diff --git a/charts/forgejo-proxy/Chart.yaml b/charts/forgejo-proxy/Chart.yaml
new file mode 100644
index 0000000..bb94e01
--- /dev/null
+++ b/charts/forgejo-proxy/Chart.yaml
@@ -0,0 +1,5 @@
+apiVersion: v2
+name: forgejo-proxy
+description: Traefik-Route forgejo.boday-it.ch -> Forgejo auf BITCLAW01 (ausserhalb des Clusters)
+type: application
+version: 0.1.0
diff --git a/charts/forgejo-proxy/templates/ingress.yaml b/charts/forgejo-proxy/templates/ingress.yaml
new file mode 100644
index 0000000..7588bc5
--- /dev/null
+++ b/charts/forgejo-proxy/templates/ingress.yaml
@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: forgejo
+  annotations:
+    cert-manager.io/cluster-issuer: {{ .Values.clusterIssuer | quote }}
+spec:
+  ingressClassName: traefik
+  tls:
+    - secretName: forgejo-tls
+      hosts:
+        - {{ .Values.host | quote }}
+  rules:
+    - host: {{ .Values.host | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: forgejo-external
+                port:
+                  name: https
diff --git a/charts/forgejo-proxy/templates/serverstransport.yaml b/charts/forgejo-proxy/templates/serverstransport.yaml
new file mode 100644
index 0000000..17626ca
--- /dev/null
+++ b/charts/forgejo-proxy/templates/serverstransport.yaml
@@ -0,0 +1,9 @@
+# Interner Hop Traefik -> nginx auf BITCLAW01 nutzt das selbstsignierte Zertifikat (CN registry.local).
+# Nach aussen liefert Traefik das gültige Let's-Encrypt-Zertifikat aus.
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: forgejo-transport
+spec:
+  serverName: {{ .Values.backend.serverName | quote }}
+  insecureSkipVerify: true
diff --git a/charts/forgejo-proxy/templates/service.yaml b/charts/forgejo-proxy/templates/service.yaml
new file mode 100644
index 0000000..4098984
--- /dev/null
+++ b/charts/forgejo-proxy/templates/service.yaml
@@ -0,0 +1,30 @@
+# Service ohne Selector: zeigt auf einen Host ausserhalb des Clusters (EndpointSlice unten)
+apiVersion: v1
+kind: Service
+metadata:
+  name: forgejo-external
+  annotations:
+    traefik.ingress.kubernetes.io/service.serversscheme: https
+    traefik.ingress.kubernetes.io/service.serverstransport: {{ .Release.Namespace }}-forgejo-transport@kubernetescrd
+spec:
+  ports:
+    - name: https
+      port: 443
+      protocol: TCP
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: forgejo-external-1
+  labels:
+    kubernetes.io/service-name: forgejo-external
+addressType: IPv4
+ports:
+  - name: https
+    port: {{ .Values.backend.port }}
+    protocol: TCP
+endpoints:
+  - addresses:
+      - {{ .Values.backend.ip | quote }}
+    conditions:
+      ready: true
diff --git a/charts/forgejo-proxy/values.yaml b/charts/forgejo-proxy/values.yaml
new file mode 100644
index 0000000..5548f11
--- /dev/null
+++ b/charts/forgejo-proxy/values.yaml
@@ -0,0 +1,6 @@
+host: forgejo.boday-it.ch
+clusterIssuer: letsencrypt-prod
+backend:
+  ip: 172.25.65.20      # BITCLAW01
+  port: 3005            # nginx (HTTPS) vor Forgejo; von den Talos-Nodes aus bereits freigegeben
+  serverName: registry.local
diff --git a/main.tf b/main.tf
index cf25ab1..8e59844 100644
--- a/main.tf
+++ b/main.tf
@@ -195,6 +195,27 @@ resource "helm_release" "traefik" {
   })]
 }
 
+# --- Forgejo (läuft als Docker auf BITCLAW01) über Traefik veröffentlichen ---
+
+variable "forgejo_host" {
+  type    = string
+  default = "forgejo.boday-it.ch"
+}
+
+resource "helm_release" "forgejo_proxy" {
+  name             = "forgejo-proxy"
+  chart            = "${path.module}/charts/forgejo-proxy"
+  namespace        = "forgejo"
+  create_namespace = true
+
+  set {
+    name  = "host"
+    value = var.forgejo_host
+  }
+
+  depends_on = [helm_release.traefik, helm_release.cluster_issuer]
+}
+
 output "traefik_lb_ip" {
   value = var.traefik_lb_ip
 }