From cfabe217912e1f15c0deb65a02c386373b94162d Mon Sep 17 00:00:00 2001
From: poprhythm <james.kolpack@gmail.com>
Date: Thu, 6 Aug 2026 23:56:28 +0000
Subject: [PATCH] gitea: lock down after cryptominer compromise

Pin image to digest instead of :nightly (DB schema already ahead of
stable 1.27, downgrading would break startup) and disable open
self-registration/OpenID signup, which attackers used to plant xmrig
via a git hook.
---
 gitea/docker-compose.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/gitea/docker-compose.yaml b/gitea/docker-compose.yaml
index 8f469a8..8d87a86 100644
--- a/gitea/docker-compose.yaml
+++ b/gitea/docker-compose.yaml
@@ -5,7 +5,10 @@ networks:
 
 services:
   server:
-    image: docker.gitea.com/gitea:nightly
+    # Pinned to digest (not :nightly) after 2026-08-06 compromise: DB schema is
+    # already on the 1.28-dev branch, ahead of stable 1.27, so downgrading to a
+    # stable tag would break startup. Move to a real stable tag once 1.28 ships.
+    image: docker.gitea.com/gitea@sha256:fb8bea4620c12ccf067608ead53b946636516ab6a56771e697079895f23b2b0f
     container_name: gitea
     labels:
       - com.centurylinklabs.watchtower.monitor-only=true
@@ -15,6 +18,8 @@ services:
       - VIRTUAL_HOST=gitea.kolpacksoftware.com
       - VIRTUAL_PORT=3000
       - LETSENCRYPT_HOST=gitea.kolpacksoftware.com
+      - GITEA__service__DISABLE_REGISTRATION=true
+      - GITEA__openid__ENABLE_OPENID_SIGNUP=false
     restart: always
     volumes:
       - /srv/gitea-data:/data