gitea: lock down after cryptominer compromise

Pin image to digest instead of :nightly (DB schema already ahead of
stable 1.27, downgrading would break startup) and disable open
self-registration/OpenID signup, which attackers used to plant xmrig
via a git hook.

gitea/docker-compose.yaml

@@ -5,7 +5,10 @@ networks:
 
 services:
   server:
-    image: docker.gitea.com/gitea:nightly
+    # Pinned to digest (not :nightly) after 2026-08-06 compromise: DB schema is
+    # already on the 1.28-dev branch, ahead of stable 1.27, so downgrading to a
+    # stable tag would break startup. Move to a real stable tag once 1.28 ships.
+    image: docker.gitea.com/gitea@sha256:fb8bea4620c12ccf067608ead53b946636516ab6a56771e697079895f23b2b0f
     container_name: gitea
     labels:
       - com.centurylinklabs.watchtower.monitor-only=true
@@ -15,6 +18,8 @@ services:
       - VIRTUAL_HOST=gitea.kolpacksoftware.com
       - VIRTUAL_PORT=3000
       - LETSENCRYPT_HOST=gitea.kolpacksoftware.com
+      - GITEA__service__DISABLE_REGISTRATION=true
+      - GITEA__openid__ENABLE_OPENID_SIGNUP=false
     restart: always
     volumes:
       - /srv/gitea-data:/data