Frank
cfed6ef7bb
New tools/gitea/client-access.md: the credential file (~/.config/secrets/gitea, 0600) behind a global 'store --file' helper, the git 2.56 credential-store trap (the key=value block shape parses to an empty get; the file must be one http://user:token@host:port URL per line), the GIT_TERMINAL_PROMPT=0 verification loop, the lfs.locksverify key that silences the URL echo, and the rotation procedure. Cross-linked from the gitea index and management pages. Both workstation remotes are now bare URLs; the token lives in one file.
3.5 KiB
Gitea on dankclaw
Private Git hosting on dankclaw. Three quadlet-managed containers in the rootless podman session of user dank: Gitea, PostgreSQL, Caddy.
Host: dankclaw (71.227.227.172)
Config: ~/.config/containers/systemd/gitea-{postgres,server,caddy}.container + gitea.network
Local access: http://dankclaw:3000
Domain: https://gitea.franksdank.cloud (DNS pending)
Architecture
| Container | Unit | Port | Purpose |
|---|---|---|---|
gitea-server |
gitea-server.service |
3000 (HTTP), 2222 (SSH) | Git web UI, API, SSH daemon |
gitea-postgres |
gitea-postgres.service |
5432 (internal) | Database |
gitea-caddy |
gitea-caddy.service |
80, 443 | Reverse proxy, auto-TLS |
The containers share the private network systemd-gitea (quadlet gitea.network, DNS enabled). The automatic podman default network has DNS disabled; do not run the stack on it.
Management
All commands run as dank on dankclaw.
| Action | Command |
|---|---|
| Start all | systemctl --user start gitea-postgres gitea-server gitea-caddy |
| Stop all | systemctl --user stop gitea-caddy gitea-server gitea-postgres |
| Restart Gitea only | systemctl --user restart gitea-server |
| Follow logs | podman logs -f gitea-server or journalctl --user -u gitea-server -f |
| Check status | systemctl --user status gitea-postgres gitea-server gitea-caddy |
Data Persistence
All data lives on host bind mounts under /opt/gitea/data/. Containers are ephemeral. Stopping a quadlet unit removes its container; the next start recreates it. Volumes survive.
| Volume Path | Container Mount | Contents |
|---|---|---|
/opt/gitea/data/gitea-gitea/ |
/data |
Git repositories, app.ini, attachments |
/opt/gitea/data/gitea-postgres/ |
/var/lib/postgresql/data |
PostgreSQL data files |
/opt/gitea/data/caddy/data/ |
/root/.local/share/caddy |
Caddy configuration, TLS certs |
See data-persistence for backup and restore.
Boot Persistence
User-level linger is enabled for dank. The units start at host boot without a login. Each unit carries [Install] WantedBy=default.target; the podman generator applies it. The legacy podman-compose stack had no units and did not survive reboots (incident 2026-08-16).
See management for boot persistence details and troubleshooting.
Repo Copies
The quadlet files, Caddyfile, and .env.example are tracked in the serverAppConfigs repo under dankclaw/gitea/. The live password lives only in /opt/gitea/.env on the host (mode 0600).
See Also
-
architecture — network topology and ports
-
management — operations, upgrades, backups, incident log
-
client-access — client-side tokens, the credential store, and the git 2.56 store-format trap
-
data-persistence — volumes and backup strategy
-
containers — quadlet reference
-
Gitea Architecture — Gitea container architecture, network topology, and Caddy reverse proxy configuration on dankclaw.
-
Gitea Data Persistence — Gitea data persistence, volume mounts, ownership, and backup strategy on dankclaw.
-
Gitea Management — Gitea container management, boot persistence, troubleshooting, upgrades, and backup procedures on dankclaw.
-
Gitea Client Access — Token-based HTTP access from client workstations, credential store layout, and verification.
-