OpenVibe Git moves to git.openvibe.codes (its DNS name exists since 2026-10-21); openvibe.codes/git/… redirects to the same path there (#93)

ddiff --git a/README.md b/README.md
iindex 0df2386..3b8cc70 100644
---- a/README.md
++++ b/README.md
@@@ -8,7 +8,7 @@
  **License:** AGPL-3.0 (same as every OpenVibe service).
  
  
--**OpenVibe Git** (since 2026-10-15): Forgejo at [openvibe.codes/git](https://openvibe.codes/git/), signed in with your OpenVibe account, with read mirrors of the OpenVibers GitHub repositories. Install and operations: [deploy/forgejo](deploy/forgejo/README.md).
++**OpenVibe Git** (since 2026-10-15): Forgejo at [git.openvibe.codes](https://git.openvibe.codes/) (its first address, openvibe.codes/git, redirects there), signed in with your OpenVibe account, with read mirrors of the OpenVibers GitHub repositories. Install and operations: [deploy/forgejo](deploy/forgejo/README.md).
  ## Purpose
  
  One place to send a coding task to the agent that fits it — by what the task needs first, then by cost — hand it over when one agent gets stuck, and keep the run in one place; and the front door for anyone who wants to improve OpenVibe itself. The agents run on people's own machines or OpenVibe's; Codes routes, records and hands off, and never holds a person's provider keys in the clear.
ddiff --git a/deploy/forgejo/README.md b/deploy/forgejo/README.md
iindex 06ba27d..a989083 100644
---- a/deploy/forgejo/README.md
++++ b/deploy/forgejo/README.md
@@@ -1,8 +1,8 @@
  # OpenVibe Git (Forgejo)
  
--The OpenVibe projects' own Git host, at **https://openvibe.codes/git/**. It runs Forgejo, which is lighter than GitLab
--on the 15 GB host. It moves to `git.openvibe.codes` once that DNS name exists: change `ROOT_URL`, `DOMAIN` and the
--redirect URI.
++The OpenVibe projects' own Git host, at **https://git.openvibe.codes/** (since 2026-10-21; it began at
++`openvibe.codes/git/` on 2026-10-15, and every old address redirects to the same path on the new host). It runs Forgejo,
++which is lighter than GitLab on the 15 GB host.
  
  - **Sign-in:** people sign in with their OpenVibe account through OpenVibe.Network's OpenID Connect (the OAuth client
    `forgejo`, which Network seeds). There is no local sign-up; the first sign-in creates the account with the OpenVibe
@@@ -10,7 +10,7 @@ redirect URI.
  - **Mirrors:** the `OpenVibers` organisation holds read mirrors of the public GitHub repositories, pulled hourly.
    GitHub stays canonical until a repository is moved here, one at a time. Then the direction flips to a push mirror
    to GitHub.
--- **Cloning:** HTTPS only. `openvibe.codes` is behind Cloudflare's proxy, which carries no SSH.
++- **Cloning:** HTTPS only. `git.openvibe.codes` is behind Cloudflare's proxy, which carries no SSH.
  - **Off:** mail, Actions (CI) and federation are off for now; turn them on in `app.ini` when they have a job.
  
  ## Files
@@@ -24,7 +24,8 @@ redirect URI.
  | `setup-sso.sh` | The site admin (a random password in `/root/forgejo-admin.txt`) and the OpenVibe sign-in. The client secret is read from Network's database. |
  | `mirror-github.sh [file]` | The `OpenVibers` organisation and one pull mirror per public repository: names from `gh`, or one per line in `file`. |
  
--nginx: `deploy/nginx/openvibe.codes.conf` proxies `^~ /git/` to `127.0.0.1:5060`, streamed, with a 512 MB limit.
++nginx: `deploy/nginx/openvibe.codes.conf` serves `git.openvibe.codes` from `127.0.0.1:5060`, streamed, with a 512 MB
++limit, and answers `openvibe.codes/git/…` with a permanent redirect to the same path there.
  
  ## Install (on the host, from the Codes checkout)
  
ddiff --git a/deploy/forgejo/app.ini.template b/deploy/forgejo/app.ini.template
iindex a7dc2c5..060d4f0 100644
---- a/deploy/forgejo/app.ini.template
++++ b/deploy/forgejo/app.ini.template
@@@ -1,4 +1,4 @@
--; OpenVibe Git: Forgejo at https://openvibe.codes/git/ (deploy/forgejo/install.sh writes /etc/forgejo/app.ini from this).
++; OpenVibe Git: Forgejo at https://git.openvibe.codes/ (deploy/forgejo/install.sh writes /etc/forgejo/app.ini from this).
  ; @VALUES@ are filled in on the host; the secrets are generated there and never leave it.
  APP_NAME = OpenVibe Git
  RUN_USER = forgejo
@@@ -9,9 +9,9 @@ WORK_PATH = /var/lib/forgejo
  PROTOCOL = http
  HTTP_ADDR = 127.0.0.1
  HTTP_PORT = 5060
--DOMAIN = openvibe.codes
--ROOT_URL = https://openvibe.codes/git/
--; Cloning and pushing are over HTTPS only: openvibe.codes is behind Cloudflare's proxy, which carries no SSH.
++DOMAIN = git.openvibe.codes
++ROOT_URL = https://git.openvibe.codes/
++; Cloning and pushing are over HTTPS only: git.openvibe.codes is behind Cloudflare's proxy, which carries no SSH.
  DISABLE_SSH = true
  START_SSH_SERVER = false
  LANDING_PAGE = explore
ddiff --git a/deploy/forgejo/openvibe-forgejo.service b/deploy/forgejo/openvibe-forgejo.service
iindex 97e9849..02be191 100644
---- a/deploy/forgejo/openvibe-forgejo.service
++++ b/deploy/forgejo/openvibe-forgejo.service
@@@ -1,5 +1,5 @@
  [Unit]
--Description=OpenVibe Git (Forgejo) at https://openvibe.codes/git/
++Description=OpenVibe Git (Forgejo) at https://git.openvibe.codes/
  After=network.target postgresql.service
  Wants=postgresql.service
  
ddiff --git a/deploy/nginx/openvibe.codes.conf b/deploy/nginx/openvibe.codes.conf
iindex 9bd37d6..fc85211 100644
---- a/deploy/nginx/openvibe.codes.conf
++++ b/deploy/nginx/openvibe.codes.conf
@@@ -23,6 +23,15 @@ server {
      location / { return 301 https://openvibe.codes$request_uri; }
  }
  
++server {
++    listen 80;
++    listen [::]:80;
++    server_name git.openvibe.codes;
++
++    location /.well-known/acme-challenge/ { root /var/www/certbot; }
++    location / { return 301 https://git.openvibe.codes$request_uri; }
++}
++
  server {
      listen 443 ssl;
      listen [::]:443 ssl;
@@@ -103,17 +112,13 @@ server {
      # OpenVibe.Events delivers to 127.0.0.1 directly; nothing from outside reaches /internal/.
      location /internal/ { return 404; }
  
--    # ── OpenVibe Git: Forgejo (deploy/forgejo), its ROOT_URL is https://openvibe.codes/git/ ──
++    # ── OpenVibe Git moved to https://git.openvibe.codes/ (2026-10-21): every old address answers a permanent redirect
++    # to the same path there, query included. Git follows it for a clone's first request and then uses the new URL.
      # ^~ so the dotfile rule below never hides a repository path like /git/OpenVibers/x/src/branch/main/.github/.
--    # Pushes and clones are streamed (no buffering), up to 512 MB a request (Cloudflare's own limit is lower).
--    location = /git { return 301 /git/; }
++    location = /git { return 301 https://git.openvibe.codes/; }
      location ^~ /git/ {
--        client_max_body_size 512m;
--        proxy_request_buffering off;
--        proxy_buffering off;
--        proxy_read_timeout 600s;
--        proxy_send_timeout 600s;
--        proxy_pass http://127.0.0.1:5060/;
++        if ($request_uri ~ ^/git(/.*)$) { return 301 https://git.openvibe.codes$1; }
++        return 301 https://git.openvibe.codes/;
      }
  
      # ── Pages, docs, robots.txt, sitemap, static assets ─────
@@@ -125,3 +130,40 @@ server {
          deny all;
      }
  }
++
++# ── OpenVibe Git: Forgejo (deploy/forgejo) at https://git.openvibe.codes/ (its ROOT_URL) ──────────────
++# The openvibe.codes wildcard certificate covers the name; Cloudflare proxies it (HTTPS only, no SSH).
++# Pushes and clones are streamed (no buffering), up to 512 MB a request (Cloudflare's own limit is lower).
++server {
++    listen 443 ssl;
++    listen [::]:443 ssl;
++    http2 on;
++    server_name git.openvibe.codes;
++    include snippets/security-txt.conf;   # /.well-known/security.txt (the host's file)
++
++    ssl_certificate     /etc/letsencrypt/live/openvibe.codes/fullchain.pem;
++    ssl_certificate_key /etc/letsencrypt/live/openvibe.codes/privkey.pem;
++    ssl_protocols       TLSv1.2 TLSv1.3;
++
++    access_log /var/log/nginx/git.openvibe.codes.access.log;
++    error_log  /var/log/nginx/git.openvibe.codes.error.log;
++
++    add_header X-Content-Type-Options nosniff always;
++    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
++
++    # Forgejo's own Prometheus endpoint stays off the internet (app.ini leaves [metrics] at its default, off).
++    location ~* ^/metrics(/|$) { return 404; }
++
++    location / {
++        client_max_body_size 512m;
++        proxy_request_buffering off;
++        proxy_buffering off;
++        proxy_read_timeout 600s;
++        proxy_send_timeout 600s;
++        proxy_set_header Host $host;
++        proxy_set_header X-Real-IP $remote_addr;
++        proxy_set_header X-Forwarded-For $remote_addr;
++        proxy_set_header X-Forwarded-Proto https;
++        proxy_pass http://127.0.0.1:5060;
++    }
++}