# hart org

> Organization settings: the organization's Git providers

URL: https://docs.harthelm.dev/reference/hart/org/ · Harthelm v1.6.1

Commands for an organization's owners (and cluster admins). `--org` names the organization by its id or
by its exact name (any case); without it, the organization of the current team (`--team`, `HART_TEAM`,
the context).

```text
hart org [flags]
hart org [command]
```

| Flag | Description |
|---|---|
| `--org string` | the organization: its id or exact name (default: the current team's) |

Subcommands:

- [`hart org git-providers`](#org-git-providers): Git providers the organization registers for its teams

## hart org git-providers

An organization's owners register Gitea or Forgejo servers for the organization's teams, next to the
installation's providers. Members connect their own account to one in the console (Account settings, Git
connections), and workspaces of the organization's teams clone through it. A provider is named by the
organization's id for it (ID); everywhere else it goes by its ref, \<ID\>-\<the organization's suffix\>.
The client secret is never shown and never taken from the command line.

```text
hart org git-providers [flags]
hart org git-providers [command]
```

Aliases: `git-providers`, `git-provider`.

Subcommands:

- [`hart org git-providers add`](#org-git-providers-add): Register a Git provider for the organization
- [`hart org git-providers list`](#org-git-providers-list): List the organization's Git providers
- [`hart org git-providers redirect-uri`](#org-git-providers-redirect-uri): Print the redirect URI of a provider, also before it exists
- [`hart org git-providers retire`](#org-git-providers-retire): Retire one of the organization's Git providers
- [`hart org git-providers update`](#org-git-providers-update): Change one of the organization's Git providers

### hart org git-providers add

Registers a Gitea (or Forgejo) server for the organization's teams. First create an OAuth2 application at
the provider with the redirect URI that 'hart org git-providers redirect-uri ID' prints, then pass its client
id here. The client secret is never an argument: `--client-secret-file` reads it from a file, otherwise it is
read without echo from the terminal, or all of stdin when it is piped (one trailing newline is dropped).
`--ca-file` adds the PEM certificates of a private CA that signed the provider's HTTPS certificate.

The URL must be https. Loopback and link-local addresses, names inside the cluster, single-label names and
IP literals of private ranges are refused: register the provider by its DNS name. Registering a retired ID
again brings the provider back with the new settings.

```text
hart org git-providers add ID --url URL --client-id CLIENT_ID [flags]
```

Examples:

```sh
hart org git-providers redirect-uri forge --org Acme
hart org git-providers add forge --org Acme --url https://git.acme.example --client-id 3b5c1f0e --client-secret-file forge.secret
op read op://it/forge/secret | hart org git-providers add forge --url https://git.acme.example --client-id 3b5c1f0e
```

| Flag | Description |
|---|---|
| `--ca-file string` | PEM certificates of the CA of the provider's HTTPS (- reads stdin) |
| `--client-id string` | the client id of the provider's OAuth2 application |
| `--client-secret-file string` | read the client secret from this file (default: the terminal, or stdin) |
| `--kind string` | the provider's kind: gitea (Forgejo speaks the same API) (default "gitea") |
| `--name string` | the name members see (default: the id) |
| `--url string` | the provider's web URL (https://host[:port][/path]) |

### hart org git-providers list

Lists the providers the organization registered, ordered by id (the installation's own are not listed;
GET /git/providers shows both). Secrets are never shown. `--all` adds the retired ones.

```text
hart org git-providers list [flags]
```

Aliases: `list`, `ls`.

| Flag | Description |
|---|---|
| `--all` | also list retired providers |

### hart org git-providers redirect-uri

Prints the redirect URI to register in the provider's OAuth2 application: the one of the registered
provider, or, for an ID not registered yet, https://\<console\>/auth/git/\<ID\>-\<the organization's suffix\>/callback,
so the OAuth2 application can be created before 'hart org git-providers add'.

```text
hart org git-providers redirect-uri ID [flags]
```

### hart org git-providers retire

Nobody can connect the provider any more, every member's connection to it is deleted, and workspaces lose
access to its repositories (their files stay). The stored secret and CA are wiped. Registering the same ID
again brings it back. Asks first on a terminal; otherwise it needs `--yes`.

```text
hart org git-providers retire ID [flags]
```

| Flag | Description |
|---|---|
| `-y, --yes` | do not ask for confirmation |

### hart org git-providers update

Sends only what is named. A new client secret comes from `--client-secret-file`, or with `--new-client-secret`
from the terminal without echo (or all of stdin); never from the command line. `--ca-file` replaces the CA,
`--remove-ca` removes it. A `--url` on another host needs the client secret again, and it disconnects every
member: their tokens belong to the old host.

```text
hart org git-providers update ID [flags]
```

Examples:

```sh
hart org git-providers update forge --name "Acme Forge"
hart org git-providers update forge --url https://forge.acme.example --client-secret-file forge.secret
```

| Flag | Description |
|---|---|
| `--ca-file string` | replace the CA with the PEM certificates of this file (- reads stdin) |
| `--client-id string` | the client id of the provider's OAuth2 application |
| `--client-secret-file string` | read a new client secret from this file |
| `--name string` | the name members see |
| `--new-client-secret` | read a new client secret from the terminal without echo, or from stdin |
| `--remove-ca` | remove the CA; the provider's HTTPS is checked against the system's roots |
| `--url string` | the provider's web URL (https://host[:port][/path]) |