From e1b8995a722899dfc38dc0cb95f5fa695f72a4c1 Mon Sep 17 00:00:00 2001 From: Roman Fischer Date: Wed, 18 Feb 2026 21:10:16 +0100 Subject: [PATCH] Initial commit --- .env.example | 21 ++++++++++ .gitignore | 1 + README.md | 97 +++++++++++++++++++++++++++++++++++++++++++++- docker-compose.yml | 69 +++++++++++++++++++++++++++++++++ 4 files changed, 187 insertions(+), 1 deletion(-) create mode 100644 .env.example create mode 100644 .gitignore create mode 100644 docker-compose.yml diff --git a/.env.example b/.env.example new file mode 100644 index 0000000..c9d1baa --- /dev/null +++ b/.env.example @@ -0,0 +1,21 @@ +### Shared network with your existing Traefik/Postgres stack +SHARED_NETWORK_NAME=web + +### Public domain for Gitea (requested subdomain: git) +GITEA_DOMAIN=git.example.com + +### Container user mapping +GITEA_UID=1000 +GITEA_GID=1000 + +### Existing Postgres connection (from your main stack) +GITEA_DB_HOST=postgres +GITEA_DB_PORT=5432 +GITEA_DB_NAME=gitea +GITEA_DB_USER=gitea +GITEA_DB_PASSWORD=change-me + +### Gitea Actions runner +GITEA_RUNNER_NAME=gitea-runner-01 +GITEA_RUNNER_LABELS=ubuntu-latest:docker://node:20-bookworm,linux_amd64:host +GITEA_RUNNER_REGISTRATION_TOKEN=replace-with-runner-token diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..4c49bd7 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +.env diff --git a/README.md b/README.md index b007fe4..eb2514d 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,97 @@ -# gitea-setup +# Gitea Docker Setup (Traefik + Existing Postgres + Actions Runner) +This project deploys: +- `gitea` behind your existing Traefik reverse proxy +- `gitea-runner` for CI/CD (Gitea Actions) +- connection to your already running Postgres in the shared Docker network + +## What this is built for + +- Existing stack already provides: + - Traefik with Let's Encrypt + - Postgres service named `postgres` + - shared Docker network via `${SHARED_NETWORK_NAME}` +- Gitea should be reachable at subdomain `git` (for example `git.example.com`) + +## Files + +- `docker-compose.yml`: Gitea + Actions runner stack +- `.env.example`: required environment variables + +## 1) Prepare environment + +```bash +cp .env.example .env +``` + +Edit `.env` and set: +- `SHARED_NETWORK_NAME` to the same network name used by your main stack +- `GITEA_DOMAIN` to your git subdomain (for example `git.example.com`) +- Postgres credentials for a dedicated Gitea database/user + +## 2) Create Postgres DB/User (on your existing DB) + +If not already present, create dedicated credentials for Gitea in your existing Postgres: + +```sql +CREATE USER gitea WITH PASSWORD 'change-me'; +CREATE DATABASE gitea OWNER gitea; +GRANT ALL PRIVILEGES ON DATABASE gitea TO gitea; +``` + +Use your own secure password and update `.env`. + +## 3) DNS + +Create an `A`/`AAAA` record for: +- `git.` -> your server IP + +## 4) Start services + +```bash +docker compose up -d +``` + +## 5) Create the first admin user + +Run the CLI inside the container as the non-root `git` user: + +```bash +docker exec -u git -it gitea gitea admin user create \ + --username youradmin \ + --password 'StrongPasswordHere' \ + --email you@example.com \ + --admin \ + --must-change-password=false +``` + +Public sign-up is disabled by default in this stack (`GITEA__service__DISABLE_REGISTRATION=true`). + +## 6) Runner registration token + +1. Open `https://` +2. Login as admin +3. Go to: + - Site level: `Administration -> Actions -> Runners` + - or Org/Repo level: `Settings -> Actions -> Runners` +4. Generate registration token +5. Put token into `.env` as `GITEA_RUNNER_REGISTRATION_TOKEN` +6. Restart runner: + +```bash +docker compose up -d gitea-runner +``` + +## 7) Verify + +```bash +docker compose ps +docker compose logs -f gitea +docker compose logs -f gitea-runner +``` + +## Notes + +- This setup uses HTTPS via Traefik labels and Let's Encrypt from your existing stack. +- Git over SSH is not enabled in this compose because your current Traefik config only exposes `:80` and `:443`. HTTPS clone/push works directly. +- Gitea Actions is enabled (`GITEA__actions__ENABLED=true`). diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..4b3ace2 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,69 @@ +services: + gitea: + image: gitea/gitea:latest + container_name: gitea + restart: unless-stopped + environment: + - USER_UID=${GITEA_UID} + - USER_GID=${GITEA_GID} + - GITEA__server__DOMAIN=${GITEA_DOMAIN} + - GITEA__server__ROOT_URL=https://${GITEA_DOMAIN}/ + - GITEA__server__SSH_DOMAIN=${GITEA_DOMAIN} + - GITEA__server__HTTP_PORT=3000 + - GITEA__server__SSH_PORT=22 + - GITEA__database__DB_TYPE=postgres + - GITEA__database__HOST=${GITEA_DB_HOST}:${GITEA_DB_PORT} + - GITEA__database__NAME=${GITEA_DB_NAME} + - GITEA__database__USER=${GITEA_DB_USER} + - GITEA__database__PASSWD=${GITEA_DB_PASSWORD} + - GITEA__security__INSTALL_LOCK=true + - GITEA__service__DISABLE_REGISTRATION=true + - GITEA__actions__ENABLED=true + - GITEA__actions__DEFAULT_ACTIONS_URL=self + volumes: + - gitea_data:/data + - /etc/timezone:/etc/timezone:ro + - /etc/localtime:/etc/localtime:ro + labels: + - traefik.enable=true + - traefik.docker.network=${SHARED_NETWORK_NAME} + - traefik.http.routers.gitea.rule=Host(`${GITEA_DOMAIN}`) + - traefik.http.routers.gitea.entrypoints=websecure + - traefik.http.routers.gitea.tls=true + - traefik.http.routers.gitea.tls.certresolver=letsencrypt + - traefik.http.services.gitea.loadbalancer.server.port=3000 + networks: + - web + + gitea-runner: + image: gitea/act_runner:latest + container_name: gitea-runner + restart: unless-stopped + depends_on: + - gitea + environment: + - GITEA_INSTANCE_URL=http://gitea:3000 + - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN} + - GITEA_RUNNER_NAME=${GITEA_RUNNER_NAME} + - GITEA_RUNNER_LABELS=${GITEA_RUNNER_LABELS} + volumes: + - gitea_runner_data:/data + - /var/run/docker.sock:/var/run/docker.sock + command: >- + sh -c " + if [ ! -f /data/.runner ]; then + act_runner register --no-interactive --instance $${GITEA_INSTANCE_URL} --token $${GITEA_RUNNER_REGISTRATION_TOKEN} --name $${GITEA_RUNNER_NAME}; + fi; + act_runner daemon + " + networks: + - web + +volumes: + gitea_data: + gitea_runner_data: + +networks: + web: + external: true + name: ${SHARED_NETWORK_NAME}