chore: add gitea mariadb deployment

deploy/gitea/.env.example

@@ -0,0 +1,2 @@
+MARIADB_ROOT_PASSWORD=replace-with-a-long-random-password
+MARIADB_PASSWORD=replace-with-another-long-random-password

deploy/gitea/Caddyfile.snippet

@@ -0,0 +1,4 @@
+git.roncarve.com {
+	encode zstd gzip
+	reverse_proxy gitea:3000
+}

deploy/gitea/README.md

@@ -0,0 +1,13 @@
+# Gitea self-managed deployment
+
+Gitea runs behind the existing Caddy gateway at `https://git.roncarve.com` and stores its data in MariaDB.
+The web service is private to Docker network `gateway_gateway`; Caddy proxies to `gitea:3000`.
+Git over SSH is exposed on host port `2222`:
+
+```text
+git clone ssh://git@git.roncarve.com:2222/owner/repository.git
+```
+
+Persistent data is stored under `/opt/gitea` on the server. MariaDB is only available inside the Docker network and is not exposed on a host port.
+
+The first visit opens Gitea's installation page. Complete the setup and create the first administrator account there.

deploy/gitea/docker-compose.yml

@@ -0,0 +1,62 @@
+services:
+  gitea:
+    image: docker.gitea.com/gitea:latest
+    container_name: gitea
+    hostname: git.roncarve.com
+    restart: unless-stopped
+    depends_on:
+      mariadb:
+        condition: service_healthy
+    env_file:
+      - .env
+    environment:
+      GITEA__server__DOMAIN: git.roncarve.com
+      GITEA__server__SSH_DOMAIN: git.roncarve.com
+      GITEA__server__ROOT_URL: https://git.roncarve.com/
+      GITEA__server__PROTOCOL: http
+      GITEA__server__HTTP_PORT: "3000"
+      GITEA__server__SSH_PORT: "2222"
+      GITEA__database__DB_TYPE: mysql
+      GITEA__database__HOST: mariadb:3306
+      GITEA__database__NAME: gitea
+      GITEA__database__USER: gitea
+      GITEA__database__PASSWD: ${MARIADB_PASSWORD}
+      GITEA__mailer__PROTOCOL: smtps
+    ports:
+      - "2222:22"
+    volumes:
+      - /opt/gitea:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    networks:
+      gateway:
+        aliases:
+          - gitea
+
+  mariadb:
+    image: mariadb:11.4
+    container_name: gitea-mariadb
+    restart: unless-stopped
+    env_file:
+      - .env
+    environment:
+      MARIADB_ROOT_PASSWORD: ${MARIADB_ROOT_PASSWORD}
+      MARIADB_DATABASE: gitea
+      MARIADB_USER: gitea
+      MARIADB_PASSWORD: ${MARIADB_PASSWORD}
+    volumes:
+      - /opt/gitea/mariadb:/var/lib/mysql
+    healthcheck:
+      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
+      interval: 10s
+      timeout: 5s
+      retries: 12
+    networks:
+      gateway:
+        aliases:
+          - mariadb
+
+networks:
+  gateway:
+    external: true
+    name: gateway_gateway