Initial commit

.env.example

@@ -0,0 +1,21 @@
+### Shared network with your existing Traefik/Postgres stack
+SHARED_NETWORK_NAME=web
+
+### Public domain for Gitea (requested subdomain: git)
+GITEA_DOMAIN=git.example.com
+
+### Container user mapping
+GITEA_UID=1000
+GITEA_GID=1000
+
+### Existing Postgres connection (from your main stack)
+GITEA_DB_HOST=postgres
+GITEA_DB_PORT=5432
+GITEA_DB_NAME=gitea
+GITEA_DB_USER=gitea
+GITEA_DB_PASSWORD=change-me
+
+### Gitea Actions runner
+GITEA_RUNNER_NAME=gitea-runner-01
+GITEA_RUNNER_LABELS=ubuntu-latest:docker://node:20-bookworm,linux_amd64:host
+GITEA_RUNNER_REGISTRATION_TOKEN=replace-with-runner-token

.gitignore

@@ -0,0 +1 @@
+.env

README.md

@@ -1,2 +1,97 @@
-# gitea-setup
+# Gitea Docker Setup (Traefik + Existing Postgres + Actions Runner)
 
+This project deploys:
+- `gitea` behind your existing Traefik reverse proxy
+- `gitea-runner` for CI/CD (Gitea Actions)
+- connection to your already running Postgres in the shared Docker network
+
+## What this is built for
+
+- Existing stack already provides:
+  - Traefik with Let's Encrypt
+  - Postgres service named `postgres`
+  - shared Docker network via `${SHARED_NETWORK_NAME}`
+- Gitea should be reachable at subdomain `git` (for example `git.example.com`)
+
+## Files
+
+- `docker-compose.yml`: Gitea + Actions runner stack
+- `.env.example`: required environment variables
+
+## 1) Prepare environment
+
+```bash
+cp .env.example .env
+```
+
+Edit `.env` and set:
+- `SHARED_NETWORK_NAME` to the same network name used by your main stack
+- `GITEA_DOMAIN` to your git subdomain (for example `git.example.com`)
+- Postgres credentials for a dedicated Gitea database/user
+
+## 2) Create Postgres DB/User (on your existing DB)
+
+If not already present, create dedicated credentials for Gitea in your existing Postgres:
+
+```sql
+CREATE USER gitea WITH PASSWORD 'change-me';
+CREATE DATABASE gitea OWNER gitea;
+GRANT ALL PRIVILEGES ON DATABASE gitea TO gitea;
+```
+
+Use your own secure password and update `.env`.
+
+## 3) DNS
+
+Create an `A`/`AAAA` record for:
+- `git.<your-domain>` -> your server IP
+
+## 4) Start services
+
+```bash
+docker compose up -d
+```
+
+## 5) Create the first admin user
+
+Run the CLI inside the container as the non-root `git` user:
+
+```bash
+docker exec -u git -it gitea gitea admin user create \
+  --username youradmin \
+  --password 'StrongPasswordHere' \
+  --email you@example.com \
+  --admin \
+  --must-change-password=false
+```
+
+Public sign-up is disabled by default in this stack (`GITEA__service__DISABLE_REGISTRATION=true`).
+
+## 6) Runner registration token
+
+1. Open `https://<your-gitea-domain>`
+2. Login as admin
+3. Go to:
+   - Site level: `Administration -> Actions -> Runners`
+   - or Org/Repo level: `Settings -> Actions -> Runners`
+4. Generate registration token
+5. Put token into `.env` as `GITEA_RUNNER_REGISTRATION_TOKEN`
+6. Restart runner:
+
+```bash
+docker compose up -d gitea-runner
+```
+
+## 7) Verify
+
+```bash
+docker compose ps
+docker compose logs -f gitea
+docker compose logs -f gitea-runner
+```
+
+## Notes
+
+- This setup uses HTTPS via Traefik labels and Let's Encrypt from your existing stack.
+- Git over SSH is not enabled in this compose because your current Traefik config only exposes `:80` and `:443`. HTTPS clone/push works directly.
+- Gitea Actions is enabled (`GITEA__actions__ENABLED=true`).

docker-compose.yml

@@ -0,0 +1,69 @@
+services:
+  gitea:
+    image: gitea/gitea:latest
+    container_name: gitea
+    restart: unless-stopped
+    environment:
+      - USER_UID=${GITEA_UID}
+      - USER_GID=${GITEA_GID}
+      - GITEA__server__DOMAIN=${GITEA_DOMAIN}
+      - GITEA__server__ROOT_URL=https://${GITEA_DOMAIN}/
+      - GITEA__server__SSH_DOMAIN=${GITEA_DOMAIN}
+      - GITEA__server__HTTP_PORT=3000
+      - GITEA__server__SSH_PORT=22
+      - GITEA__database__DB_TYPE=postgres
+      - GITEA__database__HOST=${GITEA_DB_HOST}:${GITEA_DB_PORT}
+      - GITEA__database__NAME=${GITEA_DB_NAME}
+      - GITEA__database__USER=${GITEA_DB_USER}
+      - GITEA__database__PASSWD=${GITEA_DB_PASSWORD}
+      - GITEA__security__INSTALL_LOCK=true
+      - GITEA__service__DISABLE_REGISTRATION=true
+      - GITEA__actions__ENABLED=true
+      - GITEA__actions__DEFAULT_ACTIONS_URL=self
+    volumes:
+      - gitea_data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    labels:
+      - traefik.enable=true
+      - traefik.docker.network=${SHARED_NETWORK_NAME}
+      - traefik.http.routers.gitea.rule=Host(`${GITEA_DOMAIN}`)
+      - traefik.http.routers.gitea.entrypoints=websecure
+      - traefik.http.routers.gitea.tls=true
+      - traefik.http.routers.gitea.tls.certresolver=letsencrypt
+      - traefik.http.services.gitea.loadbalancer.server.port=3000
+    networks:
+      - web
+
+  gitea-runner:
+    image: gitea/act_runner:latest
+    container_name: gitea-runner
+    restart: unless-stopped
+    depends_on:
+      - gitea
+    environment:
+      - GITEA_INSTANCE_URL=http://gitea:3000
+      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
+      - GITEA_RUNNER_NAME=${GITEA_RUNNER_NAME}
+      - GITEA_RUNNER_LABELS=${GITEA_RUNNER_LABELS}
+    volumes:
+      - gitea_runner_data:/data
+      - /var/run/docker.sock:/var/run/docker.sock
+    command: >-
+      sh -c "
+      if [ ! -f /data/.runner ]; then
+        act_runner register --no-interactive --instance $${GITEA_INSTANCE_URL} --token $${GITEA_RUNNER_REGISTRATION_TOKEN} --name $${GITEA_RUNNER_NAME};
+      fi;
+      act_runner daemon
+      "
+    networks:
+      - web
+
+volumes:
+  gitea_data:
+  gitea_runner_data:
+
+networks:
+  web:
+    external: true
+    name: ${SHARED_NETWORK_NAME}