From 99095c51f38cc38a94c253000d8e7923fbceacea Mon Sep 17 00:00:00 2001
From: brahmi <dalvibrahmi@outlook.com>
Date: Thu, 15 Oct 2026 19:31:20 +0000
Subject: [PATCH] Add docker-compose.yml

---
 docker-compose.yml | 55 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 docker-compose.yml

diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..6e0828d
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,55 @@
+# Gitea (SQLite) behind a Caddy TLS reverse proxy. Cloud-agnostic: works on a
+# DigitalOcean Droplet or an AWS EC2 instance. DRAFT: not yet run on a server.
+# Copy .env.example to .env (untracked) and set the values before `docker compose up -d`.
+services:
+  gitea:
+    image: gitea/gitea:${GITEA_VERSION}          # pinned in .env
+    container_name: gitea
+    restart: unless-stopped
+    environment:
+      USER_UID: "1000"
+      USER_GID: "1000"
+      GITEA__database__DB_TYPE: sqlite3           # FINAL team decision (Oct 12, 2026): SQLite
+      GITEA__database__PATH: /data/gitea/gitea.db # inside the persistent /data volume
+      GITEA__server__DOMAIN: ${GITEA_DOMAIN}
+      GITEA__server__ROOT_URL: https://${GITEA_DOMAIN}/
+      GITEA__server__HTTP_PORT: "3000"
+      GITEA__server__DISABLE_SSH: "true"          # HTTPS-only Git; no SSH listener
+      GITEA__security__INSTALL_LOCK: "true"       # skip web installer; create admin via CLI
+      GITEA__service__DISABLE_REGISTRATION: "true"
+    volumes:
+      - gitea_data:/data                          # repos, attachments, SQLite file
+    networks:
+      - web
+    # No `ports:` on purpose: Gitea (3000) is reachable only from the proxy.
+    healthcheck:
+      test: ["CMD", "curl", "-fsS", "http://localhost:3000/api/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+
+  caddy:
+    image: caddy:${CADDY_VERSION}                 # pinned in .env
+    container_name: caddy
+    restart: unless-stopped
+    depends_on:
+      - gitea
+    ports:
+      - "80:80"     # HTTP-to-HTTPS redirect and ACME HTTP-01 validation only
+      - "443:443"
+    environment:
+      GITEA_DOMAIN: ${GITEA_DOMAIN}
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data                          # certificates + ACME account: persist!
+      - caddy_config:/config
+    networks:
+      - web
+
+networks:
+  web:
+
+volumes:
+  gitea_data:
+  caddy_data:
+  caddy_config: