From e816c1b0844238dbcc23e9230f1d7943b3540e96 Mon Sep 17 00:00:00 2001
From: Tommy <contact@tommytran.io>
Date: Wed, 23 Nov 2022 08:39:45 -0500
Subject: [PATCH] Initial upload

Signed-off-by: Tommy <contact@tommytran.io>
---
 README.md           |  3 ++
 docker-compose.yml  | 80 +++++++++++++++++++++++++++++++++++++++++++++
 swag/nginx/ssl.conf | 40 +++++++++++++++++++++++
 3 files changed, 123 insertions(+)
 create mode 100644 docker-compose.yml
 create mode 100644 swag/nginx/ssl.conf

diff --git a/README.md b/README.md
index 1e687d0..0885d3f 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,5 @@
 # Gitea-Docker-Compose
 Gitea Docker-Compose
+
+1. Update `docker-compose.yml`
+2. Run `docker-compose up` and make sure nothing errors out. You can use `docker-compose up -d` to start it in the background if you want.
\ No newline at end of file
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..621df7b
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,80 @@
+version: "3"
+
+services:
+  gitea:
+    # You can use gitea/gitea:latest-rootless, but it tends to be behind gitea:latest for some reason :/
+    image: gitea/gitea:dev-rootless
+    container_name: gitea
+    restart: always
+    volumes:
+      - gitea-data:/var/lib/gitea
+      - gitea-config:/etc/gitea
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "2222:2222"
+    depends_on:
+      - mariadb
+    networks:
+      - gitea
+      - mariadb
+    restart: unless-stopped
+    read_only: true
+    user: "1000:1000"
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+  mariadb:
+    image: mariadb:latest
+    container_name: mariadb
+    restart: always
+    environment:
+      - MYSQL_ROOT_PASSWORD=gitea
+      - MYSQL_USER=gitea
+      - MYSQL_PASSWORD=changeme
+      - MYSQL_DATABASE=gitea
+    volumes:
+      - mariadb:/var/lib/mysql
+    networks:
+      - mariadb
+    restart: unless-stopped
+    user: "999:999"
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+
+  swag:
+    image: ghcr.io/linuxserver/swag
+    container_name: swag
+    cap_add:
+      - NET_ADMIN
+    environment:
+      - PUID=1000
+      - PGID=1000
+      - URL=yourdomain.tld
+      - SUBDOMAINS=git
+      - VALIDATION=http
+      - EMAIL=changeme@yourdomain.tld
+      - ONLY_SUBDOMAINS=true
+    volumes:
+      - ./swag:/config:Z
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - 443:443
+      - 80:80
+    networks:
+      - gitea
+    restart: unless-stopped
+
+networks:
+  gitea:
+  mariadb:
+
+volumes:
+  gitea-data:
+  gitea-config:
+  mariadb:
diff --git a/swag/nginx/ssl.conf b/swag/nginx/ssl.conf
new file mode 100644
index 0000000..3c1bbd4
--- /dev/null
+++ b/swag/nginx/ssl.conf
@@ -0,0 +1,40 @@
+## Version 2022/08/20 - Changelog: https://github.com/linuxserver/docker-baseimage-alpine-nginx/commits/master/root/defaults/nginx/ssl.conf.sample
+
+### Mozilla Recommendations
+# generated 2022-08-05, Mozilla Guideline v5.6, nginx 1.17.7, OpenSSL 1.1.1k, intermediate configuration
+# https://ssl-config.mozilla.org/#server=nginx&version=1.17.7&config=intermediate&openssl=1.1.1k&guideline=5.6
+
+ssl_certificate /config/keys/cert.crt;
+ssl_certificate_key /config/keys/cert.key;
+ssl_session_timeout 1d;
+ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
+ssl_session_tickets off;
+
+# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam
+ssl_dhparam /config/nginx/dhparams.pem;
+
+# intermediate configuration
+ssl_protocols TLSv1.2 TLSv1.3;
+ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
+ssl_prefer_server_ciphers off;
+
+# HSTS (ngx_http_headers_module is required) (63072000 seconds)
+add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+
+# OCSP stapling
+ssl_stapling on;
+ssl_stapling_verify on;
+
+# verify chain of trust of OCSP response using Root CA and Intermediate certs
+ssl_trusted_certificate /config/keys/cert.crt;
+
+# Optional additional headers
+add_header Content-Security-Policy "default-src 'none'; connect-src 'self'; font-src * https: data:; img-src * https: data:; manifest-src * https: data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'; block-all-mixed-content; base-uri 'none'";
+add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), screen-wake-lock=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always;
+add_header Referrer-Policy "same-origin" always;
+add_header X-Content-Type-Options "nosniff" always;
+#add_header X-UA-Compatible "IE=Edge" always;
+add_header X-XSS-Protection "0" always;
+add_header Cross-Origin-Opener-Policy same-origin;
+add_header Cross-Origin-Resource-Policy same-origin;
+add_header Expect-CT "enforce, max-age=63072000";
\ No newline at end of file