diff --git a/servers/bwh-hk-cmi/gitea/README.md b/servers/bwh-hk-cmi/gitea/README.md
new file mode 100644
index 0000000..6b151f3
--- /dev/null
+++ b/servers/bwh-hk-cmi/gitea/README.md
@@ -0,0 +1,17 @@
+# HK Gitea
+
+Gitea target on the `bwh-hk-cmi` Arcane Environment.
+
+- Web: `https://gitea.kais.cloud`
+- Git SSH: `ssh://git@gitea.kais.cloud:222/<owner>/<repo>.git`
+- Persistent data: `/opt/stacks/gitea/data`
+- Shared reverse-proxy network: external Docker network `hk-web`
+- Reverse proxy: Caddy in the existing `web-managed` project
+
+The initial target deliberately uses Gitea `1.25.1`, matching the source on
+Arcane Local Docker. Keep the source online and do not initialize unrelated
+production data before the planned dump/restore cutover.
+
+The Gitea data directory is not stored in Git. Back it up before upgrades and
+before every migration attempt. Repository credentials, session secrets, and
+the migrated `app.ini` remain only under `/opt/stacks/gitea/data`.
diff --git a/servers/bwh-hk-cmi/gitea/compose.yaml b/servers/bwh-hk-cmi/gitea/compose.yaml
new file mode 100644
index 0000000..f0b041a
--- /dev/null
+++ b/servers/bwh-hk-cmi/gitea/compose.yaml
@@ -0,0 +1,38 @@
+services:
+  gitea:
+    image: docker.gitea.com/gitea:1.25.1@sha256:7dff60d7ea6df9d0bdf78971cdb1350e9b7df3fda5f115c77afe12122887bd64
+    container_name: gitea-hk
+    restart: unless-stopped
+    environment:
+      USER_UID: "1000"
+      USER_GID: "1000"
+      GITEA__server__DOMAIN: gitea.kais.cloud
+      GITEA__server__ROOT_URL: https://gitea.kais.cloud/
+      GITEA__server__SSH_DOMAIN: gitea.kais.cloud
+      GITEA__server__SSH_PORT: "222"
+      GITEA__server__SSH_LISTEN_PORT: "22"
+      GITEA__server__LFS_START_SERVER: "true"
+    ports:
+      - "222:22"
+    volumes:
+      - /opt/stacks/gitea/data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    networks:
+      - hk-web
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/api/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 60s
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: "3"
+
+networks:
+  hk-web:
+    external: true
+    name: hk-web
diff --git a/servers/bwh-hk-cmi/web/Caddyfile b/servers/bwh-hk-cmi/web/Caddyfile
index 2b5b27e..adce292 100644
--- a/servers/bwh-hk-cmi/web/Caddyfile
+++ b/servers/bwh-hk-cmi/web/Caddyfile
@@ -24,3 +24,7 @@ share.kais.cloud {
 api.opfo.xyz {
     reverse_proxy 100.100.130.66:1049
 }
+
+gitea.kais.cloud {
+    reverse_proxy gitea-hk:3000
+}
diff --git a/servers/bwh-hk-cmi/web/README.md b/servers/bwh-hk-cmi/web/README.md
index 45d69c4..d567189 100644
--- a/servers/bwh-hk-cmi/web/README.md
+++ b/servers/bwh-hk-cmi/web/README.md
@@ -4,5 +4,6 @@
 - 复用旧项目 `/opt/stacks/web` 下的持久化数据。
 - Secret 仅存 Arcane `.env`：`WEBDAV_PASSWORD`。
 - HAProxy 使用 SNI passthrough 接管 TCP 443：`cmi-tls-a7f29c.opfo.xyz` 转发至 AnyTLS，`conn.opfo.xyz` 转发至 Trojan，其余连接转发至 Caddy。
-- Caddy HTTPS 仅发布在宿主机 `127.0.0.1:8443`，并关闭 HTTP/3，将 UDP 443 留给 Hysteria2。
+- Caddy HTTPS 只在 Docker 网络内由 HAProxy 转发，宿主机另发布 HTTP 80；HTTP/3 已关闭，将 UDP 443 留给 Hysteria2。
+- `gitea.kais.cloud` 由 Caddy 转发到共享外部网络 `hk-web` 上的 `gitea-hk:3000`；Gitea 本体属于独立 Git Sync 项目。
 - `metacubexd` 与 `metube` 不迁移。
diff --git a/servers/bwh-hk-cmi/web/compose.yaml b/servers/bwh-hk-cmi/web/compose.yaml
index 5683634..9f36a8a 100644
--- a/servers/bwh-hk-cmi/web/compose.yaml
+++ b/servers/bwh-hk-cmi/web/compose.yaml
@@ -28,6 +28,9 @@ services:
       - /opt/stacks/web/caddy/site:/srv
       - /opt/stacks/web/caddy/data:/data
       - /opt/stacks/web/caddy/config:/config
+    networks:
+      - default
+      - hk-web
 
   filebrowser:
     image: filebrowser/filebrowser:s6
@@ -49,3 +52,8 @@ services:
       PASSWORD: ${WEBDAV_PASSWORD}
     volumes:
       - /opt/stacks/web/dav:/media
+
+networks:
+  hk-web:
+    external: true
+    name: hk-web