Remove what is about deploying behind Gitea (closes #209)

Delete the Gitea compose setup, its document, its two scripts and their
make targets. Documents and tests no longer use Gitea as the example
deployment. The Core Rule Set exclusions for Gitea's false positives in
internal/waf stay, with their comments and tests.

Model: opus-5-5

README.md

@@ -100,8 +100,8 @@ Point traefik's labels at port 8080 of `rproxy`
 of the app or of `servewaf`. Anything on that network can reach the app around
 `rproxy`, and can ask `servewaf` questions, so the network holds only what you
 trust. Each further app adds its own container and its own `rproxy`, whose
-`SWRP_WAF_BACKEND` names the same `servewaf`. The "Smallest setup" and "In front
-of gitea" examples below show this shape.
+`SWRP_WAF_BACKEND` names the same `servewaf`. The "Smallest setup" example below
+shows this shape.
 
 ### `rproxy` in the app's container
 
@@ -338,9 +338,8 @@ full, and the limits that are fixed rather than settings.
 Each example is a complete `compose.yaml`. `smallwebwaf` is the tag
 `make docker` gives the image; on another host, use the name you pushed it
 under, by digest. Docker Compose puts the services on a private network of its
-own, where each reaches the others by service name. Only "In front of gitea"
-uses traefik. The other three publish `rproxy`'s port on the host, for trying it
-out.
+own, where each reaches the others by service name. Each example publishes
+`rproxy`'s port on the host, for trying it out.
 
 ### Smallest setup
 
@@ -426,88 +425,6 @@ volumes:
     servewaf-state:
 ```
 
-### In front of gitea
-
-gitea behind traefik, set up for a code forge:
-
-- the upload limits raised, in size and in time;
-- the response size limit raised, for clones over 1 GiB;
-- the Actions runners exempt from counting;
-- the default request and byte limits kept.
-
-`traefik` is the network traefik is on, made outside this file.
-
-```yaml
-services:
-    gitea:
-        # gitea 1.27.3, 2026-08-29
-        image: gitea/gitea@sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025d6e00e46adc43bef
-        environment:
-            GITEA__server__ROOT_URL: https://git.example/
-            # The host and the port of the SSH clone URLs gitea shows.
-            GITEA__server__SSH_DOMAIN: git.example
-            GITEA__server__SSH_PORT: "2222"
-            # gitea's TCP peer is rproxy, on the private network.
-            GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16
-        volumes:
-            - gitea-data:/data
-        networks:
-            - site
-        ports:
-            # SSH does not pass through smallwebwaf.
-            - "2222:22"
-
-    rproxy:
-        image: smallwebwaf
-        environment:
-            SWRP_WAF_BACKEND: http://servewaf:8080
-            SWRP_UPSTREAM_URL: http://gitea:3000
-            # Pushes, LFS objects and image layers over 100 MiB, or slower
-            # than a minute, are cut off at the defaults.
-            SWRP_MAX_REQUEST_SIZE: 2G
-            SWRP_MAX_REQUEST_TIME_MS: "600000"
-            # A clone larger than 1 GiB is cut off at the default.
-            SWRP_MAX_RESPONSE_SIZE: 4G
-        networks:
-            - site
-            - traefik
-        labels:
-            traefik.enable: "true"
-            # rproxy is on two networks; traefik reaches it on this one.
-            traefik.docker.network: traefik
-            traefik.http.routers.git.rule: Host(`git.example`)
-            traefik.http.routers.git.entrypoints: websecure
-            traefik.http.routers.git.tls.certresolver: letsencrypt
-            traefik.http.services.git.loadbalancer.server.port: "8080"
-
-    servewaf:
-        image: smallwebwaf
-        environment:
-            SMALLWEBWAF_COMMAND: servewaf
-            SWWAF_INSTANCE_NAME: fsn1/servewaf
-            # The Actions runners ask for work all day; never count them.
-            SWWAF_RATE_LIMIT_EXEMPT_NETS: 10.0.4.0/24
-            # gitea never serves these; a request for one bans the client.
-            SWWAF_TRAP_PATHS: /wp-login.php,/xmlrpc.php,/wp-admin/
-        volumes:
-            - servewaf-state:/var/lib/smallwebwaf
-        networks:
-            - site
-
-networks:
-    site:
-    traefik:
-        external: true
-
-volumes:
-    gitea-data:
-    servewaf-state:
-```
-
-`deploy/gitea` holds a complete setup of gitea, traefik included, as a Docker
-Compose file. [`docs/gitea.md`](docs/gitea.md) explains it, and records what the
-defaults do in front of gitea, request by request.
-
 ### `rproxy` beside the app
 
 The app is built on the `smallwebwaf` image, with `rproxy` inside its container.
@@ -771,18 +688,6 @@ on the host.
     - orderly stops with `sv stop` and `docker stop`;
     - bans surviving a new container on the same volume;
     - a setting given as a file.
-- `script/gitea-requests`: builds the image and runs gitea 1.27.3 behind
-  `rproxy` and `servewaf`, three containers on one network. Every setting is at
-  its default, but for those that join the containers and
-  `SWWAF_LOG_REQUEST_HEADERS`, which adds the header that labels each request.
-  It sends through them a sample of gitea's ordinary use and the requests the
-  Core Rule Set is known to refuse, and prints what `servewaf` did with each.
-  Needs network access, and a docker daemon that pushes to a registry on
-  `localhost` over plain HTTP. `make gitea-requests`.
-- `script/gitea-setup`: builds the image, brings up the setup in `deploy/gitea`,
-  and checks it as [`docs/gitea.md`](docs/gitea.md) describes. Then it removes
-  the containers, the network, the volumes and the image it built. Needs network
-  access. `make gitea-setup`.
 
 ## TODO
 
@@ -806,8 +711,6 @@ on the host.
 - [`docs/state-files.md`](docs/state-files.md): the state files and what each
   holds.
 - [`docs/image.md`](docs/image.md): what the image holds and how it is pinned.
-- [`docs/gitea.md`](docs/gitea.md): `smallwebwaf` in front of gitea: the setup
-  in `deploy/gitea`, and what the defaults do there.
 
 ## License