A few days late, but I have a pretty similar usecase to you on forgejo.ellis.link. My solution is go-away, git.gammaspectra.live/git/go-away, which just sits as a reverse proxy in between traefik and Forgejo. I haven’t enabled fancy stuff like TLS fingerprinting. It’s been effective enough at killing the bots downloading archives and DDoSing the server from residential IPs. My config is based on the example Forgejo config, but with a few tweaks. Too long to post here, though, so message me if you need access