[candidature] Gna! software forge hosting

This application is proposed by Loïc Dachary @dachary and Nathanaël Cretin @natct10

• Presentation on the forum: https://forum.chatons.org/t/presentation-de-gna/3409
• Name of the future CHATONS : Gna!
• Legal form of the structure: Horizontal collective
• Site of the future CHATONS : https://gna.org
• Legal notice : https://gna.org/legalese/
• Privacy notice: https://gna.org/privacy-policy/
• Terms of use : https://gna.org/tos/
• Incident and maintenance log : https://gitea.gna.org/Hostea/support/issues
• Documentation : https://enough-community.readthedocs.io/en/latest/
• Backup details : https://enough-community.readthedocs.io/en/latest/services/backup.html
• List of administrative requests: None
• Details on copyright requests: None
• Activity reports: None
• Link to CHATONS' hosting information: https://www.chatons.org/chatons/gna
• Example of a contribution to Free Software:
  • Aravinth Manivannan: https://github.com/realaravinth
  • Loïc Dachary: https://lab.forgefriends.org/dachary
• Example of a popular education approach: None.
• Aravinth Manivannan and Loïc Dachary have admin access to the infrastructure and commit to the CHATON charter

---

Partial copy of the reviewer checklist with the essential elements:

• gna.org is onllne
• Users have access to the main information about the security policy.
• Run mozilla observatory on the gna.org. Note: Some headers could be added to improve the score (D+ See).
• People who have admin access, volunteers or employees commit to a charter regarding points of confidentiality and caution. (in the application form, in the ToS and in the Coc)
• Backup information is listed on the applicant's website (not just in the application). (in the ToS)
• The site indicates where data is hosted (including backups). (in the ToS)
• The site indicates the supplier(s)/subcontractor(s) of the future CHATONS (OVH, in the ToS)
• The site indicates the degree of control the CHATONS has over its infrastructure (in the ToS) => Full control of the machines located in Paris and Berlin; VM installed with Debian by Gna!, hosted at OVH.
• The documentation details the global infrastructure (in the ToS)
• The documentation informs about the processes required to deploy each service. (in the ToS, link to Enough)
• Providers and data localisation. Future CHATONS' vendor(s)/subcontractor(s) are not inconsistent with the charter. If they are, the information is clearly indicated on the future CHATONS' website. (the payment provider is incompatible with the CHATON charter https://gna.org/privacy-policy/#online-payment-provider)
• CHATONS' recurring procedures are documented (possibly in a private part). Example: how to make backups, statistics, how to create an account, a vps to a new person... (in the ToS, link to Enough)
• A document or paragraph describing the security practices and measures to protect the data and infrastructure of the future CHATONS exists. (in the ToS, link to enough unattended upgrades playbook)
• A document on log retention times exists (in the Privacy section)
• The General Terms of Use / GTU are accessible from the future CHATONS' website. (ToS page)
• There is a "Personal Data and Privacy" clause clearly stating what is the CHATONS' policy regarding the practices covered. (link to Privacy page)
• The future CHATONS undertakes in its TOS[GTU] not to arrogate to itself any ownership rights to the content, data and metadata produced by the hosted or the users. (see https://gna.org/legalese/#copyright)
• The GTU allow users to obtain the definitive deletion of any information (accounts and personal data) concerning the hosted, within the limits of legal and technical obligations. (the user is root on its Gitea instance and can delete whatever it contains at any time)
• The GTU provides for the possibility for hosted users to leave the services by recovering the associated data in open formats, where possible. (All projects hosted on Gna! can be migrated out of Gna! using the native migration features, see https://docs.gitea.io/en-us/migrations-interfaces/)
• The Legal Notice is accessible from the future CHATONS' website. (link to legalese link) (see https://gna.org/legalese/)
  • The name of the publication director (in the case of an organization, the legal name of the legal entity). (see https://gna.org/tos/#editorial-responsibility)
  • The name, first name, address and telephone number of the host (see https://gna.org/tos/#editorial-responsibility and https://gna.org/legalese/#hosting with an email instead of a phone number)
  • If necessary, information regarding intellectual property rights (licensing of publications) and the storage policy of cookies and personal
• The site allows all hosted people to communicate with the future CHATONS by highlighting at least one way to do so (support tracker in the ToS) (see https://gna.org/tos/#support)
• It is possible to physically meet, exchange, and participate in the future CHATONS. (see https://gna.org/tos/#human-contact)