Make HopWeb deployment settings configurable for production reverse proxies

Hop-State: A_06FN53JE9D7CAMGNCD3YMB8 Hop-Proposal: R_06FN53H8KYJKYP7K5TMCPT8 Hop-Task: T_06FN50V05VH5V9WE9QQF9KR Hop-Attempt: AT_06FN50V05RGZYCX0EKTK6Q0
2026-07-11 12:01:25 -07:00
parent 1e01cd2882
commit e31008c066
3 changed files with 51 additions and 8 deletions
@@ -0,0 +1,30 @@
+# Production deployment
+
+Run the Compose stack behind an HTTPS reverse proxy. Keep the Gitea HTTP port
+and Hop control-plane port bound to loopback; only publish Gitea's SSH port if
+the deployment has a DNS-only hostname that can reach it without an HTTP
+proxy.
+
+Start from `.env.example`, replace every secret, and set at least:
+
+```dotenv
+GITEA_DOMAIN=git.example.com
+GITEA_ROOT_URL=https://git.example.com/
+GITEA_HTTP_BIND=127.0.0.1
+HOP_HTTP_BIND=127.0.0.1
+GITEA_SSH_BIND=127.0.0.1
+GITEA_DISABLE_SSH=true
+GITEA_DISABLE_REGISTRATION=true
+```
+
+Start the services and install the Hop-native Gitea assets:
+
+```sh
+docker compose --env-file .env up --build -d
+./deploy/gitea/install-hop-native.sh
+```
+
+The reverse proxy should forward the public hostname to the configured
+`GITEA_HTTP_BIND:GITEA_HTTP_PORT`, preserve the `Host` header, and set
+`X-Forwarded-Proto` to `https`. Persistent repository and database data live in
+the named Compose volumes.