Waldson Patrício
08c1012e60
Run a single-user, self-hosted git server on the droplet. New forgejo/ compose stack on proxy_net: git-over-SSH is published on host 2222 (container sshd on 22) so the host's admin sshd keeps port 22, while the web UI (3000) is unpublished and reached only through the central Caddy, which gains a git.waldson.com.br reverse-proxy block. SQLite backs the instance and all state - repos, database, generated app.ini, SSH host keys - lives in the forgejo_data volume, so a force-recreate preserves every user and repository. The full configuration is injected via FORGEJO__ environment variables and written into app.ini on startup: registration disabled, Forgejo Actions disabled, and DOMAIN/SSH_DOMAIN/SSH_PORT set so clone URLs carry the right host and port. INSTALL_LOCK skips the web installer, so the single admin is created from the CLI; the security posture survives recreation instead of depending on installer clicks. README documents the deploy, admin-creation, SSH-config, and upgrade runbook.
65 lines
2.9 KiB
YAML
65 lines
2.9 KiB
YAML
name: forgejo
|
|
|
|
# Single-user Forgejo instance behind the central Caddy proxy at
|
|
# git.waldson.com.br. The web UI is reached only through Caddy on proxy_net (the
|
|
# HTTP port is never published); git-over-SSH is published on host port 2222 so
|
|
# the host's own sshd keeps port 22. All state (repos, the SQLite database, and
|
|
# the generated app.ini) lives in the forgejo_data volume. See README.md for the
|
|
# deploy, admin-creation, and upgrade runbook.
|
|
|
|
services:
|
|
forgejo:
|
|
# Pinned to a major version: Forgejo major upgrades run one-way database
|
|
# migrations, so bump this tag deliberately (see the upgrade runbook) rather
|
|
# than tracking latest.
|
|
image: codeberg.org/forgejo/forgejo:11
|
|
restart: unless-stopped
|
|
environment:
|
|
# Own the repos and SQLite file as the droplet's deploy user, matching the
|
|
# Syncthing stack, so state is manageable over plain SSH.
|
|
USER_UID: "1000"
|
|
USER_GID: "1000"
|
|
# All configuration is injected here and written into app.ini on startup,
|
|
# so the security posture (registration off, Actions off) is reproduced on
|
|
# every recreate and does not depend on installer choices.
|
|
FORGEJO__database__DB_TYPE: sqlite3
|
|
FORGEJO__database__PATH: /data/gitea/gitea.db
|
|
# Public-facing identity. ROOT_URL and SSH_DOMAIN drive the clone URLs the
|
|
# UI shows; without them Forgejo would advertise its container hostname.
|
|
FORGEJO__server__DOMAIN: git.waldson.com.br
|
|
FORGEJO__server__SSH_DOMAIN: git.waldson.com.br
|
|
FORGEJO__server__ROOT_URL: https://git.waldson.com.br/
|
|
FORGEJO__server__HTTP_PORT: "3000"
|
|
# SSH_PORT is what the UI puts in ssh:// clone URLs (the published host
|
|
# port); SSH_LISTEN_PORT is the container-internal sshd that host 2222 maps
|
|
# to. Keeping them distinct lets the host sshd keep port 22.
|
|
FORGEJO__server__SSH_PORT: "2222"
|
|
FORGEJO__server__SSH_LISTEN_PORT: "22"
|
|
# No sign-up path for strangers; the single admin is created out of band
|
|
# via the CLI (see the runbook).
|
|
FORGEJO__service__DISABLE_REGISTRATION: "true"
|
|
# Skip the web installer entirely: the instance is fully configured above,
|
|
# and locking it stops anyone from re-running install to change these.
|
|
FORGEJO__security__INSTALL_LOCK: "true"
|
|
# No CI runners on the 2 GB droplet.
|
|
FORGEJO__actions__ENABLED: "false"
|
|
volumes:
|
|
# Repos, the SQLite database, generated config, and SSH host keys all live
|
|
# under /data, so this one volume is the entire instance. It is never
|
|
# removed casually (see the runbook).
|
|
- forgejo_data:/data
|
|
ports:
|
|
# git-over-SSH only. Host 2222 -> container sshd on 22, so the host's admin
|
|
# sshd on 22 is untouched. HTTP (3000) is deliberately unpublished; Caddy
|
|
# reaches it by container name on proxy_net.
|
|
- "2222:22"
|
|
mem_limit: 768m
|
|
networks:
|
|
- proxy_net
|
|
|
|
networks:
|
|
proxy_net:
|
|
external: true
|
|
|
|
volumes:
|
|
forgejo_data:
|