Enable SSH and no-login access to public repos

gitea-podman/setup-gitea-podman.sh

@@ -373,6 +373,10 @@ SSH_DOMAIN = ${GITEA_DOMAIN}
 ; at a non-privileged port, mapped to the outside via the Quadlet unit's PublishPort.
 SSH_PORT = ${GITEA_SSH_PORT}
 SSH_LISTEN_PORT = ${SSH_LISTEN_PORT}
+; Show the SSH clone URL on a public repo's page to visitors who aren't
+; signed in (an anonymous key still can't push or read a private repo --
+; this only affects whether the URL itself is displayed).
+SSH_EXPOSE_ANONYMOUS = true
 LFS_START_SERVER = true
 LFS_JWT_SECRET = ${lfs_jwt_secret}
 
@@ -397,7 +401,10 @@ JWT_SECRET = ${oauth2_jwt_secret}
 
 [service]
 DISABLE_REGISTRATION = ${GITEA_DISABLE_REGISTRATION}
-REQUIRE_SIGNIN_VIEW = true
+; false (GitHub-style): public repos can be browsed and cloned over HTTP(S)
+; without signing in. Private repos still require auth either way -- this
+; only affects whether the sign-in wall covers public content too.
+REQUIRE_SIGNIN_VIEW = false
 DEFAULT_KEEP_EMAIL_PRIVATE = true
 DEFAULT_ALLOW_CREATE_ORGANIZATION = true
 
@@ -406,6 +413,9 @@ DEFAULT_ALLOW_CREATE_ORGANIZATION = true
 ; which keeps log rotation the host's job (journald) instead of ours.
 MODE = console
 LEVEL = info
+; Logs each SSH connection to the built-in SSH server -- who connected and
+; which key/repo -- the SSH-side counterpart of the HTTP access log.
+ENABLE_SSH_LOG = true
 EOF
 }
 
@@ -490,7 +500,14 @@ EOF
 
 start_service() {
     log "Starting ${UNIT_NAME}..."
-    systemctl enable "$UNIT_NAME"
+    # NOT 'systemctl enable': Quadlet units are transient/generated (they live
+    # under /run/systemd/generator/, regenerated from the .container file on
+    # every daemon-reload and boot), and systemd refuses to enable those --
+    # "Failed to enable unit: Unit .../gitea.service is transient or generated".
+    # The generator itself already applies this file's [Install] section (the
+    # WantedBy=multi-user.target above) every time it regenerates the unit,
+    # which is what makes it come back up on the next boot -- no enable step
+    # needed, and none is possible.
     systemctl restart "$UNIT_NAME"
 }