Public downloads: the installer and the updater come from Gitea releases, no token

REQUIRE_SIGNIN_VIEW is off and mitchell/hamlab is public, so anyone can clone it or pull
a release. The other five repos are individually private and 404 to anonymous. Gitea
resolves releases/download/latest/<asset>, so the install one-liner and HAMLAB_URL point
at the newest release and never need changing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

PLAN.md

@@ -398,6 +398,17 @@ something long in one, switch away and back, refresh — it's all still there.
   **not** part of `make deploy`, because deploy pushes this build to the machines this hub
   owns while publishing offers it to every install anywhere, and one tag per deploy would
   be noise. Re-publishing a version needs `--force`.
+  **Public since 2026-09-23**, at Mitchell's instruction and after the trade was put to him
+  twice: Gitea's instance-wide `REQUIRE_SIGNIN_VIEW` is off and `mitchell/hamlab` is marked
+  public, so anyone can browse it, clone it and download a release with no account. The
+  other five repos there are each marked private and are invisible — an anonymous request
+  for one is a 404, not a login prompt — registration is still disabled, and new repos
+  still default to private. No token is needed by anything any more (the read-only one was
+  revoked; only `hamlab-publish`, which creates releases, remains). Gitea resolves
+  `releases/download/latest/<asset>`, so `install.sh` and `HAMLAB_URL` now point straight
+  at the newest release and never need changing; the rolling copy on
+  `hamlab-demo.bigham.dev` stays as a mirror. What is public is the source, the history,
+  `BUGS.md` and this file — which describes the lab and names the console's hostname.
 - **Auth hardening** — WebAuthn passkeys (phone Face ID), TOTP fallback, optional NPM
   access list restricting to WireGuard/LAN.
 - **Files tab** — **shipped 2026-09-18** (`internal/files`, `Files.tsx`): browse from
@@ -426,28 +437,6 @@ something long in one, switch away and back, refresh — it's all still there.
 
 ## To do
 
-- **Somewhere public to download from** — asked for 2026-09-22, half done. The **updater**
-  shipped 2026-09-23 (above) and reads releases from Gitea, but `git.bigham.dev` runs with
-  `REQUIRE_SIGNIN_VIEW=true`, so those releases are reachable only with a token. That is
-  fine for this fleet — each machine carries a read-only `read:repository` token — and no
-  use at all to a stranger running the `install.sh` one-liner, who still gets the rolling
-  copy on `hamlab-demo.bigham.dev`. What is left is deciding where a public download
-  actually lives:
-  - **Lower the wall on Gitea.** `REQUIRE_SIGNIN_VIEW=false` and per-repo visibility does
-    the rest: every repo there is private and stays hidden, and only a repo marked public
-    is visible. That is how Gitea is meant to be configured, and it is the one change that
-    makes "releases on my Gitea" literally true. It is an instance-wide posture change on
-    a public hostname, so it is Mitchell's call — the same trade was declined once before
-    (`docs/docker.md`, the demo site's `install.sh` is hosted outside Gitea for exactly
-    this reason).
-  - **Or keep the wall and keep the demo site** as the public face: `make publish` already
-    writes the rolling `dl/` directory there, and a generated index page (version, built
-    when, a row per architecture with size and checksum, the one-line install, and that
-    the binaries are unsigned and served from his own box) would finish the "page" half
-    without touching Gitea at all.
-  - Either way the release notes and version history live on Gitea, and the updater does
-    not care which of the two it is pointed at.
-
 - **Deprecate copyparty** — asked for 2026-09-23, not started. `copyparty` on `grid`
   (`copyparty.service`, `:3923`, `/etc/copyparty.conf`, serving all of `/tank` as user
   `core` with one account behind NPM) overlaps the **Files** tab almost entirely. The aim

README.md

@@ -20,15 +20,16 @@ sudo ./hamlab-linux-amd64 install          # that's the whole install
 or, from wherever `make release` output is served:
 
 ```sh
-curl -fsSL https://hamlab-demo.bigham.dev/install.sh | sh        # asks: user, address, HTTPS, firewall, password
-curl -fsSL https://hamlab-demo.bigham.dev/install.sh | sh -s -- --yes                              # asks nothing, all defaults
-curl -fsSL https://hamlab-demo.bigham.dev/install.sh | sh -s -- --listen 0.0.0.0:8100 --tls auto   # flags go to `hamlab install`
+curl -fsSL https://git.bigham.dev/mitchell/hamlab/releases/download/latest/install.sh | sh        # asks: user, address, HTTPS, firewall, password
+curl -fsSL https://git.bigham.dev/mitchell/hamlab/releases/download/latest/install.sh | sh -s -- --yes                              # asks nothing, all defaults
+curl -fsSL https://git.bigham.dev/mitchell/hamlab/releases/download/latest/install.sh | sh -s -- --listen 0.0.0.0:8100 --tls auto   # flags go to `hamlab install`
 ```
 
 `install.sh` is a wizard when there is a terminal (it reads answers from `/dev/tty`, so it
 works piped from curl) and silent otherwise. Either way it picks the build for `uname -m`,
 checks it against `SHA256SUMS` and runs `hamlab install`; re-running it upgrades in place.
-`make publish` puts a release where that URL serves it (`HAMLAB_URL` points it elsewhere); run it beside the `hamlab-linux-*` files and it installs offline.
+`latest` is an alias Gitea resolves to the newest release, so that URL never changes.
+`make gitea-release` publishes a release there (`HAMLAB_URL` points the installer elsewhere); run the script beside the `hamlab-linux-*` files and it installs offline.
 `hamlab install`:
 
 - copies the binary to `/usr/local/bin` (`--prefix`), atomically;

install.sh

@@ -15,6 +15,8 @@
 #   ./install.sh                 # beside the hamlab-linux-* files: installs offline
 #
 #   HAMLAB_URL       where hamlab-linux-<arch>, SHA256SUMS and VERSION are served from —
+#                    by default the newest release on Gitea; "latest" is an alias Gitea
+#                    resolves to the most recent release, so the URL never needs changing —
 #                    any static file host, or a Gitea/Forgejo release's download URL
 #   HAMLAB_TOKEN     access token, when that place is a private Gitea/Forgejo repo
 #   NO_COLOR         plain output
@@ -22,7 +24,7 @@
 # POSIX sh: runs under dash, busybox ash and bash alike.
 set -eu
 
-HAMLAB_URL="${HAMLAB_URL:-https://hamlab-demo.bigham.dev/dl}"
+HAMLAB_URL="${HAMLAB_URL:-https://git.bigham.dev/mitchell/hamlab/releases/download/latest}"
 BUILT_FOR="@VERSION@" # filled in by `make release`
 
 # ─────────────────────────────────────────────────────────────── looks ──