From 7bf72a39d8a82b356248a968f0298c9d29d2070c Mon Sep 17 00:00:00 2001
From: Martin McCaffery <martin.mccaffery@think-ahead.tech>
Date: Tue, 17 Mar 2026 14:06:06 +0100
Subject: [PATCH] Enforce MFA for all admin users

---
 template/stacks/forgejo/forgejo-server/values.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/template/stacks/forgejo/forgejo-server/values.yaml b/template/stacks/forgejo/forgejo-server/values.yaml
index 1c3ad14..38ae176 100644
--- a/template/stacks/forgejo/forgejo-server/values.yaml
+++ b/template/stacks/forgejo/forgejo-server/values.yaml
@@ -137,6 +137,9 @@ gitea:
       ENABLED: true
       ADAPTER: redis
 
+    security:
+      GLOBAL_TWO_FACTOR_REQUIREMENT: admin
+
     service:
       DISABLE_REGISTRATION: true
       ENABLE_NOTIFY_MAIL: true