# Quadlet unit: Gitea web server (rootless, boot-persistent).
#
# Install path on dankclaw: ~/.config/containers/systemd/gitea-server.container
# Unit name: gitea-server.service (podman 5.x drops the container- prefix)
#
# The [Service] EnvironmentFile= line lets systemd expand
# ${GITEA_DB_PASSWORD} in the generated ExecStart.
# The DB password lives in /home/dank/Containers/gitea/env on the host (mode 0600).
# This file holds no secrets. See serverAppConfigs-docs/Dankclaw/Gitea.md.
#
# Ports (live): 3000 = HTTP UI/API, 2222 = git SSH. The docs table in
# Dankclaw Stack.md historically said 3001; the live host port is 3000.

[Unit]
Description=Gitea web server container
Wants=gitea-postgres.service
After=gitea-postgres.service network.target

[Container]
ContainerName=gitea-server
Network=gitea.network
Image=docker.io/gitea/gitea:latest@sha256:30777c91280d973fa02be48b1ade735bd6859e8f6f7af3b4444d519437852504
EnvironmentFile=/home/dank/Containers/gitea/env
Environment=DATABASE_TYPE=postgres
Environment=DATABASE_HOST=gitea-postgres
Environment=DATABASE_NAME=gitea
Environment=DATABASE_USER=gitea
Environment=DATABASE_PASSWD=${GITEA_DB_PASSWORD}
Environment=DATABASE_PORT=5432
Environment=USER_UID=1000
Environment=USER_GID=1000
# Prometheus scrapes /metrics over the published LAN port (job "gitea" in
# shared/prometheus/prometheus.yml). Off, /metrics is a 404 and the target is
# permanently red (the audit's "disabled metrics" class). 0.0.0.0 binds inside
# the container; the only route in is this host's published 3000, and the
# exposed surface is counters only — same posture as the LLM /metrics.
Environment=GITEA__metrics__ENABLED=true
Environment=GITEA__metrics__ENABLED_HOST=0.0.0.0
PublishPort=0.0.0.0:3000:3000
PublishPort=2222:22
Volume=/home/dank/Containers/gitea/data:/data
Volume=/etc/timezone:/etc/timezone:ro
Volume=/etc/localtime:/etc/localtime:ro

[Service]
EnvironmentFile=/home/dank/Containers/gitea/env
TimeoutStartSec=900
Restart=always

[Install]
WantedBy=default.target