new config

2026-09-18 15:14:01 +02:00
parent 626b573b5a
commit 53a84cd2f0
9 changed files with 1098 additions and 147 deletions
@@ -5,6 +5,9 @@ networks:
  back_network_gitea:
    driver: bridge
    attachable: true
+  monitoring_network:
+    external: true
+    name: monitoring_network

 #### SERVICES
 services:
@@ -47,8 +50,8 @@ services:
      - GITEA__actions__ENABLED=true
      - GITEA__metrics__ENABLED=true
      - GITEA__metrics__ENABLED_ISSUE_BY_REPOSITORY=true
-            - GITEA__metrics__ENABLED_ISSUE_BY_LABEL=true
-      - GITEA__service__DISABLE_REGISTRATION=false
+      - GITEA__metrics__ENABLED_ISSUE_BY_LABEL=true
+      - GITEA__service__DISABLE_REGISTRATION=true
      - GITEA__service__REQUIRE_SIGNIN_VIEW=false
      - GITEA__service__REGISTER_EMAIL_CONFIRM=true
      - GITEA__service__ENABLE_NOTIFY_MAIL=true
@@ -58,31 +61,33 @@ services:
      - GITEA__service__DEFAULT_ALLOW_CREATE_ORGANIZATION=false
      - GITEA__service__DEFAULT_ENABLE_TIMETRACKING=true
      - GITEA__service__NO_REPLY_ADDRESS=${GITEA_NOREPLY_EMAIL}
+      - GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION_API=true
      - GITEA__RUN_MODE=prod
      - GITEA__APP_NAME=Gitea
    restart: always
    networks:
      - back_network_gitea
      - traefik_front_network
+      - monitoring_network
    volumes:
      - ./gitea:/data:rw
      - ./custom:/app/gitea/custom:rw
      - ./log:/app/gitea/log:rw
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
-#    ports:
-#      - "3080:3000"
-#      - "222:222"
    depends_on:
      postgres:
        condition: service_healthy
    healthcheck:
-      test: ["CMD", "curl", "-f", "http://gitea.tips-of-mine.com/"]
+      test: ["CMD", "curl", "-f", "http://localhost:3000/api/healthz"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 90s
+    security_opt:
+      - no-new-privileges
    labels:
+      - "com.centurylinklabs.watchtower.enable=true"
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_front_network"
 # HTTP
@@ -94,12 +99,25 @@ services:
      - "traefik.http.routers.gitea-https.entrypoints=https"
      - "traefik.http.routers.gitea-https.tls=true"
      - "traefik.http.routers.gitea-https.priority=50"
-      - "traefik.http.routers.gitea.service=gitea-https-service"
+      - "traefik.http.routers.gitea-https.service=gitea-https-service"
+      - "traefik.http.routers.gitea-https.middlewares=gitea-middlewares"
+      - "traefik.http.routers.gitea-https.observability.accesslogs=true"
+      - "traefik.http.routers.gitea-https.observability.metrics=true"
+      - "traefik.http.routers.gitea-https.observability.tracing=true"
 # SSH
-      - "traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)"
-      - "traefik.tcp.routers.gitea-ssh.entrypoints=ssh"
-      - "traefik.tcp.routers.gitea-ssh.service=gitea-ssh-service"
+#      - "traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)"
+#      - "traefik.tcp.routers.gitea-ssh.entrypoints=ssh"
+#      - "traefik.tcp.routers.gitea-ssh.service=gitea-ssh-service"
 # Middleware
+#      - "traefik.http.middlewares.gitea-middlewares.headers.SSLRedirect=true"
+      - "traefik.http.middlewares.gitea-middlewares.headers.STSSeconds=15552000"
+#      - "traefik.http.middlewares.gitea-middlewares.headers.customResponseHeaders"
+#      - "traefik.http.middlewares.gitea-middlewares.headers.browserXSSFilter=true"
+#      - "traefik.http.middlewares.gitea-middlewares.headers.contentTypeNosniff=true"
+      - "traefik.http.middlewares.gitea-middlewares.headers.forceSTSHeader=true"
+#      - "traefik.http.middlewares.gitea-middlewares.headers.SSLHost=tips-of-mine.com"
+      - "traefik.http.middlewares.gitea-middlewares.headers.STSIncludeSubdomains=true"
+      - "traefik.http.middlewares.gitea-middlewares.headers.STSPreload=true"
 # Service
      - "traefik.http.services.gitea-https-service.loadbalancer.server.port=3000"
 #      - "traefik.http.services.gitea-https-service.loadbalancer.server.scheme=https"
@@ -107,8 +125,14 @@ services:
 #      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.method=foobar"
 #      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.timeout=10"
 #      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.interval=30"
-      - "traefik.tcp.services.gitea-ssh-service.loadbalancer.server.port=22"
+#      - "traefik.tcp.services.gitea-ssh-service.loadbalancer.server.port=22"
 #      - "traefik.tcp.services.gitea-ssh-service.loadbalancer.server.tls=true"
+# Homepage
+      - "homepage.group=Dev"
+      - "homepage.name=Gitea"
+      - "homepage.icon=gitea.png"
+      - "homepage.href=https://gitea.tips-of-mine.com"
+      - "homepage.description=git"

 ### postgres
  postgres:
@@ -132,6 +156,10 @@ services:
      timeout: 5s
      retries: 3
      start_period: 60s
+    security_opt:
+      - no-new-privileges
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"

 ### adminer
 #  adminer:
@@ -197,6 +225,10 @@ services:
    depends_on:
      postgres:
        condition: service_healthy
+    security_opt:
+      - no-new-privileges
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"

 ### runner
  runner:
@@ -204,22 +236,32 @@ services:
    hostname: gitea-runner
    image: gitea/act_runner:latest
    environment:
+      - TZ="Europe/Paris"
+      - GITEA_RUNNER_LOG_LEVEL="trace"
      - GITEA_INSTANCE_URL=${GITEA_URL}
-      - GITEA_RUNNER_REGISTRATION_TOKEN=v1bOsBNZeoJ0P3fGHsyEoqxcpBoLc8xTBByhnB5I
      - GITEA_RUNNER_NAME=gitea-runner
+#      - GITEA_RUNNER_CAPACITY=3
+      - DOCKER_TLS_VERIFY=0
    restart: unless-stopped
    networks:
      - back_network_gitea
+      - traefik_front_network
    volumes:
-#      - ./data-runner:/data
+      - ./data/act_runner:/data:rw
      - /etc/ssl/certs/:/etc/ssl/certs:ro
+      - ./config.yaml:/config.yaml:ro
 #      - ./data-runner/cache:/root/.cache
-#      - ./config.yaml:/config.yaml
+      - ./config.yaml:/config.yaml
      - /var/run/docker.sock:/var/run/docker.sock
-    privileged: true
+      - ./cache/actions:/root/.cache/act:rw
+      - ./cache/build:/root/.cache:rw
    depends_on:
      gitea:
        condition: service_healthy
+    security_opt:
+      - no-new-privileges
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"

 ### msmtpd
  msmtpd:
@@ -241,7 +283,7 @@ services:
      - "SMTP_TLS_CHECKCERT=off"
      - "SMTP_AUTH=on"
      - "[email protected]"
-      - "SMTP_PASSWORD=P@ssword!Here!123456"
+      - "SMTP_PASSWORD=Whf2VtLEd2QR4er"
      - "SMTP_DOMAIN=localhost"
      - "[email protected]"
    restart: always
@@ -250,3 +292,7 @@ services:
      interval: 5s
      timeout: 5s
      retries: 5
+    security_opt:
+      - no-new-privileges
+    labels:
+      - "com.centurylinklabs.watchtower.enable=true"