chore(deploy): password sign-in's keys and GitHub's end

TOTP_KEY, RECOVERY_CODE_KEY and SIGN_IN_DECOY_KEY switch password
sign-in on (each at least 32 characters, or the server stops), and
GITHUB_SIGN_IN_ENDS names the day GitHub stops signing anyone in. CI
gives the test runs throwaway keys as it does the other passwords.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>

.forgejo/workflows/ci.yaml

@@ -131,6 +131,9 @@ jobs:
           for name in SERVERPOD_DATABASE_PASSWORD \
             SERVERPOD_PASSWORD_serverSideSessionKeyHashPepper \
             SERVERPOD_PASSWORD_emailSignInPepper \
+            SERVERPOD_PASSWORD_totpKey \
+            SERVERPOD_PASSWORD_recoveryCodeKey \
+            SERVERPOD_PASSWORD_signInDecoyKey \
             SERVERPOD_PASSWORD_serviceSecret; do
             echo "$name=$(openssl rand -hex 32)" >> "$FORGEJO_ENV"
           done

deploy/.env.example

@@ -76,6 +76,25 @@ EMAIL_SMTP_PASSWORD=
 # DMARC records for the service, or mail lands in spam.
 EMAIL_FROM=
 
+# Password sign-in (ADR 0017): an address, a password that never leaves the device, and
+# a code from an authenticator app. Off unless all three keys and email sign-in are set
+# up (resets go by mail); each key at least 32 characters, or the server doesn't start.
+# They stay outside the database, so a copy of it alone gives none of this away:
+# TOTP_KEY seals the authenticators' secrets: changing it makes every authenticator
+#   useless (people then reset theirs, 72 hours, by mail).
+# RECOVERY_CODE_KEY keys the recovery codes' hashes: changing it voids every recovery
+#   code (people make new ones once signed in).
+# SIGN_IN_DECOY_KEY makes the answers for addresses nobody has look like an account's:
+#   changing it lets someone who watched those answers tell which addresses are unused.
+# Generate each: openssl rand -hex 32
+TOTP_KEY=
+RECOVERY_CODE_KEY=
+SIGN_IN_DECOY_KEY=
+# The day GitHub stops signing anyone in, three months after the release that brings
+# passwords (ADR 0017, D2): from then on its people sign in with their address and
+# password only, and the daily pruning forgets every GitHub ID. Empty: GitHub goes on.
+#GITHUB_SIGN_IN_ENDS=2027-01-22
+
 # Where the source of what this instance runs is, shown in the app's About dialog: both
 # licences (AGPL for the app, SSPL for the server) require offering it to the people who
 # use the instance. Empty: the project's repository, which is right for unmodified code.

deploy/compose.yaml

@@ -75,6 +75,13 @@ services:
       SERVERPOD_PASSWORD_emailSmtpUser: ${EMAIL_SMTP_USER:-}
       SERVERPOD_PASSWORD_emailSmtpPassword: ${EMAIL_SMTP_PASSWORD:-}
       SERVERPOD_PASSWORD_emailFrom: ${EMAIL_FROM:-}
+      # Password sign-in with TOTP (ADR 0017), only with these keys and email
+      # sign-in; empty: off. Each at least 32 characters, or the server stops.
+      SERVERPOD_PASSWORD_totpKey: ${TOTP_KEY:-}
+      SERVERPOD_PASSWORD_recoveryCodeKey: ${RECOVERY_CODE_KEY:-}
+      SERVERPOD_PASSWORD_signInDecoyKey: ${SIGN_IN_DECOY_KEY:-}
+      # The day GitHub stops signing anyone in (`2027-01-22`); empty: no end.
+      GITHUB_SIGN_IN_ENDS: ${GITHUB_SIGN_IN_ENDS:-}
       # Where the source of what this instance runs is; empty: the project's.
       SOURCE_URL: ${SOURCE_URL:-}
       # The domain people's handles are on; empty: DOMAIN's host.