Bind Gitea web port to loopback only

nginx is the only consumer; 0.0.0.0:3000 exposed Gitea directly and
was used to plant a Monero miner (Sep 2026).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -28,7 +28,9 @@ services:
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     ports:
-      - "${GITEA_HTTP_PORT}:3000"
+      # Web is loopback-only: nginx (repos.guschin.info) is the only consumer.
+      # Was 0.0.0.0 — exposed Gitea directly; exploited for a miner in Sep 2026.
+      - "127.0.0.1:${GITEA_HTTP_PORT}:3000"
       - "${GITEA_SSH_PORT}:22"
     extra_hosts:
       - "host.docker.internal:host-gateway"