networks:
  nginx-bridge:
    external: true
services:
  gitea:
    image: docker.io/gitea/gitea:latest
    container_name: gitea
    hostname: gitea
    domainname: git.gbrown.org
    networks:
    - nginx-bridge
    ports:
    - '2222:22'
    environment:
    - TZ=America/New_York
    - USER_UID=1001
    - USER_GID=1003
    # ── Mailer ────────────────────────────────────────────────────────────────
    # The image's entrypoint runs `environment-to-ini`, so GITEA__section__KEY
    # vars are written into /data/gitea/conf/app.ini on every start. This block
    # is therefore the source of truth -- hand-editing app.ini gets overwritten
    # on the next restart. It also means PASSWD lands in app.ini in plaintext
    # inside the volume; that is how Gitea works, not a misconfiguration.
    #
    # PROTOCOL=smtp+starttls matches port 587. The relay refuses AUTH until
    # STARTTLS succeeds, so plain `smtp` would fail with 538.
    - GITEA__mailer__ENABLED=true
    - GITEA__mailer__PROTOCOL=smtp+starttls
    - GITEA__mailer__SMTP_ADDR=smtp.usesend.gbrown.org
    - GITEA__mailer__SMTP_PORT=587
    - GITEA__mailer__USER=usesend
    - GITEA__mailer__PASSWD=${USESEND_API_KEY:?set USESEND_API_KEY in Gitea/.env}
    - GITEA__mailer__FROM=Gitea <git@git.gbrown.org>
    labels:
      com.centurylinklabs.watchtower.enable: 'true'
    volumes:
    - ./volume:/data:Z
    - /home/gib/Media/gitea-packages:/data/gitea/packages:Z
    - ./ssh:/data/git/.ssh:Z
    tty: true
    restart: unless-stopped