mguschinandClaude Opus 5.5
97df1c2032
nginx is the only consumer; 0.0.0.0:3000 exposed Gitea directly and was used to plant a Monero miner (Sep 2026). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
45 lines
1.3 KiB
YAML
45 lines
1.3 KiB
YAML
version: '3.8'
|
|
|
|
services:
|
|
gitea:
|
|
image: gitea/gitea:latest
|
|
container_name: gitea
|
|
environment:
|
|
- USER_UID=1000
|
|
- USER_GID=1000
|
|
- GITEA__database__DB_TYPE=mysql
|
|
- GITEA__database__HOST=${DB_HOST}
|
|
- GITEA__database__NAME=${DB_NAME}
|
|
- GITEA__database__USER=${DB_USER}
|
|
- GITEA__database__PASSWD=${DB_PASSWORD}
|
|
- GITEA__server__DOMAIN=${GITEA_DOMAIN}
|
|
- GITEA__server__SSH_DOMAIN=${GITEA_DOMAIN}
|
|
- GITEA__server__ROOT_URL=${GITEA_ROOT_URL}
|
|
- GITEA__server__HTTP_PORT=3000
|
|
- GITEA__server__SSH_PORT=22
|
|
- GITEA__service__DISABLE_REGISTRATION=true
|
|
- GITEA__OPENID__ENABLE_OPENID_SIGNIN=false
|
|
- GITEA__OPENID__ENABLE_OPENID_SIGNUP=false
|
|
restart: unless-stopped
|
|
networks:
|
|
- gitea
|
|
volumes:
|
|
- gitea-data:/data
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
ports:
|
|
# Web is loopback-only: nginx (repos.guschin.info) is the only consumer.
|
|
# Was 0.0.0.0 — exposed Gitea directly; exploited for a miner in Sep 2026.
|
|
- "127.0.0.1:${GITEA_HTTP_PORT}:3000"
|
|
- "${GITEA_SSH_PORT}:22"
|
|
extra_hosts:
|
|
- "host.docker.internal:host-gateway"
|
|
|
|
networks:
|
|
gitea:
|
|
driver: bridge
|
|
|
|
volumes:
|
|
gitea-data:
|
|
driver: local
|