dank/serverAppConfigs
1
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

Gitea: document rootless privileged-port sysctl fix

Browse Source 
Rootless podman cannot bind ports below 1024 by default, so gitea-caddy
(publishes 80/443) crash-looped (13,000+ restarts). Fix: one-time sysctl
net.ipv4.ip_unprivileged_port_start=80, persisted in
/etc/sysctl.d/99-rootless-ports.conf. Applied 2026-08-18.
This commit is contained in:
Frank
2026-08-18 13:55:37 -07:00
parent e3cd2aca1b
commit b4f1043b1a
1 changed files with 1 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/Dankclaw/Gitea.md
+1
View File
@@ -84,6 +84,7 @@ Back up `/opt/gitea/data/` (tar) or `pg_dump` the database. See the knowledge ba
- **The host auto-reboots.** `unattended-upgrades` reboots Dankclaw when a package needs it. The quadlet units make Gitea survive that. See the 2026-08-16 incident below.
- **Port 3000 vs 3001.** The live host port is 3000. The full-stack [`dankclaw/compose.yaml`](../compose.yaml) maps 3001. Align the two before deploying the full stack.
- **Legacy compose retired.** `/opt/gitea/podman-compose.yml` is retired to `/opt/gitea/.deprecated/`. Do not run it; its containers would collide with the quadlet units on ports 3000, 2222, 80, and 443.
- **Rootless cannot bind ports below 1024 by default.** `gitea-caddy` publishes 80 and 443. Without a host sysctl, `rootlessport` fails with `permission denied` and the unit crash-loops under `Restart=always`. The fix is a one-time sysctl: `net.ipv4.ip_unprivileged_port_start=80`, persisted in `/etc/sysctl.d/99-rootless-ports.conf`. Applied 2026-08-18 after a 13,000-restart crash loop.
## Incident: 2026-08-16 — down after unattended reboot