G

docker-compose.yml

@@ -11,28 +11,34 @@ services:
       - "222:22"
     depends_on:
       - db
-    hostname: gitea.domain.test
     volumes:
-      - .ssl/wildcard.pem:/etc/ssl/certs/wildcard.pem:ro
+      - ./data:/data
-      - .ssl/wildcard.key:/etc/ssl/private/wildcard.key:ro
     environment:
       - GITEA__database__DB_TYPE=mysql
       - GITEA__database__HOST=db:3306
       - GITEA__database__NAME=gitea
       - GITEA__database__USER=gitea
-      - GITEA__database__PASSWD=gitea
+      - GITEA__database__PASSWD=${DB_PASSWD}
-      - GITEA__server__PROTOCOL=https
-      - GITEA__server__CERT_FILE=/etc/ssl/certs/wildcard.pem
-      - GITEA__server__KEY_FILE=/etc/ssl/private/wildcard.key
   db:
     image: mysql:8
     networks:
       - gitea
+    volumes:
+      - ./mysql:/var/lib/mysql
     environment:
-      - MYSQL_ROOT_PASSWORD=gitea
+      - MYSQL_ROOT_PASSWORD_FILE=/run/secrets/db_root_passwd
       - MYSQL_USER=gitea
-      - MYSQL_PASSWORD=gitea
+      - MYSQL_PASSWORD_FILE=/run/secrets/db_passwd
       - MYSQL_DATABASE=gitea
+    secrets:
+      - db_passwd
+      - db_root_passwd
 
 networks:
   gitea:
+
+secrets:
+   db_passwd:
+     file: .passwd/mysql_passwd
+   db_root_passwd:
+     file: .passwd/mysql_root_passwd

first-run.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+
+[[ ! -d .passwd ]] && mkdir .passwd
+openssl rand -base64 20 > .passwd/mysql_root_passwd
+openssl rand -base64 20 > .passwd/mysql_passwd
+echo "DB_PASSWD=$(cat .passwd/mysql_passwd)" > .env
+chmod 500 .passwd
+chmod 400 .passwd/*
+chmod 400 .env