Remove what is about deploying behind Gitea (#210)

README.md

@@ -100,8 +100,8 @@ Point traefik's labels at port 8080 of `rproxy`
 of the app or of `servewaf`. Anything on that network can reach the app around
 `rproxy`, and can ask `servewaf` questions, so the network holds only what you
 trust. Each further app adds its own container and its own `rproxy`, whose
-`SWRP_WAF_BACKEND` names the same `servewaf`. The "Smallest setup" and "In front
-of gitea" examples below show this shape.
+`SWRP_WAF_BACKEND` names the same `servewaf`. The "Smallest setup" example below
+shows this shape.
 
 ### `rproxy` in the app's container
 
@@ -338,9 +338,8 @@ full, and the limits that are fixed rather than settings.
 Each example is a complete `compose.yaml`. `smallwebwaf` is the tag
 `make docker` gives the image; on another host, use the name you pushed it
 under, by digest. Docker Compose puts the services on a private network of its
-own, where each reaches the others by service name. Only "In front of gitea"
-uses traefik. The other three publish `rproxy`'s port on the host, for trying it
-out.
+own, where each reaches the others by service name. Each example publishes
+`rproxy`'s port on the host, for trying it out.
 
 ### Smallest setup
 
@@ -426,88 +425,6 @@ volumes:
     servewaf-state:
 ```
 
-### In front of gitea
-
-gitea behind traefik, set up for a code forge:
-
-- the upload limits raised, in size and in time;
-- the response size limit raised, for clones over 1 GiB;
-- the Actions runners exempt from counting;
-- the default request and byte limits kept.
-
-`traefik` is the network traefik is on, made outside this file.
-
-```yaml
-services:
-    gitea:
-        # gitea 1.27.3, 2026-08-29
-        image: gitea/gitea@sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025d6e00e46adc43bef
-        environment:
-            GITEA__server__ROOT_URL: https://git.example/
-            # The host and the port of the SSH clone URLs gitea shows.
-            GITEA__server__SSH_DOMAIN: git.example
-            GITEA__server__SSH_PORT: "2222"
-            # gitea's TCP peer is rproxy, on the private network.
-            GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
-        volumes:
-            - gitea-data:/data
-        networks:
-            - site
-        ports:
-            # SSH does not pass through smallwebwaf.
-            - "2222:22"
-
-    rproxy:
-        image: smallwebwaf
-        environment:
-            SWRP_WAF_BACKEND: http://servewaf:8080
-            SWRP_UPSTREAM_URL: http://gitea:3000
-            # Pushes, LFS objects and image layers over 100 MiB, or slower
-            # than a minute, are cut off at the defaults.
-            SWRP_MAX_REQUEST_SIZE: 2G
-            SWRP_MAX_REQUEST_TIME_MS: "600000"
-            # A clone larger than 1 GiB is cut off at the default.
-            SWRP_MAX_RESPONSE_SIZE: 4G
-        networks:
-            - site
-            - traefik
-        labels:
-            traefik.enable: "true"
-            # rproxy is on two networks; traefik reaches it on this one.
-            traefik.docker.network: traefik
-            traefik.http.routers.git.rule: Host(`git.example`)
-            traefik.http.routers.git.entrypoints: websecure
-            traefik.http.routers.git.tls.certresolver: letsencrypt
-            traefik.http.services.git.loadbalancer.server.port: "8080"
-
-    servewaf:
-        image: smallwebwaf
-        environment:
-            SMALLWEBWAF_COMMAND: servewaf
-            SWWAF_INSTANCE_NAME: fsn1/servewaf
-            # The Actions runners ask for work all day; never count them.
-            SWWAF_RATE_LIMIT_EXEMPT_NETS: 10.0.4.0/24
-            # gitea never serves these; a request for one bans the client.
-            SWWAF_TRAP_PATHS: /wp-login.php,/xmlrpc.php,/wp-admin/
-        volumes:
-            - servewaf-state:/var/lib/smallwebwaf
-        networks:
-            - site
-
-networks:
-    site:
-    traefik:
-        external: true
-
-volumes:
-    gitea-data:
-    servewaf-state:
-```
-
-`deploy/gitea` holds a complete setup of gitea, traefik included, as a Docker
-Compose file. [`docs/gitea.md`](docs/gitea.md) explains it, and records what the
-defaults do in front of gitea, request by request.
-
 ### `rproxy` beside the app
 
 The app is built on the `smallwebwaf` image, with `rproxy` inside its container.
@@ -771,18 +688,6 @@ on the host.
     - orderly stops with `sv stop` and `docker stop`;
     - bans surviving a new container on the same volume;
     - a setting given as a file.
-- `script/gitea-requests`: builds the image and runs gitea 1.27.3 behind
-  `rproxy` and `servewaf`, three containers on one network. Every setting is at
-  its default, but for those that join the containers and
-  `SWWAF_LOG_REQUEST_HEADERS`, which adds the header that labels each request.
-  It sends through them a sample of gitea's ordinary use and the requests the
-  Core Rule Set is known to refuse, and prints what `servewaf` did with each.
-  Needs network access, and a docker daemon that pushes to a registry on
-  `localhost` over plain HTTP. `make gitea-requests`.
-- `script/gitea-setup`: builds the image, brings up the setup in `deploy/gitea`,
-  and checks it as [`docs/gitea.md`](docs/gitea.md) describes. Then it removes
-  the containers, the network, the volumes and the image it built. Needs network
-  access. `make gitea-setup`.
 
 ## TODO
 
@@ -806,8 +711,6 @@ on the host.
 - [`docs/state-files.md`](docs/state-files.md): the state files and what each
   holds.
 - [`docs/image.md`](docs/image.md): what the image holds and how it is pinned.
-- [`docs/gitea.md`](docs/gitea.md): `smallwebwaf` in front of gitea: the setup
-  in `deploy/gitea`, and what the defaults do there.
 
 ## License