first commit

deploy/gitea/.env.example

@@ -0,0 +1,7 @@
+GITEA_DB_PASSWORD=CHANGE_ME_LONG_RANDOM
+GITEA_DOMAIN=127.0.0.1
+GITEA_ROOT_URL=http://127.0.0.1:3200/
+
+# After Nginx + domain:
+# GITEA_DOMAIN=git.nexpa-ai.com
+# GITEA_ROOT_URL=https://git.nexpa-ai.com/

deploy/gitea/docker-compose.yml

@@ -0,0 +1,67 @@
+# NEXPA Gitea — host ports chosen to avoid this Ubuntu server's existing listeners.
+#
+# Already in use (do not reuse):
+#   22 SSH | 80/443 Nginx | 3000 Node | 3010 | 3306 MySQL | 4180 Node
+#   5437 | 8000 existing SourceHub(python3) | 33060
+#
+# This stack publishes only:
+#   127.0.0.1:3200  → Gitea web   (container 3000)
+#   0.0.0.0:2222    → Gitea SSH   (container 22)
+# Postgres stays on the Docker network only (not host 5432/5437).
+#
+# First-time wizard: ssh -L 3200:127.0.0.1:3200 ubuntu@SERVER
+# then open http://127.0.0.1:3200
+# Or add deploy/nginx-gitea.conf and use https://git.YOUR_DOMAIN
+#
+# Change CHANGE_ME_* before the first start.
+
+networks:
+  gitea:
+
+volumes:
+  gitea-data:
+  gitea-postgres:
+
+services:
+  db:
+    image: postgres:16-alpine
+    container_name: gitea-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_USER: gitea
+      POSTGRES_PASSWORD: ${GITEA_DB_PASSWORD:?set GITEA_DB_PASSWORD in .env}
+      POSTGRES_DB: gitea
+    networks:
+      - gitea
+    volumes:
+      - gitea-postgres:/var/lib/postgresql/data
+
+  server:
+    image: docker.gitea.com/gitea:1.27.3
+    container_name: gitea
+    restart: unless-stopped
+    depends_on:
+      - db
+    environment:
+      USER_UID: "1000"
+      USER_GID: "1000"
+      GITEA__database__DB_TYPE: postgres
+      GITEA__database__HOST: db:5432
+      GITEA__database__NAME: gitea
+      GITEA__database__USER: gitea
+      GITEA__database__PASSWD: ${GITEA_DB_PASSWORD:?set GITEA_DB_PASSWORD in .env}
+      GITEA__server__DOMAIN: ${GITEA_DOMAIN:-127.0.0.1}
+      GITEA__server__ROOT_URL: ${GITEA_ROOT_URL:-http://127.0.0.1:3200/}
+      GITEA__server__HTTP_PORT: "3000"
+      GITEA__server__SSH_DOMAIN: ${GITEA_DOMAIN:-127.0.0.1}
+      GITEA__server__SSH_PORT: "2222"
+      GITEA__server__SSH_LISTEN_PORT: "22"
+    networks:
+      - gitea
+    volumes:
+      - gitea-data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "127.0.0.1:3200:3000"
+      - "2222:22"

deploy/nginx-gitea.conf

@@ -0,0 +1,27 @@
+# Optional. Existing Nginx already owns 80/443 — add a server_name, do not change listen ports.
+# Copy to /etc/nginx/sites-available/ and enable after certificates exist.
+
+server {
+    listen 80;
+    server_name git.nexpa-ai.com;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name git.nexpa-ai.com;
+
+    ssl_certificate     /etc/letsencrypt/live/git.nexpa-ai.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/git.nexpa-ai.com/privkey.pem;
+
+    client_max_body_size 500m;
+
+    location / {
+        proxy_pass http://127.0.0.1:3200;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 300s;
+    }
+}

deploy/nginx-sourcehub.conf

@@ -0,0 +1,26 @@
+server {
+    listen 80;
+    server_name sourcehub.nexpa-ai.com;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name sourcehub.nexpa-ai.com;
+
+    # 운영 서버의 실제 인증서 경로로 변경
+    ssl_certificate     /etc/letsencrypt/live/sourcehub.nexpa-ai.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/sourcehub.nexpa-ai.com/privkey.pem;
+
+    client_max_body_size 500m;
+
+    location / {
+        # 3.8 listens on 18000 so it can run beside the current 8000 process.
+        proxy_pass http://127.0.0.1:18000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Forwarded-Proto https;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 300s;
+    }
+}