pal-e-docs

TODO: Forgejo PyPI Registry -- Migrate 22 Public Packages

todo-forgejo-pypi Todo

todo done
Project

Problem

22 Python packages are published to public pypi.org under the ldraney account. These include internal SDKs, MCP servers, and auth libraries that have no reason to be public. PyPI does not offer private packages on the free tier, and packages uploaded more than 72 hours ago cannot be deleted (PEP 763).

Solution

Forgejo has a built-in PyPI package registry — already enabled on our instance (forgejo.tail5b443a.ts.net), zero new infrastructure required. Publish via twine, install via pip, all within Tailnet.
Previous approach (Harbor) was abandoned: Harbor does NOT natively support PyPI registries — it's OCI artifacts only. Confirmed via goharbor/harbor#19381. Harbor continues to handle container images; Forgejo handles Python packages.
Status: Forgejo PyPI registry setup + first package (woodpecker-sdk) is handled by phase-2026-02-28-2-pypi-pipeline of plan-2026-02-28-woodpecker-sdk-mcp. This TODO covers the remaining migration work: republishing the 22 existing public packages to Forgejo and yanking old versions on pypi.org.

What This Enables

  • All SDK/MCP packages stay private on own infrastructure
  • No public exposure of internal tooling
  • pip install from Forgejo instead of pypi.org
  • Woodpecker CI pipelines push packages to Forgejo (same creds, same Tailnet)
  • Full control over package lifecycle, no 72-hour deletion windows

Forgejo PyPI Registry Details

  • Publish URL: https://forgejo.tail5b443a.ts.net/api/packages/forgejo_admin/pypi
  • Install URL: https://forgejo_admin:{token}@forgejo.tail5b443a.ts.net/api/packages/forgejo_admin/pypi/simple
  • Auth: Forgejo username + password or API token
  • Tool: twine upload --repository forgejo dist/* (configure ~/.pypirc)
  • Security note: Use --index-url not --extra-index-url to avoid dependency confusion attacks

Remaining Scope (after Phase 2 establishes the pattern)

  • Migrate existing packages: rebuild and publish all 22 to Forgejo
  • Yank old versions on pypi.org (optional, signals deprecation)
  • Add .woodpecker.yml to each repo (reuse template from Phase 2)
  • Update all pip install references across the platform to use Forgejo index

Existing Public Packages (22 on pypi.org)

  • gcal-mcp-ldraney, gcal-mcp-remote-ldraney, gcal-sdk-ldraney
  • gmail-mcp-ldraney, gmail-mcp-remote-ldraney, gmail-sdk-ldraney
  • ldraney-ebay-oauth, ldraney-ebay-sdk
  • ldraney-forgejo-sdk
  • ldraney-gmail-mcp, ldraney-gmail-sdk
  • ldraney-linkedin-mcp, ldraney-linkedin-sdk
  • ldraney-notion-mcp, ldraney-notion-sdk
  • linkedin-mcp-scheduler-ldraney, linkedin-scheduler-remote-ldraney
  • mcp-remote-auth-ldraney
  • notion-mcp-ldraney, notion-mcp-remote-ldraney, notion-sdk-ldraney
  • pal-e-auth-ldraney
These cannot be deleted from pypi.org (PEP 763, >72h). They can be yanked to discourage installation.
  • plan-2026-02-28-woodpecker-sdk-mcp Phase 2 — establishes Forgejo PyPI + pipeline pattern
  • plan-2026-02-28-woodpecker-mcp — MCP depends on SDK being on Forgejo
  • service-onboarding-sop — Harbor handles container images, Forgejo handles Python packages