Arpad Krejczinger
e608ce6d5b
- Simplify daemon.json to minimal working version, removing problematic security settings that caused read-only filesystem issues - Update Gitea docker-compose.yml to working configuration: - Remove read-only filesystem (breaks s6-overlay init) - Keep user privilege dropping via USER_UID/USER_GID - Bind SSH port directly for Git operations - Maintain localhost binding for web interface
54 lines
1.4 KiB
YAML
54 lines
1.4 KiB
YAML
# DEPLOYMENT LOCATION: /opt/docker/gitea/docker-compose.yml
|
|
# Move this file with: sudo cp gitea-docker-compose.yml /opt/docker/gitea/docker-compose.yml
|
|
# Create data directory: sudo mkdir -p /opt/docker/gitea/data
|
|
# Set permissions: sudo chown -R hoborg:hoborg /opt/docker/gitea
|
|
|
|
# WORKING CONFIGURATION - Balanced security and functionality
|
|
# - Ports bound to localhost only
|
|
# - Non-root user (1000:1000)
|
|
# - Removed read-only filesystem (causes s6-svscan issues)
|
|
|
|
networks:
|
|
gitea:
|
|
external: false
|
|
|
|
services:
|
|
server:
|
|
image: gitea/gitea:latest
|
|
container_name: gitea
|
|
environment:
|
|
- USER_UID=1000
|
|
- USER_GID=1000
|
|
- GITEA__server__ROOT_URL=https://ak-homelab.duckdns.org/gitea/
|
|
- GITEA__server__SSH_PORT=2223
|
|
restart: unless-stopped
|
|
|
|
# Let Gitea container handle user switching internally (USER_UID/USER_GID)
|
|
# DO NOT set user: directive - breaks s6-overlay init system
|
|
|
|
networks:
|
|
- gitea
|
|
volumes:
|
|
- ./data:/data
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
|
|
# Bind ports to localhost only for reverse proxy
|
|
ports:
|
|
- "127.0.0.1:3000:3000"
|
|
- "2223:22"
|
|
|
|
# Reasonable resource limits
|
|
deploy:
|
|
resources:
|
|
limits:
|
|
memory: 1G
|
|
|
|
# Health check
|
|
healthcheck:
|
|
test: ["CMD", "curl", "-f", "http://localhost:3000/api/healthz"]
|
|
interval: 30s
|
|
timeout: 10s
|
|
retries: 3
|
|
start_period: 40s
|