# Gitea — self-hosted git + OAuth provider for Decap and Woodpecker.
# Copy this directory to /srv/gitea/ on the server, then: docker compose up -d
# Web UI is bound to localhost only; Caddy proxies git.vienalatina.com to it.

services:
  gitea:
    image: gitea/gitea:1.22
    restart: unless-stopped
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__server__DOMAIN=git.vienalatina.com
      - GITEA__server__ROOT_URL=https://git.vienalatina.com/
      - GITEA__server__SSH_DOMAIN=git.vienalatina.com
      - GITEA__service__DISABLE_REGISTRATION=true
      - GITEA__webhook__ALLOWED_HOST_LIST=ci.vienalatina.com
      # Decap is served from vienalatina.com but exchanges its OAuth code for a
      # token by calling git.vienalatina.com from the browser — a cross-origin
      # request. Without this, Gitea returns no Access-Control-Allow-Origin, the
      # browser drops the response, and Decap reports "TypeError: Failed to
      # fetch" right after you authorize, which reads like a Decap bug.
      - GITEA__cors__ENABLED=true
      - GITEA__cors__ALLOW_DOMAIN=https://vienalatina.com
      - GITEA__cors__METHODS=GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS
      - GITEA__cors__HEADERS=Content-Type,User-Agent,Authorization

      # Members reach /comunidad/ through Gitea's sign-in and authorize
      # screens, so those are part of the site's journey even for people
      # who never open a repository. DEFAULT_THEME is what anonymous
      # visitors get, which is exactly those two pages.
      # Install the theme first: bash scripts/gitea-theme.sh
      - GITEA__ui__DEFAULT_THEME=vienalatina
    volumes:
      - ./data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "127.0.0.1:3000:3000"