poprhythm
cfabe21791
Pin image to digest instead of :nightly (DB schema already ahead of stable 1.27, downgrading would break startup) and disable open self-registration/OpenID signup, which attackers used to plant xmrig via a git hook.
31 lines
998 B
YAML
31 lines
998 B
YAML
networks:
|
|
default:
|
|
external:
|
|
name: npm-network
|
|
|
|
services:
|
|
server:
|
|
# Pinned to digest (not :nightly) after 2026-08-06 compromise: DB schema is
|
|
# already on the 1.28-dev branch, ahead of stable 1.27, so downgrading to a
|
|
# stable tag would break startup. Move to a real stable tag once 1.28 ships.
|
|
image: docker.gitea.com/gitea@sha256:fb8bea4620c12ccf067608ead53b946636516ab6a56771e697079895f23b2b0f
|
|
container_name: gitea
|
|
labels:
|
|
- com.centurylinklabs.watchtower.monitor-only=true
|
|
environment:
|
|
- USER_UID=1000
|
|
- USER_GID=1000
|
|
- VIRTUAL_HOST=gitea.kolpacksoftware.com
|
|
- VIRTUAL_PORT=3000
|
|
- LETSENCRYPT_HOST=gitea.kolpacksoftware.com
|
|
- GITEA__service__DISABLE_REGISTRATION=true
|
|
- GITEA__openid__ENABLE_OPENID_SIGNUP=false
|
|
restart: always
|
|
volumes:
|
|
- /srv/gitea-data:/data
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
ports:
|
|
- "3001:3000"
|
|
- "222:22"
|