# Gitea on us2 — reference compose (Plane VPS-94, 迁移完成 2026-09-18)
# 参考镜像, 服务器 /opt/gitea 文件为准 (同 soft-serve 约定, 未接入 compose-deploy)
# rootless 镜像: uid 1000 原生非 root; 数据 /var/lib/gitea (宿主 ./data), 配置 /etc/gitea (宿主 ./config)
# SSH: 容器内监听 2322 (非特权, SSH_LISTEN_PORT), 对外 repo.windy.me:2222 经 Traefik TCP entrypoint `ssh`
services:
  gitea:
    image: gitea/gitea@sha256:1c17ecaead42eb3b5391553d8708103a4beb0e86edf5b9ebc1eb269c318845f2 # 1.27.3-rootless
    container_name: gitea
    restart: unless-stopped
    user: "1000:1000"
    environment:
      TZ: Asia/Shanghai
    volumes:
      - ./data:/var/lib/gitea
      - ./config:/etc/gitea
      - ./secrets:/secrets:ro # 复用的 soft-serve host key (SSH_SERVER_HOST_KEYS)
    networks:
      - traefik
    labels:
      - traefik.enable=true
      # Web UI: repo.windy.me (2026-09-18 操作者决定复用现有域名, 免 DNS 变更)
      - traefik.http.routers.gitea-web.rule=Host(`repo.windy.me`)
      - traefik.http.routers.gitea-web.entrypoints=websecure
      - traefik.http.routers.gitea-web.tls.certresolver=letsencrypt
      - traefik.http.services.gitea-web.loadbalancer.server.port=3000
      # SSH: 接管 :2222 (entrypoint 已存在, router 动态生效, 无需重启 Traefik)
      - traefik.tcp.routers.gitea-ssh.entrypoints=ssh
      - traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)
      - traefik.tcp.routers.gitea-ssh.tls=false
      - traefik.tcp.services.gitea-ssh.loadbalancer.server.port=2322

  gitea-backup:
    build:
      context: .
      dockerfile: Dockerfile.backup
    container_name: gitea-backup
    restart: unless-stopped
    volumes:
      - ./data:/data:ro
      - ./config:/config:ro
      - ./backups:/backup
      - ./scripts:/scripts
    environment:
      TZ: Asia/Shanghai
      BACKUP_UID: 1000
      BACKUP_GID: 1000
    entrypoint: >
      /bin/sh -ec "
        umask 077 &&
        touch /backup/backup.log &&
        crontab /scripts/crontab.txt &&
        echo '[INFO] gitea backup cron installed' &&
        crond -f -l 8
      "

networks:
  traefik:
    external: true
    name: vw-net