smallwebwaf/deploy/gitea/compose.yaml

# Gitea behind traefik, with rproxy and servewaf in front of it.
# docs/gitea.md says what each setting here does and why. Before starting it:
#   - set SMALLWEBWAF_IMAGE to the smallwebwaf image, named by digest;
#   - replace git.example.org with the site's host name;
#   - replace each 10.99.0 with the first three numbers of a /24 subnet that
#     no other network on the host uses. The /24 must lie inside 10.0.0.0/8,
#     172.16.0.0/12 or 192.168.0.0/16, because rproxy believes
#     X-Forwarded-For only from those by default. Replace each fd10:99 with
#     the first two hextets of an unused /64 subnet whose third and fourth
#     hextets are 0, as in fd10:99::/64;
#   - set GITEA_SECRET_KEY to the output of
#     `docker run --rm <gitea's image below> gitea generate secret SECRET_KEY`,
#     once per install, and keep it.
# Then run `docker compose up --detach` in this directory.
# script/gitea-setup checks this setup.

name: gitea

x-logging: &logging
    driver: json-file
    options:
        max-size: 10m
        max-file: "5"

services:
    traefik:
        # traefik v3.7.17, 2026-11-03
        image: traefik@sha256:68ae5fe5b64ca166704b746a9e8afcd385e36b3f569a5691401bf652d57b3748
        # traefik replaces the X-Forwarded-For header a visitor sends. Keep it
        # so: otherwise a visitor could name an address on the shared network,
        # and skip servewaf's checks.
        command:
            - --providers.docker.exposedbydefault=false
            - --entrypoints.web.address=:80
            - --entrypoints.web.http.redirections.entrypoint.to=websecure
            - --entrypoints.websecure.address=:443
            # Until a certificate resolver is added here, as for your other
            # sites, traefik answers with a certificate it made itself.
            - --entrypoints.websecure.http.tls=true
            # traefik's own limit of 60 seconds for a whole request would cut
            # off an upload long before rproxy's limit of 30 minutes.
            - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=30m
        ports:
            - 80:80
            - 443:443
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock:ro
        networks:
            shared:
                # Containers on the shared network find traefik under the
                # site's name, and so reach it from their own address.
                aliases:
                    - git.example.org
        restart: unless-stopped

    gitea:
        # gitea 1.27.3, 2026-08-29
        image: gitea/gitea@sha256:87a67ee09d3ae0d1df5fda5dcda3e2a1f9236a45b0a59025d6e00e46adc43bef
        environment:
            GITEA__server__ROOT_URL: https://git.example.org/
            # Gitea starts at its defaults, with SQLite, instead of showing its
            # install page to whoever opens it first.
            GITEA__security__INSTALL_LOCK: "true"
            GITEA__security__SECRET_KEY: ${GITEA_SECRET_KEY:?set GITEA_SECRET_KEY, see docs/gitea.md}
            # Accounts are made with `gitea admin user create`.
            GITEA__service__DISABLE_REGISTRATION: "true"
            # rproxy's addresses. Gitea then takes each visitor's address from
            # the X-Real-Ip header traefik sets and rproxy passes on.
            GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: 10.99.0.2,fd10:99::2
        volumes:
            - gitea-data:/data
        networks:
            - shared
        restart: unless-stopped

    rproxy:
        image: ${SMALLWEBWAF_IMAGE:?set SMALLWEBWAF_IMAGE to the smallwebwaf image}
        environment:
            SWRP_WAF_BACKEND: http://servewaf:8080
            SWRP_UPSTREAM_URL: http://gitea:3000
            # Pushes, LFS objects, packages and release attachments of up to
            # 2 GiB, sent in up to 30 minutes.
            SWRP_MAX_REQUEST_SIZE: 2G
            SWRP_MAX_REQUEST_TIME_MS: "1800000"
            # 15 minutes for a clone or a download, half the default.
            SWRP_MAX_RESPONSE_TIME_MS: "900000"
        labels:
            traefik.enable: "true"
            traefik.http.routers.gitea.rule: Host(`git.example.org`)
            traefik.http.routers.gitea.entrypoints: websecure
            traefik.http.services.gitea.loadbalancer.server.port: "8080"
        networks:
            shared:
                ipv4_address: 10.99.0.2
                ipv6_address: fd10:99::2
        logging: *logging
        restart: unless-stopped

    servewaf:
        image: ${SMALLWEBWAF_IMAGE:?set SMALLWEBWAF_IMAGE to the smallwebwaf image}
        environment:
            SMALLWEBWAF_COMMAND: servewaf
            # The containers on the shared network skip the checks. Add the
            # address of an automation fleet on another host here too; without
            # that, it is counted like any client.
            SWWAF_ALLOW_NETS: 10.99.0.128/25,fd10:99:0:0:8000::/65
            # In block mode the Core Rule Set refuses everyday Gitea searches
            # and file names, and 31 refusals in a minute ban the address.
            SWWAF_WAF_MODE: detect
        volumes:
            - servewaf-state:/var/lib/smallwebwaf
        networks:
            - shared
        logging: *logging
        restart: unless-stopped

networks:
    # The network traefik and Gitea share. Its containers get addresses in the
    # upper half of each subnet, which servewaf lets skip the checks. Each
    # subnet's gateway, the host's own address on it, stays out of that half:
    # requests docker passes on from a published port can come from it.
    shared:
        enable_ipv6: true
        ipam:
            config:
                - subnet: 10.99.0.0/24
                  ip_range: 10.99.0.128/25
                  gateway: 10.99.0.1
                - subnet: fd10:99::/64
                  ip_range: fd10:99:0:0:8000::/65
                  gateway: fd10:99::1

volumes:
    gitea-data:
    servewaf-state: