homelab/docker-infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

gitea: lock down after cryptominer compromise

Browse Source 
Pin image to digest instead of :nightly (DB schema already ahead of
stable 1.27, downgrading would break startup) and disable open
self-registration/OpenID signup, which attackers used to plant xmrig
via a git hook.
This commit is contained in:
poprhythm
2026-08-06 23:56:28 +00:00
parent 15640da229
commit cfabe21791
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
gitea/docker-compose.yaml
+6 -1
View File
@@ -5,7 +5,10 @@ networks:
services: services:
server: server:
image: docker.gitea.com/gitea:nightly # Pinned to digest (not :nightly) after 2026-08-06 compromise: DB schema is
# already on the 1.28-dev branch, ahead of stable 1.27, so downgrading to a
# stable tag would break startup. Move to a real stable tag once 1.28 ships.
image: docker.gitea.com/gitea@sha256:fb8bea4620c12ccf067608ead53b946636516ab6a56771e697079895f23b2b0f
container_name: gitea container_name: gitea
labels: labels:
- com.centurylinklabs.watchtower.monitor-only=true - com.centurylinklabs.watchtower.monitor-only=true
@@ -15,6 +18,8 @@ services:
- VIRTUAL_HOST=gitea.kolpacksoftware.com - VIRTUAL_HOST=gitea.kolpacksoftware.com
- VIRTUAL_PORT=3000 - VIRTUAL_PORT=3000
- LETSENCRYPT_HOST=gitea.kolpacksoftware.com - LETSENCRYPT_HOST=gitea.kolpacksoftware.com
- GITEA__service__DISABLE_REGISTRATION=true
- GITEA__openid__ENABLE_OPENID_SIGNUP=false
restart: always restart: always
volumes: volumes:
- /srv/gitea-data:/data - /srv/gitea-data:/data