Point links at git.coffeylabs.org after the move from GitHub

GitHub took the organization's repos and GHCR offline on 2026-09-20. Repo,
release, raw-file and clone links now go to Gitea at git.coffeylabs.org,
container images to registry.coffeylabs.org, and GitLab-style /-/blob paths
to Gitea's /src/branch form. Go module paths are identifiers and stay as
they are; links to GitHub issues and pull requests are left as history.

CONTRIBUTING.md

@@ -70,7 +70,7 @@ upgrade migrates its data with no way back, so its version only changes in a
 release of this tool.
 
 Binaries for `linux/amd64` and `linux/arm64` and a `SHA256SUMS` file are
-attached to every [release](https://github.com/Coffey-Labs/ihasmail-oneshot/releases).
+attached to every [release](https://git.coffeylabs.org/coffey-labs/ihasmail-oneshot/releases).
 
 Every release is built by the [release workflow](.github/workflows/release.yml)
 from a tagged commit on `main`, after the tests and a known-vulnerabilities

README.md

@@ -1,12 +1,12 @@
 # ihasmail-oneshot
 
-[![Latest release](https://img.shields.io/github/v/release/Coffey-Labs/ihasmail-oneshot?sort=date)](https://github.com/Coffey-Labs/ihasmail-oneshot/releases/latest)
+[![Latest release](https://img.shields.io/gitea/v/release/coffey-labs/ihasmail-oneshot?gitea_url=https%3A%2F%2Fgit.coffeylabs.org)](https://git.coffeylabs.org/coffey-labs/ihasmail-oneshot/releases/latest)
 [![License: AGPL-3.0-or-later](https://img.shields.io/badge/license-AGPL--3.0--or--later-blue)](LICENSE)
 [![Docs: docs.ihasmail.org](https://img.shields.io/badge/docs-docs.ihasmail.org-0ea5e9)](https://docs.ihasmail.org/install/oneshot/)
 
 **One command that turns a Linux Docker host into a working mail server with
 webmail.** It deploys a fresh [Stalwart](https://stalw.art) mail server and a
-fresh [ihasmail](https://github.com/Coffey-Labs/ihasmail) webmail, links them
+fresh [ihasmail](https://git.coffeylabs.org/coffey-labs/ihasmail) webmail, links them
 together, gets them certificates, and hands you the administrator password and
 the DNS records to publish.
 
@@ -50,8 +50,8 @@ The full list is in [docs/reference.md](docs/reference.md#requirements).
 
 ```bash
 ARCH=amd64   # or arm64
-curl -fsSLO https://github.com/Coffey-Labs/ihasmail-oneshot/releases/latest/download/ihasmail-oneshot-linux-$ARCH.tar.gz
-curl -fsSLO https://github.com/Coffey-Labs/ihasmail-oneshot/releases/latest/download/SHA256SUMS
+curl -fsSLO https://git.coffeylabs.org/coffey-labs/ihasmail-oneshot/releases/download/latest/ihasmail-oneshot-linux-$ARCH.tar.gz
+curl -fsSLO https://git.coffeylabs.org/coffey-labs/ihasmail-oneshot/releases/download/latest/SHA256SUMS
 sha256sum --ignore-missing -c SHA256SUMS
 tar -xzf ihasmail-oneshot-linux-$ARCH.tar.gz
 sudo install -m 0755 ihasmail-oneshot /usr/local/bin/

SECURITY.md

@@ -39,5 +39,5 @@ Out of scope, and best reported upstream:
 
 - Vulnerabilities in Stalwart itself
 - Vulnerabilities in ihasmail itself — see
-  [its security policy](https://github.com/Coffey-Labs/ihasmail/security/policy)
+  [its security policy](https://git.coffeylabs.org/coffey-labs/ihasmail/src/branch/main/SECURITY.md)
 - Vulnerabilities in Caddy or Docker

docs/how-it-works.md

@@ -50,7 +50,7 @@ It deploys three containers:
 | Container | Image | Role |
 | --- | --- | --- |
 | **Stalwart** | `stalwartlabs/stalwart` | The mail server: SMTP, IMAP, POP3, JMAP, CalDAV, CardDAV, spam filtering, DKIM. It holds all the mail and all the accounts |
-| **ihasmail** | `ghcr.io/coffey-labs/ihasmail` | The webmail: mail, calendars, contacts, files and filters in the browser, talking to Stalwart over JMAP. It holds nothing but sessions |
+| **ihasmail** | `registry.coffeylabs.org/coffey-labs/ihasmail` | The webmail: mail, calendars, contacts, files and filters in the browser, talking to Stalwart over JMAP. It holds nothing but sessions |
 | **Caddy** | `caddy` | The HTTPS front: certificates and TLS for the webmail and for Stalwart's web side |
 
 It has two shapes:

docs/reference.md

@@ -39,8 +39,8 @@ unpack:
 
 ```bash
 ARCH=amd64   # or arm64
-curl -fsSLO https://github.com/Coffey-Labs/ihasmail-oneshot/releases/latest/download/ihasmail-oneshot-linux-$ARCH.tar.gz
-curl -fsSLO https://github.com/Coffey-Labs/ihasmail-oneshot/releases/latest/download/SHA256SUMS
+curl -fsSLO https://git.coffeylabs.org/coffey-labs/ihasmail-oneshot/releases/download/latest/ihasmail-oneshot-linux-$ARCH.tar.gz
+curl -fsSLO https://git.coffeylabs.org/coffey-labs/ihasmail-oneshot/releases/download/latest/SHA256SUMS
 sha256sum --ignore-missing -c SHA256SUMS
 tar -xzf ihasmail-oneshot-linux-$ARCH.tar.gz
 sudo install -m 0755 ihasmail-oneshot /usr/local/bin/
@@ -57,7 +57,7 @@ same bytes from the same commit.
 With Go 1.26.8 or newer:
 
 ```bash
-git clone https://github.com/Coffey-Labs/ihasmail-oneshot.git
+git clone https://git.coffeylabs.org/coffey-labs/ihasmail-oneshot.git
 cd ihasmail-oneshot
 go build -o ihasmail-oneshot ./cmd/ihasmail-oneshot
 ```
@@ -168,7 +168,7 @@ docker compose pull && docker compose up -d
 
 - **ihasmail** is safe to move to any newer release that supports your
   Stalwart version. Its release notes say which. The newest is on
-  [ihasmail's releases](https://github.com/Coffey-Labs/ihasmail/releases); its
+  [ihasmail's releases](https://git.coffeylabs.org/coffey-labs/ihasmail/releases); its
   image tag is the version with `+` written as `-`, e.g. `2026.9.13-pr344`.
 - **Stalwart**: read its upgrade notes before changing versions. Check that the
   ihasmail version you run supports the new Stalwart release first, since

internal/config/config.go

@@ -37,7 +37,7 @@ const (
 	DefaultStalwartImage = "stalwartlabs/stalwart:v0.16.22"
 	DefaultCaddyImage    = "caddy:2.11.4"
 
-	IhasmailRepository = "ghcr.io/coffey-labs/ihasmail"
+	IhasmailRepository = "registry.coffeylabs.org/coffey-labs/ihasmail"
 	// NewestIhasmail is the default --ihasmail-image. Only full releases move
 	// this tag; prereleases never do.
 	NewestIhasmail = IhasmailRepository + ":latest"

internal/config/config_test.go

@@ -104,17 +104,17 @@ func TestIhasmailFollowsTheNewestReleaseUnlessNamed(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	if !p.FollowsNewestIhasmail() || p.IhasmailImage != "ghcr.io/coffey-labs/ihasmail:latest" {
+	if !p.FollowsNewestIhasmail() || p.IhasmailImage != "registry.coffeylabs.org/coffey-labs/ihasmail:latest" {
 		t.Errorf("default ihasmail image %q", p.IhasmailImage)
 	}
-	named, err := Options{Domain: "example.com", IhasmailImage: "ghcr.io/coffey-labs/ihasmail:2026.9.13-pr344"}.Validate()
+	named, err := Options{Domain: "example.com", IhasmailImage: "registry.coffeylabs.org/coffey-labs/ihasmail:2026.9.13-pr344"}.Validate()
 	if err != nil {
 		t.Fatal(err)
 	}
 	if named.FollowsNewestIhasmail() {
 		t.Error("a named image is treated as the newest release")
 	}
-	byDigest := "ghcr.io/coffey-labs/ihasmail@sha256:" + strings.Repeat("a", 64)
+	byDigest := "registry.coffeylabs.org/coffey-labs/ihasmail@sha256:" + strings.Repeat("a", 64)
 	if _, err := (Options{Domain: "example.com", IhasmailImage: byDigest}).Validate(); err != nil {
 		t.Errorf("a by-digest image is refused: %v", err)
 	}

internal/docker/docker.go

@@ -66,7 +66,7 @@ func envValue(env, name string) string {
 }
 
 // RepoDigest is an image's by-digest reference in one repository, e.g.
-// ghcr.io/coffey-labs/ihasmail@sha256:..., which names exactly that image for
+// registry.coffeylabs.org/coffey-labs/ihasmail@sha256:..., which names exactly that image for
 // as long as the registry keeps it.
 func RepoDigest(ctx context.Context, image, repository string) (string, error) {
 	out, err := Output(ctx, "image", "inspect", "--format", "{{range .RepoDigests}}{{println .}}{{end}}", image)