Add Traefik reverse proxy configuration for Gitea with HTTPS support and updated server settings

docker-compose.yml

@@ -7,8 +7,39 @@ networks:
 volumes:
   gitea-data:
   postgres-data:
+  traefik-certs:
 
 services:
+  traefik:
+    image: traefik:v2.9
+    container_name: traefik
+    restart: always
+    ports:
+      - "80:80"      # HTTP
+      - "443:443"    # HTTPS
+      - "8080:8080"  # Dashboard
+    networks:
+      - gitea
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - traefik-certs:/letsencrypt
+    command:
+      - "--providers.docker=true"
+      - "--providers.docker.exposedbydefault=false"
+      - "--providers.docker.network=gitea-docker_gitea"
+      - "--entrypoints.web.address=:80"
+      - "--entrypoints.websecure.address=:443"
+      - "--entrypoints.web.http.redirections.entryPoint.to=websecure"
+      - "--entrypoints.web.http.redirections.entryPoint.scheme=https"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge=true"
+      - "--certificatesresolvers.letsencrypt.acme.httpchallenge.entrypoint=web"
+      - "--certificatesresolvers.letsencrypt.acme.email=bennett.l.david@gmail.com"
+      - "--certificatesresolvers.letsencrypt.acme.storage=/letsencrypt/acme.json"
+      - "--api=true"
+      - "--api.dashboard=true"
+      - "--api.insecure=true"
+      - "--log.level=DEBUG"
+    
   server:
     image: gitea/gitea:latest
     container_name: gitea
@@ -20,15 +51,20 @@ services:
       - GITEA__database__NAME=gitea
       - GITEA__database__USER=gitea
       - GITEA__database__PASSWD=gitea
-      # SSH Configuration
+      # Server Configuration
       - GITEA__server__DOMAIN=bee8333.ddns.net
-      - GITEA__server__SSH_DOMAIN=bee8333.ddns.net
       - GITEA__server__ROOT_URL=https://bee8333.ddns.net/
-      - GITEA__server__SSH_PORT=222
+      - GITEA__server__PROTOCOL=http
+      - GITEA__server__HTTP_PORT=3000
+      - GITEA__server__SSH_DOMAIN=bee8333.ddns.net
+      - GITEA__server__SSH_PORT=2224
       - GITEA__server__SSH_LISTEN_PORT=22
-      - GITEA__server__PROTOCOL=https
-      - GITEA__server__CERT_FILE=/data/gitea/cert.pem
-      - GITEA__server__KEY_FILE=/data/gitea/key.pem
+      - GITEA__server__START_SSH_SERVER=false
+      - GITEA__server__OFFLINE_MODE=false
+      - GITEA__server__ENABLE_GZIP=true
+      # Reverse Proxy Settings
+      - GITEA__server__USE_PROXY_PROTOCOL=false
+      - GITEA__server__PROXY_PROTOCOL_TLS_BRIDGING=false
     restart: always
     networks:
       - gitea
@@ -36,13 +72,25 @@ services:
       - gitea-data:/data
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
-      - ./gitea/ssl/cert.pem:/data/gitea/cert.pem:ro
-      - ./gitea/ssl/key.pem:/data/gitea/key.pem:ro
     ports:
-      - "3000:3000"  # Web UI: Host port 3000 -> Container port 3000
-      - "222:22"     # SSH: Host port 222 -> Container port 22
+      - "2224:22"    # SSH: Host port 2224 -> Container port 22
     depends_on:
       - db
+    labels:
+      - "traefik.enable=true"
+      # HTTP Configuration for HTTPS access
+      - "traefik.http.routers.gitea.rule=Host(`bee8333.ddns.net`)"
+      - "traefik.http.routers.gitea.entrypoints=websecure"
+      - "traefik.http.routers.gitea.tls.certresolver=letsencrypt"
+      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
+      - "traefik.http.middlewares.gitea-headers.headers.customrequestheaders.X-Forwarded-Proto=https"
+      - "traefik.http.routers.gitea.middlewares=gitea-headers@docker"
+      # HTTP Configuration for HTTP -> HTTPS redirection
+      - "traefik.http.routers.gitea-http.rule=Host(`bee8333.ddns.net`)"
+      - "traefik.http.routers.gitea-http.entrypoints=web"
+      - "traefik.http.middlewares.https-redirect.redirectscheme.scheme=https"
+      - "traefik.http.middlewares.https-redirect.redirectscheme.permanent=true"
+      - "traefik.http.routers.gitea-http.middlewares=https-redirect@docker"
 
   db:
     image: postgres:14