hc is nil, http.DefaultClient is used.
 func DetectForgeType(ctx context.Context, domain string, hc ...*http.Client) (ForgeType, error) {
 	client := http.DefaultClient
 	if len(hc) > 0 && hc[0] != nil {
 		client = hc[0]
 	}
-	baseURL := "https://" + domain
+	baseURL, _, err := normalizeBaseURL(domain)
+	if err != nil {
+		return Unknown, err
+	}
 
 	ft, err := detectFromHeaders(ctx, client, baseURL)
 	if err != nil {

forge.go

@@ -131,15 +131,50 @@ func (c *Client) HTTPClient() *http.Client {
 	return c.httpClient
 }
 
+// normalizeBaseURL accepts either a bare host[:port] or a full http(s) URL and
+// returns (baseURL, host). A bare host is assumed https.
+func normalizeBaseURL(s string) (baseURL, host string, err error) {
+	if !strings.Contains(s, "://") {
+		s = "https://" + s
+	}
+
+	u, err := url.Parse(s)
+	if err != nil {
+		return "", "", fmt.Errorf("invalid forge URL %q: %w", s, err)
+	}
+	u.Scheme = strings.ToLower(u.Scheme)
+	if u.Scheme != "http" && u.Scheme != "https" {
+		return "", "", fmt.Errorf("invalid forge URL scheme %q: must be http or https", u.Scheme)
+	}
+	if u.Host == "" {
+		return "", "", fmt.Errorf("invalid forge URL %q: host is required", s)
+	}
+	if u.User != nil {
+		return "", "", fmt.Errorf("invalid forge URL %q: user information is not supported", s)
+	}
+	if u.ForceQuery || u.RawQuery != "" || u.Fragment != "" {
+		return "", "", fmt.Errorf("invalid forge URL %q: query and fragment are not supported", s)
+	}
+
+	u.Path = strings.TrimRight(u.Path, "/")
+	u.RawPath = strings.TrimRight(u.RawPath, "/")
+	return u.String(), u.Host, nil
+}
+
 // RegisterDomain detects the forge type for a domain and registers the
-// appropriate Forge using the provided builder functions.
+// appropriate Forge using the provided builder functions. The domain may
+// include an http:// or https:// prefix; without one, https is assumed.
+// The bare host[:port] is used as the registry key.
 func (c *Client) RegisterDomain(ctx context.Context, domain, token string, builders ForgeBuilders) error {
-	ft, err := DetectForgeType(ctx, domain, c.httpClient)
+	baseURL, domain, err := normalizeBaseURL(domain)
+	if err != nil {
+		return err
+	}
+	ft, err := DetectForgeType(ctx, baseURL, c.httpClient)
 	if err != nil {
 		return fmt.Errorf("detecting forge type for %s: %w", domain, err)
 	}
 	c.tokens[domain] = token
-	baseURL := "https://" + domain
 	switch ft {
 	case GitHub:
 		c.forges[domain] = builders.GitHub(baseURL, token, c.httpClient)

forges_test.go

@@ -200,6 +200,66 @@ func TestDetectForgeTypeUsesProvidedClient(t *testing.T) {
 	}
 }
 
+func TestDetectForgeTypeAcceptsHTTPURL(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Forgejo-Version", "7.0.0")
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	// srv.URL is http://127.0.0.1:PORT — passing it directly must not be
+	// rewritten to https.
+	ft, err := DetectForgeType(context.Background(), srv.URL)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if ft != Forgejo {
+		t.Errorf("want Forgejo, got %s", ft)
+	}
+}
+
+func TestRegisterDomainAcceptsHTTPURL(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("X-Forgejo-Version", "7.0.0")
+		w.WriteHeader(http.StatusOK)
+	}))
+	defer srv.Close()
+
+	var gotBase string
+	c := NewClient()
+	inputURL := srv.URL + "/forge/"
+	err := c.RegisterDomain(context.Background(), inputURL, "tok", ForgeBuilders{
+		Gitea: func(baseURL, token string, hc *http.Client) Forge {
+			gotBase = baseURL
+			return nil
+		},
+	})
+	if err != nil {
+		t.Fatalf("RegisterDomain: %v", err)
+	}
+	if want := srv.URL + "/forge"; gotBase != want {
+		t.Errorf("builder got base %q, want %q", gotBase, want)
+	}
+	// Registry key must be the bare host, not the full URL.
+	host := strings.TrimPrefix(srv.URL, "http://")
+	if _, err := c.ForgeFor(host); err != nil {
+		t.Errorf("ForgeFor(%q) after RegisterDomain(%q): %v", host, inputURL, err)
+	}
+}
+
+func TestNormalizeBaseURLRejectsUnsupportedURLParts(t *testing.T) {
+	for _, input := range []string{
+		"ftp://forge.example.com",
+		"https://user@forge.example.com",
+		"https://forge.example.com?query=value",
+		"https://forge.example.com#fragment",
+	} {
+		if _, _, err := normalizeBaseURL(input); err == nil {
+			t.Errorf("normalizeBaseURL(%q) should return an error", input)
+		}
+	}
+}
+
 func TestDetectForgeTypeHeaders(t *testing.T) {
 	tests := []struct {
 		header string

internal/cli/auth.go

@@ -31,6 +31,7 @@ func authLoginCmd() *cobra.Command {
 		token     string
 		tokenCmd  string
 		forgeType string
+		scheme    string
 	)
 
 	cmd := &cobra.Command{
@@ -69,7 +70,12 @@ func authLoginCmd() *cobra.Command {
 				}
 			}
 
-			if err := config.SetDomain(domain, token, tokenCmd, forgeType); err != nil {
+			scheme = strings.ToLower(scheme)
+			if scheme != "" && scheme != "http" && scheme != "https" {
+				return fmt.Errorf("invalid --scheme %q: must be http or https", scheme)
+			}
+
+			if err := config.SetDomain(domain, token, tokenCmd, forgeType, scheme); err != nil {
 				return fmt.Errorf("saving config: %w", err)
 			}
 
@@ -86,6 +92,7 @@ func authLoginCmd() *cobra.Command {
 	cmd.Flags().StringVar(&token, "token", "", "API token")
 	cmd.Flags().StringVar(&tokenCmd, "token-cmd", "", "Shell command whose stdout is used as the token")
 	cmd.Flags().StringVar(&forgeType, "type", "", "Forge type: github, gitlab, gitea, forgejo, bitbucket, gerrit, tangled")
+	cmd.Flags().StringVar(&scheme, "scheme", "", "API scheme: http or https (default https). Use http for plain-HTTP self-hosted instances.")
 	cmd.MarkFlagsMutuallyExclusive("token", "token-cmd")
 	return cmd
 }

internal/cli/auth_test.go

@@ -113,6 +113,33 @@ func TestAuthLoginNonInteractive(t *testing.T) {
 	}
 }
 
+func TestAuthLoginNormalizesScheme(t *testing.T) {
+	resetCmd(rootCmd)
+	dir := t.TempDir()
+	t.Setenv("XDG_CONFIG_HOME", dir)
+	config.ResetCache()
+	defer config.ResetCache()
+
+	rootCmd.SetArgs([]string{
+		"auth", "login",
+		"--domain", "forgejo.example.com",
+		"--token", "test_token_123",
+		"--scheme", "HTTP",
+	})
+
+	if err := rootCmd.Execute(); err != nil {
+		t.Fatalf("auth login: %v", err)
+	}
+
+	data, err := os.ReadFile(filepath.Join(dir, "forge", "config"))
+	if err != nil {
+		t.Fatalf("reading config: %v", err)
+	}
+	if !strings.Contains(string(data), "scheme = http") {
+		t.Errorf("expected normalized scheme, got:\n%s", data)
+	}
+}
+
 func TestAuthLoginTokenCmd(t *testing.T) {
 	resetCmd(rootCmd)
 	dir := t.TempDir()

internal/cli/root.go

@@ -46,7 +46,7 @@ func Execute() error {
 func init() {
 	rootCmd.PersistentFlags().StringVarP(&flagRepo, "repo", "R", "", "Select a repository (OWNER/REPO or HOST/OWNER/REPO)")
 	rootCmd.PersistentFlags().StringVar(&flagForgeType, "forge-type", "", "Force forge type: github, gitlab, gitea, forgejo, bitbucket, gerrit, tangled")
-	rootCmd.PersistentFlags().StringVar(&flagHost, "host", "", "Force forge host (e.g. gitea.com); overrides FORGE_HOST and remote detection")
+	rootCmd.PersistentFlags().StringVar(&flagHost, "host", "", "Force forge host (e.g. gitea.com, http://forgejo.local:3000); overrides FORGE_HOST and remote detection")
 	rootCmd.PersistentFlags().StringVarP(&flagOutput, "output", "o", "table", "Output format: table, json, plain")
 	rootCmd.PersistentFlags().StringVar(&flagRemote, "remote", "", "Git remote to use when not specifying -R (default origin)")
 }

internal/config/config.go

@@ -31,6 +31,7 @@ type DefaultSection struct {
 
 type DomainSection struct {
 	Type        string // github, gitlab, gitea, forgejo, bitbucket, gerrit, tangled
+	Scheme      string // http or https; only from user config (empty = https)
 	Token       string // resolved token value; only from user config, never .forge
 	TokenExec   string // non-empty when token is retrieved via a shell command (from "token-cmd" config key)
 	SSHHost     string // alternate host for git-over-ssh; the section name remains the API host
@@ -94,6 +95,17 @@ func GitProtocolFor(domain string) string {
 	return "https"
 }
 
+func parseScheme(v string) (string, error) {
+	switch strings.ToLower(v) {
+	case "http":
+		return "http", nil
+	case "https":
+		return "https", nil
+	default:
+		return "", fmt.Errorf("invalid scheme %q: must be \"http\" or \"https\"", v)
+	}
+}
+
 func parseGitProtocol(v string) (string, error) {
 	switch strings.ToLower(v) {
 	case "ssh":
@@ -166,7 +178,7 @@ func load() (*Config, error) {
 	return cfg, nil
 }
 
-func loadFile(cfg *Config, path string, allowTokens bool) error {
+func loadFile(cfg *Config, path string, userConfig bool) error {
 	f, err := os.Open(path)
 	if os.IsNotExist(err) {
 		return nil
@@ -205,19 +217,28 @@ func loadFile(cfg *Config, path string, allowTokens bool) error {
 		if v, ok := kv["type"]; ok {
 			ds.Type = v
 		}
+		if userConfig {
+			if v, ok := kv["scheme"]; ok {
+				s, err := parseScheme(v)
+				if err != nil {
+					return fmt.Errorf("%s: [%s] %w", path, name, err)
+				}
+				ds.Scheme = s
+			}
+		}
 		if v, ok := kv["git_protocol"]; ok {
 			p, err := parseGitProtocol(v)
 			if err != nil {
 				return fmt.Errorf("%s: [%s] %w", path, name, err)
 			}
 			ds.GitProtocol = p
 		}
-		if allowTokens {
+		if userConfig {
 			if v, ok := kv["ssh_host"]; ok {
 				ds.SSHHost = v
 			}
 		}
-		if allowTokens {
+		if userConfig {
 			_, hasToken := kv["token"]
 			_, hasTokenCmd := kv["token-cmd"]
 			if hasToken && hasTokenCmd {
@@ -317,7 +338,15 @@ func findProjectConfig(dir string) string {
 // SetDomain updates or adds a domain section in the user config file.
 // Creates the config directory if needed. Sets file permissions to 0600
 // since the file may contain tokens.
-func SetDomain(domain, token, tokenCmd, forgeType string) error {
+func SetDomain(domain, token, tokenCmd, forgeType, scheme string) error {
+	if scheme != "" {
+		normalizedScheme, err := parseScheme(scheme)
+		if err != nil {
+			return err
+		}
+		scheme = normalizedScheme
+	}
+
 	path := UserConfigPath()
 	if path == "" {
 		return fmt.Errorf("cannot determine config path")
@@ -351,6 +380,9 @@ func SetDomain(domain, token, tokenCmd, forgeType string) error {
 	if forgeType != "" {
 		sections[domain]["type"] = forgeType
 	}
+	if scheme != "" {
+		sections[domain]["scheme"] = scheme
+	}
 
 	return writeINI(path, sections)
 }