Part of #169, after the split (#172). A read-only review of v1.0.0-rc2 in front of stock Gitea 1.27.3 found what Gitea needs, summarized on #169. sneak, 4 November: the sandcastle container that makes Gitea API calls is on the same host and the same Docker network as Gitea and reaches it through traefik, so it is allowed naturally; the request size limit and the response time need setting for Gitea, and the 30-minute response limit can come down, never up.
What to build
deploy/gitea/: a Docker Compose setup for running Gitea behind traefik with rproxy and servewaf, and a test of it.
Four services: traefik, stock Gitea (the image script/gitea-requests pins), rproxy in a container of its own in front of Gitea, and servewaf in a container of its own with a state volume. Restart policies and log rotation on rproxy and servewaf.
A Docker network with a fixed subnet that Gitea and traefik share, given to servewaf as SWWAF_ALLOW_NETS, so that a container on it, such as sandcastle, skips the checks. A comment says to add the fleet's address there too if it ever runs on another host, and that the default request limits are sized for such a fleet.
rproxy's settings for Gitea: SWRP_MAX_REQUEST_SIZE=2G and SWRP_MAX_REQUEST_TIME_MS=1800000, so pushes, LFS objects, packages and release attachments up to 2 GiB and 30 minutes pass; SWRP_MAX_RESPONSE_TIME_MS=900000, 15 minutes, lowered from 30 as sneak allowed; SWRP_MAX_RESPONSE_SIZE at its default.
servewaf's settings for Gitea: SWWAF_WAF_MODE=detect, since in block the Core Rule Set refuses everyday Gitea searches and file names (docs/gitea.md), and 31 such refusals in a minute ban the address. Disclose that choice in the PR.
Gitea's REVERSE_PROXY_TRUSTED_PROXIES names rproxy's address, so that Gitea logs each visitor, not rproxy.
Test
script/gitea-setup, run with make gitea-setup, outside make check like script/gitea-requests: brings the setup up under a name of its own, sends through traefik a web page load, a push and a clone, checks that each passed through rproxy and servewaf, and that a request from the shared network was allowed without the checks; stops servewaf and checks that Gitea still answers through rproxy; then removes every container, network, volume and image it made, however it ends. Every wait has a timeout.
Documents
docs/gitea.md is rewritten around the setup: what it sets and why, and what the defaults would do without it. README.md names deploy/gitea and the script in a line each.
Model: opus-5-5
Part of https://git.eeqj.de/sneak/smallwebwaf/issues/169, after the split (https://git.eeqj.de/sneak/smallwebwaf/issues/172). A read-only review of `v1.0.0-rc2` in front of stock Gitea 1.27.3 found what Gitea needs, summarized on https://git.eeqj.de/sneak/smallwebwaf/issues/169. sneak, 4 November: the sandcastle container that makes Gitea API calls is on the same host and the same Docker network as Gitea and reaches it through traefik, so it is allowed naturally; the request size limit and the response time need setting for Gitea, and the 30-minute response limit can come down, never up.
## What to build
`deploy/gitea/`: a Docker Compose setup for running Gitea behind traefik with rproxy and servewaf, and a test of it.
- Four services: traefik, stock Gitea (the image `script/gitea-requests` pins), rproxy in a container of its own in front of Gitea, and servewaf in a container of its own with a state volume. Restart policies and log rotation on rproxy and servewaf.
- A Docker network with a fixed subnet that Gitea and traefik share, given to servewaf as `SWWAF_ALLOW_NETS`, so that a container on it, such as sandcastle, skips the checks. A comment says to add the fleet's address there too if it ever runs on another host, and that the default request limits are sized for such a fleet.
- rproxy's settings for Gitea: `SWRP_MAX_REQUEST_SIZE=2G` and `SWRP_MAX_REQUEST_TIME_MS=1800000`, so pushes, LFS objects, packages and release attachments up to 2 GiB and 30 minutes pass; `SWRP_MAX_RESPONSE_TIME_MS=900000`, 15 minutes, lowered from 30 as sneak allowed; `SWRP_MAX_RESPONSE_SIZE` at its default.
- servewaf's settings for Gitea: `SWWAF_WAF_MODE=detect`, since in `block` the Core Rule Set refuses everyday Gitea searches and file names (`docs/gitea.md`), and 31 such refusals in a minute ban the address. Disclose that choice in the PR.
- Gitea's `REVERSE_PROXY_TRUSTED_PROXIES` names rproxy's address, so that Gitea logs each visitor, not rproxy.
## Test
`script/gitea-setup`, run with `make gitea-setup`, outside `make check` like `script/gitea-requests`: brings the setup up under a name of its own, sends through traefik a web page load, a push and a clone, checks that each passed through rproxy and servewaf, and that a request from the shared network was allowed without the checks; stops servewaf and checks that Gitea still answers through rproxy; then removes every container, network, volume and image it made, however it ends. Every wait has a timeout.
## Documents
`docs/gitea.md` is rewritten around the setup: what it sets and why, and what the defaults would do without it. `README.md` names `deploy/gitea` and the script in a line each.
Model: opus-5-5
clawbot
self-assigned this 2026-11-04 20:09:56 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Part of #169, after the split (#172). A read-only review of
v1.0.0-rc2in front of stock Gitea 1.27.3 found what Gitea needs, summarized on #169. sneak, 4 November: the sandcastle container that makes Gitea API calls is on the same host and the same Docker network as Gitea and reaches it through traefik, so it is allowed naturally; the request size limit and the response time need setting for Gitea, and the 30-minute response limit can come down, never up.What to build
deploy/gitea/: a Docker Compose setup for running Gitea behind traefik with rproxy and servewaf, and a test of it.script/gitea-requestspins), rproxy in a container of its own in front of Gitea, and servewaf in a container of its own with a state volume. Restart policies and log rotation on rproxy and servewaf.SWWAF_ALLOW_NETS, so that a container on it, such as sandcastle, skips the checks. A comment says to add the fleet's address there too if it ever runs on another host, and that the default request limits are sized for such a fleet.SWRP_MAX_REQUEST_SIZE=2GandSWRP_MAX_REQUEST_TIME_MS=1800000, so pushes, LFS objects, packages and release attachments up to 2 GiB and 30 minutes pass;SWRP_MAX_RESPONSE_TIME_MS=900000, 15 minutes, lowered from 30 as sneak allowed;SWRP_MAX_RESPONSE_SIZEat its default.SWWAF_WAF_MODE=detect, since inblockthe Core Rule Set refuses everyday Gitea searches and file names (docs/gitea.md), and 31 such refusals in a minute ban the address. Disclose that choice in the PR.REVERSE_PROXY_TRUSTED_PROXIESnames rproxy's address, so that Gitea logs each visitor, not rproxy.Test
script/gitea-setup, run withmake gitea-setup, outsidemake checklikescript/gitea-requests: brings the setup up under a name of its own, sends through traefik a web page load, a push and a clone, checks that each passed through rproxy and servewaf, and that a request from the shared network was allowed without the checks; stops servewaf and checks that Gitea still answers through rproxy; then removes every container, network, volume and image it made, however it ends. Every wait has a timeout.Documents
docs/gitea.mdis rewritten around the setup: what it sets and why, and what the defaults would do without it.README.mdnamesdeploy/giteaand the script in a line each.Model: opus-5-5