Thank you for your answers. This will give me a good starting point.

- ssh, I agree it is on the dangerous side to give another site ssh access and we will evaluate how to do it, even though github takes steps to make it safe (but of course not perfect). Using unrecoverable "secrets" that you can add and will not be visible to anyone (not even the one who did it) after submitting them to the site.

- yes, I'm aware that phpBB is a spambot magnet. So far we have been save because of a very specific registration answer/question and of course because the site on SF is slooooow and every user has to be manually activated (since activation mails don't work on SF).

This will be fun to migrate :)

I'm a developer of Exult ( a recreation of the game engine of the DOS game Ultima VII. Exult is 24 years old and has been on SourceForge for 22 years. With the slow but steady degrading of SourceForge (yes, they got a bit better but not enough) we needed a new home for Exult. Source is on Github but the webpage needs a home that outlasts a single user (I have no problem paying for internet service but what happens when I can't anymore for any reasons and suddenly the webpage is gone?) so tuxfamily seems to be the right place.
Project is approved and now I wanted to ask some things before starting out the migration.

- we are using the domain name that I pay for (probably the only thing I cannot make future proof) and I see that on requesting webspace I can enter that. Question is: should I (yet)? Migration will take a bit and in the meantime our webpage at SF should still work while I want to be able to test things out on tuxfamily. When I enter at the webspace request, can I test it even though still points at the SF page?

- how can I update the webpage automatically? Our webpage source is on github, when we change something there a github action runs, that uploads a zip of the webpage code to SF, then opens an interactive shell there and unzips the webpage to its place. At first glance it looks as if that would work here as well (except you don't need to start an interactive shell but just log in via ssh?).

- AFAICT installing phpBB is not a problem and I guess all the mail stuff works :) (huge problem on SF is that they disabled all outgoing scripts, prwebmail, etc... which makes hosting a support forum a real pain). We have very little traffic :)

- once I have everything set up, the site can be secured via an SSL certificate, right? How is that done?

Sorry for the many questions but I want to do it right before maing a mess :)

Thanks for accepting us :)