Instance-wide (global) info banner and maintenance mode (#36571)

The banner allows site operators to communicate important announcements
(e.g., maintenance windows, policy updates, service notices) directly
within the UI.

The maintenance mode only allows admin to access the web UI.

* Fix #2345
* Fix #9618

---------

Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>

routers/common/errpage.go

@@ -13,6 +13,7 @@ import (
 	user_model "code.gitea.io/gitea/models/user"
 	"code.gitea.io/gitea/modules/httpcache"
 	"code.gitea.io/gitea/modules/log"
+	"code.gitea.io/gitea/modules/reqctx"
 	"code.gitea.io/gitea/modules/setting"
 	"code.gitea.io/gitea/modules/templates"
 	"code.gitea.io/gitea/modules/web/middleware"
@@ -36,9 +37,7 @@ func renderServerErrorPage(w http.ResponseWriter, req *http.Request, respCode in
 		w.Header().Set(`X-Frame-Options`, setting.Security.XFrameOptions)
 	}
 
-	tmplCtx := context.NewTemplateContext(req.Context(), req)
-	tmplCtx["Locale"] = middleware.Locale(w, req)
-
+	tmplCtx := context.NewTemplateContextForWeb(reqctx.FromContext(req.Context()), req, middleware.Locale(w, req))
 	w.WriteHeader(respCode)
 
 	outBuf := &bytes.Buffer{}

routers/common/maintenancemode.go

@@ -0,0 +1,43 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package common
+
+import (
+	"net/http"
+	"strings"
+
+	"code.gitea.io/gitea/modules/setting"
+)
+
+func isMaintenanceModeAllowedRequest(req *http.Request) bool {
+	if strings.HasPrefix(req.URL.Path, "/-/") {
+		// URLs like "/-/admin", "/-/fetch-redirect" and "/-/markup" are still accessible in maintenance mode
+		return true
+	}
+	if strings.HasPrefix(req.URL.Path, "/api/internal/") {
+		// internal APIs should be allowed
+		return true
+	}
+	if strings.HasPrefix(req.URL.Path, "/user/") {
+		// URLs like "/user/signin" and "/user/signup" are still accessible in maintenance mode
+		return true
+	}
+	if strings.HasPrefix(req.URL.Path, "/assets/") {
+		return true
+	}
+	return false
+}
+
+func MaintenanceModeHandler() func(h http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(resp http.ResponseWriter, req *http.Request) {
+			maintenanceMode := setting.Config().Instance.MaintenanceMode.Value(req.Context())
+			if maintenanceMode.IsActive() && !isMaintenanceModeAllowedRequest(req) {
+				renderServiceUnavailable(resp, req)
+				return
+			}
+			next.ServeHTTP(resp, req)
+		})
+	}
+}