# Gitea behind Caddy (automatic Let's Encrypt HTTPS) on the The-Ocean droplet.
# Only Caddy publishes ports; Gitea is reachable solely on the private "web" network.
services:
  gitea:
    image: gitea/gitea:1.27.3
    restart: unless-stopped
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__database__DB_TYPE=sqlite3            # file: /data/gitea/gitea.db
      - GITEA__server__DOMAIN=git.yebilly.me
      - GITEA__server__ROOT_URL=https://git.yebilly.me/
      - GITEA__server__HTTP_PORT=3000
      - GITEA__server__DISABLE_SSH=true              # Git over HTTPS only
    volumes:
      - gitea-data:/data
    networks: [web]
    # ponytail: no ports: on purpose -- Caddy reaches gitea:3000 privately.

  caddy:
    image: caddy:2.11.4-alpine
    restart: unless-stopped
    ports:
      - "80:80"    # HTTP->HTTPS redirect + ACME HTTP-01 validation
      - "443:443"  # HTTPS
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data      # certificates + ACME account
      - caddy-config:/config
    networks: [web]
    depends_on: [gitea]

volumes:
  gitea-data:
  caddy-data:
  caddy-config:

networks:
  web: