Gan, Jimmy
cdd364e645
Bind navidrome, n8n, immich, openclaw, gitea web ports to 127.0.0.1 to prevent direct LAN access bypassing Caddy/Authelia. Tailscale userspace networking on Synology proxies through localhost, so VPS Caddy access via Tailscale IP continues to work. Gitea SSH port (2222) remains on all interfaces for external git push.
78 lines
2.2 KiB
YAML
Executable File
78 lines
2.2 KiB
YAML
Executable File
version: "3"
|
|
|
|
services:
|
|
gitea:
|
|
image: gitea/gitea:latest
|
|
container_name: gitea
|
|
environment:
|
|
- USER_UID=1000
|
|
- USER_GID=1000
|
|
- GITEA__database__DB_TYPE=postgres
|
|
- GITEA__database__HOST=db:5432
|
|
- GITEA__database__NAME=gitea
|
|
- GITEA__database__USER=gitea
|
|
- GITEA__database__PASSWD=${GITEA_DB_PASSWORD}
|
|
- GITEA__server__ROOT_URL=https://git.jimmygan.com:8443/
|
|
- GITEA__server__SSH_DOMAIN=100.78.131.124
|
|
- GITEA__server__SSH_PORT=2222
|
|
- GITEA__actions__ENABLED=true
|
|
- GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION=true
|
|
- GITEA__service__ENABLE_REVERSE_PROXY_AUTO_REGISTRATION=false
|
|
- GITEA__service__ENABLE_REVERSE_PROXY_EMAIL=true
|
|
- GITEA__service__ENABLE_REVERSE_PROXY_FULL_NAME=true
|
|
- GITEA__reverse_proxy__TRUSTED_PROXIES=127.0.0.1/32,::1/128,172.16.0.0/12
|
|
- GITEA__reverse_proxy__AUTHENTICATION_USER=Remote-User
|
|
- GITEA__reverse_proxy__AUTHENTICATION_EMAIL=Remote-Email
|
|
- GITEA__reverse_proxy__AUTHENTICATION_FULL_NAME=Remote-Name
|
|
restart: always
|
|
volumes:
|
|
- ./gitea-data:/data
|
|
- /etc/TZ:/etc/TZ:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
ports:
|
|
- "127.0.0.1:3300:3000"
|
|
- "2222:22"
|
|
depends_on:
|
|
- db
|
|
networks:
|
|
- gitea
|
|
labels:
|
|
- com.centurylinklabs.watchtower.enable=true
|
|
|
|
db:
|
|
image: postgres:16-alpine
|
|
container_name: gitea-db
|
|
restart: always
|
|
environment:
|
|
- POSTGRES_USER=gitea
|
|
- POSTGRES_PASSWORD=${GITEA_DB_PASSWORD}
|
|
- POSTGRES_DB=gitea
|
|
volumes:
|
|
- ./postgres-data:/var/lib/postgresql/data
|
|
networks:
|
|
- gitea
|
|
labels:
|
|
- com.centurylinklabs.watchtower.enable=true
|
|
|
|
runner:
|
|
image: gitea/act_runner:latest
|
|
container_name: gitea-runner
|
|
restart: always
|
|
depends_on:
|
|
- gitea
|
|
volumes:
|
|
- ./runner-data:/data
|
|
- ./runner-config.yaml:/config.yaml
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
- /var/packages/ContainerManager/target/usr/bin/docker:/usr/bin/docker
|
|
environment:
|
|
- CONFIG_FILE=/config.yaml
|
|
- GITEA_INSTANCE_URL=http://gitea:3000
|
|
- GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
|
|
networks:
|
|
- gitea
|
|
|
|
networks:
|
|
gitea:
|
|
driver: bridge
|