# Gitea on dankclaw

Private Git hosting on dankclaw. Three quadlet-managed containers in the rootless podman session of user `dank`: Gitea, PostgreSQL, Caddy.

**Host:** dankclaw (71.227.227.172)
**Config:** `~/.config/containers/systemd/gitea-{postgres,server,caddy}.container` + `gitea.network`
**Local access:** `http://dankclaw:3000`
**Domain:** `https://gitea.franksdank.cloud` (DNS pending)

## Architecture

| Container | Unit | Port | Purpose |
|---|---|---|---|
| `gitea-server` | `gitea-server.service` | 3000 (HTTP), 2222 (SSH) | Git web UI, API, SSH daemon |
| `gitea-postgres` | `gitea-postgres.service` | 5432 (internal) | Database |
| `gitea-caddy` | `gitea-caddy.service` | 80, 443 | Reverse proxy, auto-TLS |

The containers share the private network `systemd-gitea` (quadlet `gitea.network`, DNS enabled). The automatic `podman` default network has DNS disabled; do not run the stack on it.

## Management

All commands run as `dank` on dankclaw.

| Action | Command |
|---|---|
| Start all | `systemctl --user start gitea-postgres gitea-server gitea-caddy` |
| Stop all | `systemctl --user stop gitea-caddy gitea-server gitea-postgres` |
| Restart Gitea only | `systemctl --user restart gitea-server` |
| Follow logs | `podman logs -f gitea-server` or `journalctl --user -u gitea-server -f` |
| Check status | `systemctl --user status gitea-postgres gitea-server gitea-caddy` |

## Data Persistence

All data lives on host bind mounts under `/opt/gitea/data/`. Containers are ephemeral. Stopping a quadlet unit removes its container; the next start recreates it. Volumes survive.

| Volume Path | Container Mount | Contents |
|---|---|---|
| `/opt/gitea/data/gitea-gitea/` | `/data` | Git repositories, app.ini, attachments |
| `/opt/gitea/data/gitea-postgres/` | `/var/lib/postgresql/data` | PostgreSQL data files |
| `/opt/gitea/data/caddy/data/` | `/root/.local/share/caddy` | Caddy configuration, TLS certs |

See [[data-persistence|data-persistence]] for backup and restore.

## Boot Persistence

User-level linger is enabled for `dank`. The units start at host boot without a login. Each unit carries `[Install] WantedBy=default.target`; the podman generator applies it. The legacy podman-compose stack had no units and did not survive reboots (incident 2026-08-16).

See [[management|management]] for boot persistence details and troubleshooting.

## Repo Copies

The quadlet files, Caddyfile, and `.env.example` are tracked in the `serverAppConfigs` repo under `dankclaw/gitea/`. The live password lives only in `/opt/gitea/.env` on the host (mode 0600).

## See Also

- [[architecture|architecture]] — network topology and ports
- [[management|management]] — operations, upgrades, backups, incident log
- [[client-access|client-access]] — client-side tokens, the credential store, and the git 2.56 store-format trap
- [[data-persistence|data-persistence]] — volumes and backup strategy
- [[containers|containers]] — quadlet reference

  * [Gitea Architecture](architecture.md) — Gitea container architecture, network topology, and Caddy reverse proxy configuration on dankclaw.

  * [Gitea Data Persistence](data-persistence.md) — Gitea data persistence, volume mounts, ownership, and backup strategy on dankclaw.

  * [Gitea Management](management.md) — Gitea container management, boot persistence, troubleshooting, upgrades, and backup procedures on dankclaw.

  * [Gitea Client Access](client-access.md) — Token-based HTTP access from client workstations, credential store layout, and verification.