docs: document create-repo.sh and import-repo.shfeature/git-repo-scripts

Update CLAUDE.md and the setup guide to point at the new scripts
instead of the old manual git init/clone + chown steps.

2 files changed, 25 insertions, 20 deletions

diff --git a/CLAUDE.md b/CLAUDE.md
index 443c7e0..8ccdef1 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -30,6 +30,8 @@ Bastion is a self-hosted server system on Debian that runs multiple services in
 - Ports: 22 (SSH), 9418 (git daemon)
 - Volumes: `/var/git_ssh_keys` (public keys), `/var/git/repos` (repositories)
 - Host SSH runs on a non-standard port, so port 22 is free for git
+- `git-server/create-repo.sh <name> ["description"]` creates a new bare repo (runs `git init --bare` as the `git` user inside the container, so ownership/perms come out correct for both SSH push and cgit's read-only mount)
+- `git-server/import-repo.sh <source-url> [name]` mirrors an existing external repo (e.g. GitHub/GitLab) in via `git clone --mirror`; re-run `git remote update --prune` inside the container to refresh it later
 
 ### Cgit (git web interface)
 - Dir: `git-server/cgit/`
@@ -162,6 +164,8 @@ Requires `ghost/stack.env`, `admin-panel/.env`, and `share/.env` to exist before
 - `authelia/config/configuration.yml` — Authelia config (OIDC_RSA_KEY_PLACEHOLDER replaced by awk on server)
 - `authelia/config/users_database.yml.example` — user database template (real file gitignored)
 - `git-server/gerrit.config.example` — Gerrit config template (real file gitignored, lives at `/var/gerrit/etc/gerrit.config`)
+- `git-server/create-repo.sh` — create a new bare repo for cgit/SSH access
+- `git-server/import-repo.sh` — mirror an external repo (GitHub/GitLab/etc.) into the server
 - `ghost/.env.example` — template for Ghost env vars
 - `doc/git-performance.md` — git server performance tuning guide
 - `nginx/error-pages/unknown-host.html` — 404 page for unknown subdomains
diff --git a/doc/setup-guide.md b/doc/setup-guide.md
index b8fcef3..e69ddf0 100644
--- a/doc/setup-guide.md
+++ b/doc/setup-guide.md
@@ -102,48 +102,49 @@ docker compose -f server.yaml up -d
 
 ### 4.3 Create a test repository
 
+Use `git-server/create-repo.sh` from the bastion repo root (run on the
+server, not inside the container). It runs `git init --bare` as the `git`
+user inside the running `git-server` container, so ownership and
+permissions come out correct without manual `chown`:
+
 ```bash
-# On the server
-cd /var/git/repos
-git init --bare test.git
-chown -R 1000:1000 test.git  # git user inside container
+./git-server/create-repo.sh test
+```
 
+```bash
 # From a client machine
 git clone ssh://git@<server-ip>/repos/test.git
 or
 git clone git://<server-ip>/test.git
 ```
 
+Optionally pass a description: `./git-server/create-repo.sh test "my test repo"`.
+Repo names can include subdirectories, e.g. `team/project`.
+
 ### 4.4 Import an existing repository
 
-To make a one-time copy of an existing repository (e.g., from GitHub):
+Use `git-server/import-repo.sh` to mirror an existing repository (e.g. from
+GitHub or GitLab) into the server:
 
 ```bash
-cd /var/git/repos
-git clone --bare https://github.com/user/repo.git
-chown -R 1000:1000 repo.git
+./git-server/import-repo.sh https://github.com/user/repo.git
 ```
 
-This copies all branches, tags, and history. The remote reference is removed,
-so it becomes a standalone copy with no link back to the original.
-
-To keep syncing from the original source, use `--mirror` instead:
+This runs `git clone --mirror` as the `git` user inside the `git-server`
+container, straight into `/repos/repo.git`. By default the local repo name
+is taken from the source URL; pass a second argument to override it:
 
 ```bash
-cd /var/git/repos
-git clone --mirror https://github.com/user/repo.git
-chown -R 1000:1000 repo.git
+./git-server/import-repo.sh https://github.com/user/repo.git my-name
 ```
 
-This keeps the remote configured so you can periodically pull updates:
+`--mirror` is a one-time snapshot that keeps the remote configured, so you
+can pull in upstream changes later:
 
 ```bash
-cd /var/git/repos/repo.git
-git remote update
+docker exec -u git git-server git --git-dir='/repos/repo.git' remote update --prune
 ```
 
-`--mirror` syncs all refs exactly, including deleted branches.
-
 
 ## 5. Ghost (Blog)