feat: deploy Gitea on HK node

servers/bwh-hk-cmi/gitea/README.md

@@ -0,0 +1,17 @@
+# HK Gitea
+
+Gitea target on the `bwh-hk-cmi` Arcane Environment.
+
+- Web: `https://gitea.kais.cloud`
+- Git SSH: `ssh://git@gitea.kais.cloud:222/<owner>/<repo>.git`
+- Persistent data: `/opt/stacks/gitea/data`
+- Shared reverse-proxy network: external Docker network `hk-web`
+- Reverse proxy: Caddy in the existing `web-managed` project
+
+The initial target deliberately uses Gitea `1.25.1`, matching the source on
+Arcane Local Docker. Keep the source online and do not initialize unrelated
+production data before the planned dump/restore cutover.
+
+The Gitea data directory is not stored in Git. Back it up before upgrades and
+before every migration attempt. Repository credentials, session secrets, and
+the migrated `app.ini` remain only under `/opt/stacks/gitea/data`.

servers/bwh-hk-cmi/gitea/compose.yaml

@@ -0,0 +1,38 @@
+services:
+  gitea:
+    image: docker.gitea.com/gitea:1.25.1@sha256:7dff60d7ea6df9d0bdf78971cdb1350e9b7df3fda5f115c77afe12122887bd64
+    container_name: gitea-hk
+    restart: unless-stopped
+    environment:
+      USER_UID: "1000"
+      USER_GID: "1000"
+      GITEA__server__DOMAIN: gitea.kais.cloud
+      GITEA__server__ROOT_URL: https://gitea.kais.cloud/
+      GITEA__server__SSH_DOMAIN: gitea.kais.cloud
+      GITEA__server__SSH_PORT: "222"
+      GITEA__server__SSH_LISTEN_PORT: "22"
+      GITEA__server__LFS_START_SERVER: "true"
+    ports:
+      - "222:22"
+    volumes:
+      - /opt/stacks/gitea/data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    networks:
+      - hk-web
+    healthcheck:
+      test: ["CMD", "wget", "-q", "--spider", "http://127.0.0.1:3000/api/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 5
+      start_period: 60s
+    logging:
+      driver: json-file
+      options:
+        max-size: 10m
+        max-file: "3"
+
+networks:
+  hk-web:
+    external: true
+    name: hk-web