Frank
ae82aa00e4
Census against serverAppConfigs-docs + read-only ssh probes on both boxes (2026-10-18). Corrections to OURS, flags only for THEIRS: - Hardware drift: RTX 3090 moved dankserver->dankclaw 2026-09; dankserver now 2x Radeon AI PRO R9700 (Ryzen 7 7700X stays), 246 GiB RAM, no swap; dankclaw 121 GiB RAM + 64 GiB swap. Served: frank-archon radiance TP=2 (:7770 dankserver), frank-dragoon halogen NATIVE v2 (:7770 dankclaw iGPU), frank-zealot llama.cpp PrismML Ternary-Bonsai-2-27B PQ2_0 (:7771 dankclaw, 3090). Kernel 7.0.0-38 both; dankclaw :7770 no auth. - Gitea: gitea-caddy quadlet retired (fleet Caddy fronts the domain); data tree moved to /home/dank/Containers/gitea/ (2026-09-01 standard), /opt/gitea is a do-not-use leftover; LAN IP + live domain. - pi-era pages (core/settings, pi/models + role tables) demarcated as ARCHIVE with banners; llama-cpp fleet note modernized. - AGENTS.md machine-facts table corrected (it still routed prod warnings at frank-default-large). Their-side staleness flagged in the changelog entry for the operator, not edited: OMP Harness thresholdPercent 70 (live is 95), Ubuntu 24.04 OS table, 2026-09-03 stack mapping, superseded pi-KB backlink. Refs #5
88 lines
3.6 KiB
Markdown
88 lines
3.6 KiB
Markdown
---
|
|
type: reference
|
|
title: Gitea Architecture
|
|
description: Gitea container architecture, network topology, and Caddy reverse proxy configuration on dankclaw.
|
|
tags:
|
|
- gitea
|
|
- architecture
|
|
verified: 2026-10-18
|
|
---
|
|
|
|
# Gitea Architecture
|
|
|
|
Two quadlet-managed containers (Gitea, PostgreSQL) on a shared private Podman network (rootless, user `dank`). Gitea connects to PostgreSQL via network DNS. The fleet Caddy (separate stack, see [/caddy/index.md](/caddy/index.md)) proxies HTTP/S to Gitea — the old dedicated `gitea-caddy` container is retired.
|
|
|
|
## Network Topology
|
|
|
|
```
|
|
Client (HTTPS)
|
|
↓
|
|
caddy :80/:443 (auto-TLS via Let's Encrypt DNS-01/Porkbun)
|
|
↓ reverse_proxy 192.168.0.143:3000 (published quadlet port)
|
|
gitea-server :3000 (web UI, API)
|
|
↓ PostgreSQL protocol
|
|
gitea-postgres :5432 (internal only)
|
|
```
|
|
|
|
## Network
|
|
|
|
The containers share the quadlet network `systemd-gitea` (file `gitea.network`, DNS enabled by default). Container names resolve via network DNS.
|
|
|
|
The automatic rootless `podman` default network has `dns_enabled: false`. Container names do not resolve there. Keep the Gitea stack on `systemd-gitea`.
|
|
|
|
## Container and Unit Names
|
|
|
|
| Container | Unit | Depends on |
|
|
|---|---|---|
|
|
| `gitea-postgres` | `gitea-postgres.service` | `gitea-network.service` |
|
|
| `gitea-server` | `gitea-server.service` | `gitea-postgres.service` |
|
|
|
|
Podman 5.x names quadlet units after the file (`gitea-server.service`), with no `container-` prefix.
|
|
|
|
## Caddy Configuration
|
|
|
|
Caddy is a separate quadlet-managed service (`caddy.container`) on the shared `dankclaw_default` network. The live Caddyfile at `/home/dank/Containers/caddy/Caddyfile` proxies Gitea via the published quadlet port:
|
|
|
|
```
|
|
gitea.franksdank.cloud {
|
|
reverse_proxy 192.168.0.143:3000
|
|
}
|
|
```
|
|
|
|
- Caddy issues Let's Encrypt certs via DNS-01 (Porkbun module) — no inbound HTTP port needed.
|
|
- Pi-hole quadlet resolves `gitea.franksdank.cloud` to `192.168.0.143` via `addn-hosts`.
|
|
- Serves HTTP on port 80 and HTTPS on port 443, both bound to `0.0.0.0`.
|
|
|
|
## Gitea Configuration
|
|
|
|
Quadlet file: `~/.config/containers/systemd/gitea-server.container` (repo copy: `serverAppConfigs/dankclaw/gitea/quadlet/gitea-server.container`)
|
|
|
|
Key environment variables:
|
|
- `DATABASE_TYPE=postgres`
|
|
- `DATABASE_HOST=gitea-postgres` (network DNS)
|
|
- `DATABASE_NAME=gitea`
|
|
- `DATABASE_USER=gitea`
|
|
- `DATABASE_PASSWD` from `/home/dank/Containers/gitea/env` (mode 0600)
|
|
- `USER_UID=1000`, `USER_GID=1000`
|
|
|
|
Gitea writes `/data/gitea/conf/app.ini` on first start (host: `/home/dank/Containers/gitea/data/gitea/conf/app.ini`). The `[database] HOST` and `PASSWD` lines in app.ini override the env vars. When you rename the database container, edit the `HOST` line in app.ini as well.
|
|
|
|
## Ports
|
|
|
|
| Service | Host Binding | Container Port | Access |
|
|
|---|---|---|---|
|
|
| Gitea HTTP | `0.0.0.0:3000` | 3000 | Web UI, API |
|
|
| Gitea SSH | `0.0.0.0:2222` | 22 | Git clone/push via SSH |
|
|
| PostgreSQL | `5432` (internal) | 5432 | Container-to-container only |
|
|
|
|
Note: the full-stack repo compose (`dankclaw/compose.yaml`) maps Gitea HTTP to host port 3001. The live stack uses 3000. Align before the full-stack deploy.
|
|
|
|
|
|
`gitea.franksdank.cloud` resolves to `192.168.0.143` via the Pi-hole quadlet's `addn-hosts`. Caddy obtains Let's Encrypt certs via DNS-01 (Porkbun module), which requires no inbound port reachability. LAN clients reach Gitea via `http://dankclaw:3000` (published quadlet port).
|
|
|
|
## See Also
|
|
|
|
- ](index.md) — index with management commands
|
|
- [[management|management]] — operations, boot persistence, incident
|
|
- [[data-persistence|data-persistence]] — volumes and backups
|