falco: tune gitea-web proxy noise, bound log growth

nginx-proxy's routine reverse-proxied traffic to gitea:3000 trips the
"Redirect stdout/stdin to network connection" rule every 5-15 min via
the same dup3 mechanic as the already-excluded sshd case - not a new
attack pattern, just proxied web traffic volume. Scoped to gitea's own
fixed internal port so a redirect on any other port from this
previously-compromised container still alerts.

Also caps falco's own json-file log at 50MB x5 files - it had grown
to 1.1GB unbounded (mostly 15s-interval metrics snapshots), which was
making `docker logs falco` unreliable for the exact triage step its
own alert text points admins to.

Claude-Session: https://claude.ai/code/session_01HZQK6jHmdTpFjFZM8FUnqA

falco/docker-compose.yaml

@@ -10,6 +10,11 @@ services:
     image: falcosecurity/falco:0.44.1
     container_name: falco
     restart: always
+    logging:
+      driver: json-file
+      options:
+        max-size: "50m"
+        max-file: "5"
     cap_drop:
       - all
     cap_add:

falco/rules/tune-noise.yaml

@@ -77,11 +77,23 @@
 #   same dup2-based mechanic. Confirmed at the 2026-09-16 host reboot; will
 #   recur on every container start. Scoped to the image, not proc.name,
 #   since this is the container's own /init script.
+# - gitea web (not sshd this time): nginx-proxy's ordinary reverse-proxied
+#   HTTP traffic to gitea's own listen port hits the same dup3-onto-socket
+#   mechanic as the SSH case above, just for the web server instead of SSH.
+#   Confirmed 2026-09-25/26 firing every 5-15 min, always container=gitea,
+#   command="gitea web", user=git, fd.lport=3000 (gitea's fixed internal
+#   port, not internet-reachable directly - only nginx-proxy on
+#   npm-network can reach it) - i.e. every one of these traced to normal
+#   proxied web traffic volume, not a new pattern. Scoped to gitea's own
+#   listen port specifically, not the whole image or process, so a redirect
+#   on any *other* port from this container (still a real anomaly for a
+#   previously-compromised service) still gets flagged.
 - macro: user_known_stand_streams_redirect_activities
   condition: >
     (container.image.repository = "docker.gitea.com/gitea" and proc.name in (sshd, sshd-session))
     or (container.image.repository = "fireflyiii/core" and proc.cmdline contains "wait-for-it.sh")
     or (container.image.repository = "rommapp/romm" and proc.cmdline = "bash /init")
+    or (container.image.repository = "docker.gitea.com/gitea" and proc.cmdline = "gitea web" and fd.lport = 3000)
 
 # "Clear Log Activities" false-positive: lsyncd (host systemd service, not a
 # container - running since 2026-07-29) truncates its own status file,