I accidentally allowed unrestricted signups on my publicly accessible gitea instance and came back 6 months later to 20,000 accounts hosting spam and malware. O

I accidentally allowed unrestricted signups on my publicly accessible gitea instance and came back 6 months later to 20,000 accounts hosting spam and malware. Oops. Cleanup required some mysql queries and the cli. Of course its important to pay careful attention to the configuration of any app, I'm just sharing the story of how I stubbed my toe on this furniture. :) My instance is mostly used for archiving / mirroring interesting repos, more so since I had a glancing brush with censorship on github: a contributor to one of my repos was banned, which means entire issues and discussions and PRs they started were vanished overnight. This person was prolific and opened a lot of issues, so my repo became a graveyard of broken references and missing threads with conclusions and plans I no longer remember. Despite the minor scale of my project, this incident was rage inducing; it felt like github rebased my master branch to remove historical commits because someone was offended. Completely inappropriate imo. For self-hosting an archival-oriented mirror, a few features would be nice: 1. Automatically mirror every repo I star on github 2. Continuously mirror issues, discussions, and PRs 3. "safe" mirroring (see #14076), so non-ff/force-push head updates have the old head tagged to preserve history