Setting Up a Private Git Service with Gitea

There is always code that doesn’t fit on someone else’s server, so why not build your own Git service. This tutorial uses Docker, making deployment easy, migration simple, and it supports https.

Steps

1. Preparation

Pick a path you like and create a new folder to store all the files that come later. Here I recommend naming it Gitea.

Then create ./docker-compose.yml for quickly deploying the container.

2. Edit docker-compose.yml

docker-compose.yml is modified from the official documentation, using the configuration given in the PostgreSQL Database section.

Here, in addition to the gitea and postgres images, I also added the nginx image to enable https.

The content is as follows, and you can modify it as needed:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

version: "3"

networks:
  gitea:
    external: false

services:
  server:
    image: gitea/gitea:latest
    container_name: gitea
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=db:5432
      - GITEA__database__NAME=gitea
      - GITEA__database__USER=gitea
      - GITEA__database__PASSWD=gitea
    restart: always
    networks:
      - gitea
    volumes:
      - ./gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    # ports:
    #   - "3000:3000"
    #   - "222:22"
    depends_on:
      - db
      - reverse_proxy

  db:
    image: postgres:14
    restart: always
    environment:
      - POSTGRES_USER=gitea
      - POSTGRES_PASSWORD=gitea
      - POSTGRES_DB=gitea
    networks:
      - gitea
    volumes:
      - ./postgres:/var/lib/postgresql/data

  reverse_proxy:
    image: nginx:latest
    restart: always
    networks:
      - gitea
    ports:
      - "443:443"
    volumes:
      - ./nginx/conf.d/gitea.conf:/etc/nginx/conf.d/gitea.conf
      - ./nginx/gitea.crt:/etc/nginx/gitea.crt
      - ./nginx/gitea.key:/etc/nginx/gitea.key

3. Configure https

Create the directory ./nginx/conf.d, and create the files ./nginx/conf.d/gitea.conf, ./nginx/gitea.crt, and ./nginx/gitea.key:

1
2

mkdir -p ./nginx/conf.d
touch ./nginx/conf.d/gitea.conf ./nginx/gitea.crt ./nginx/gitea.key

Edit gitea.conf:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

server {
    # SSL access port number is 443
    listen 443 ssl;
    # Enter the domain bound to the certificate
    server_name gitea.com;
    
    # If they come here using HTTP, bounce them to the correct scheme
    error_page 497 https://$server_name:$server_port$request_uri;

    # Upload size limit
    client_max_body_size 1000M;
    # Logs
    error_log /var/log/nginx/error.log;
    access_log /var/log/nginx/access.log;
    # Certificate file
    ssl_certificate /etc/nginx/gitea.crt;
    # Certificate key file
    ssl_certificate_key /etc/nginx/gitea.key;

    ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
    ssl_ciphers ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS;
    ssl_prefer_server_ciphers on;
    location / {
        proxy_pass http://gitea:3000;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Host $http_host;
        proxy_set_header X-Nginx-Proxy true;
    }
}

Copy the SSL certificate content into gitea.crt and gitea.key.

4. Start the Containers

1
2

# -d: run in the background
docker-compose up -d

Then visit the website and you can start using it.

References