From 58dfcd2ebbee814baf2ae45ada79bc86e020efd9 Mon Sep 17 00:00:00 2001
From: Per Magnus Petersen <magnus@pmagnus.dk>
Date: Tue, 8 Sep 2026 16:06:44 +0000
Subject: [PATCH] Move to dedicated Postgres and netbird-only SSH; DB password
 to .env
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

docker-compose.yml had drifted from the committed version during the move to
this host: a dedicated gitea-postgres service replaces the shared postgres-db
on the LAN box, and SSH is now published on the netbird interface only
(100.75.252.111:2222) instead of 0.0.0.0.

The database password is no longer inline — both POSTGRES_PASSWORD and
GITEA__database__PASSWD read ${POSTGRES_PASSWORD} from .env (gitignored,
mode 0600). .env.example documents the key, and *.bak-* is now ignored.

Note: run docker compose from this directory, otherwise .env is not picked up
and the variable resolves empty.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kjn2zm5PJ5y9t4HjpGouWR
---
 .env.example       |  2 ++
 .gitignore         |  1 +
 docker-compose.yml | 26 ++++++++++++++++++++------
 3 files changed, 23 insertions(+), 6 deletions(-)
 create mode 100644 .env.example

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..7809634
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,2 @@
+# Copy to .env and fill in. Used by docker-compose.yml.
+POSTGRES_PASSWORD=change-me
diff --git a/.gitignore b/.gitignore
index 89d6663..ddf31c8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 *.zip
 *.log
 .env
+*.bak-*
diff --git a/docker-compose.yml b/docker-compose.yml
index bf0ed60..6f65e91 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,24 +1,37 @@
 services:
+  postgres:
+    image: postgres:16-alpine
+    container_name: gitea-postgres
+    restart: unless-stopped
+    environment:
+      - POSTGRES_USER=gitea
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=gitea
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+
   gitea:
     image: gitea/gitea:latest
     container_name: gitea
+    depends_on:
+      - postgres
     environment:
       - USER_UID=1000
       - USER_GID=1000
       - GITEA__database__DB_TYPE=postgres
-      - GITEA__database__HOST=192.168.50.42:5432
+      - GITEA__database__HOST=postgres:5432
       - GITEA__database__NAME=gitea
-      - GITEA__database__USER=postgres
-      - GITEA__database__PASSWD=ratata,123
+      - GITEA__database__USER=gitea
+      - GITEA__database__PASSWD=${POSTGRES_PASSWORD}
     restart: unless-stopped
     volumes:
       - gitea_data:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
-      - /data/backup/gitea:/tmp/backup
+      - ./backup:/tmp/backup
     ports:
       - "3008:3000"
-      - "2222:22"
+      - "100.75.252.111:2222:22"
 
   gitea-backup:
     image: alpine:3.21
@@ -30,7 +43,7 @@ services:
       - BACKUP_RETAIN_DAYS=7
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
-      - /data/backup/gitea:/backup
+      - ./backup:/backup
       - ./backup.sh:/usr/local/bin/backup.sh:ro
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
@@ -45,3 +58,4 @@ services:
 
 volumes:
   gitea_data:
+  postgres_data: