From 68f402affdf2bdaf03292ebe187042e43ab1d28a Mon Sep 17 00:00:00 2001
From: "v.karaychentsev" <105486287+vk-aterise@users.noreply.github.com>
Date: Fri, 13 Feb 2026 13:18:58 +0300
Subject: [PATCH] gitea - use secret files. gitea env to ini supports __FILE
 postfix

---
 hosts/home-morefine/docker/gitea/.env         |  6 ++--
 .../docker/gitea/docker-compose.yaml          | 32 +++++++++++++++----
 .../docker/gitea/secrets.sops.yaml            | 27 ++++++++++++++++
 3 files changed, 55 insertions(+), 10 deletions(-)
 create mode 100644 hosts/home-morefine/docker/gitea/secrets.sops.yaml

diff --git a/hosts/home-morefine/docker/gitea/.env b/hosts/home-morefine/docker/gitea/.env
index 921b4d8..0de1b67 100644
--- a/hosts/home-morefine/docker/gitea/.env
+++ b/hosts/home-morefine/docker/gitea/.env
@@ -7,12 +7,12 @@ GITEA__DATABASE__DB_TYPE=postgres
 GITEA__DATABASE__HOST=db:5432
 GITEA__DATABASE__NAME=gitea
 GITEA__DATABASE__USER=gitea
-#GITEA__DATABASE__PASSWD=secrets.sops.env
+#GITEA__DATABASE__PASSWD=secrets.sops.yaml
 
 GITEA__MAILER__ENABLED=true
 GITEA__MAILER__FROM=gitea@catmedved.com
 GITEA__MAILER__PROTOCOL=smtp+starttls
 GITEA__MAILER__SMTP_PORT=587
 GITEA__MAILER__SMTP_ADDR=smtp.fastmail.com
-#GITEA__MAILER__USER=secrets.sops.env
-#GITEA__MAILER__PASSWD=secrets.sops.env
+#GITEA__MAILER__USER=secrets.sops.yaml
+#GITEA__MAILER__PASSWD=secrets.sops.yaml
diff --git a/hosts/home-morefine/docker/gitea/docker-compose.yaml b/hosts/home-morefine/docker/gitea/docker-compose.yaml
index 9e3718a..8dcc84f 100644
--- a/hosts/home-morefine/docker/gitea/docker-compose.yaml
+++ b/hosts/home-morefine/docker/gitea/docker-compose.yaml
@@ -4,6 +4,10 @@
     container_name: gitea
     env_file:
       - .env
+    environment:
+      GITEA__DATABASE__PASSWD__FILE: /run/secrets/GITEA__DATABASE__PASSWD
+      GITEA__MAILER__USER__FILE: /run/secrets/GITEA__MAILER__USER
+      GITEA__MAILER__PASSWD__FILE: /run/secrets/GITEA__MAILER__PASSWD
     restart: unless-stopped
     networks:
       - caddy_internal
@@ -15,25 +19,31 @@
       - /etc/timezone:/etc/timezone:ro
       - /etc/localtime:/etc/localtime:ro
     ports:
-      #- "3007:3000"
-      - "127.0.0.1:2222:22" # SSHing Shim (with authorized_keys)
+      # SSHing Shim (with authorized_keys)
+      - "127.0.0.1:2222:22"
     depends_on:
       - gitea_db
+    secrets:
+      - GITEA__DATABASE__PASSWD
+      - GITEA__MAILER__USER
+      - GITEA__MAILER__PASSWD
 
   gitea_db:
     image: postgres:14
     container_name: gitea_pg_db
     restart: unless-stopped
     environment:
-      - USER_UID=${USER_UID}
-      - USER_GID=${USER_GID}
-      - POSTGRES_USER=${GITEA__DATABASE__USER}
-      - POSTGRES_PASSWORD=${GITEA__DATABASE__PASSWD}
-      - POSTGRES_DB=${GITEA__DATABASE__NAME}
+      USER_UID: ${USER_UID}
+      USER_GID: ${USER_GID}
+      POSTGRES_USER: ${GITEA__DATABASE__USER}
+      POSTGRES_DB: ${GITEA__DATABASE__NAME}
+      POSTGRES_PASSWORD_FILE: /run/secrets/GITEA__DATABASE__PASSWD
     networks:
       - gitea_db_net
     volumes:
       - /srv/rundata/gitea/postgres:/var/lib/postgresql/data
+    secrets:
+       - GITEA__DATABASE__PASSWD
 
 networks:
   caddy_internal:
@@ -41,3 +51,11 @@ networks:
     external: true
   gitea_db_net:
     internal: true
+
+secrets:
+  GITEA__DATABASE__PASSWD:
+    file: /run/secrets/gitea/GITEA__DATABASE__PASSWD
+  GITEA__MAILER__USER:
+    file: /run/secrets/gitea/GITEA__MAILER__USER
+  GITEA__MAILER__PASSWD:
+    file: /run/secrets/gitea/GITEA__MAILER__PASSWD
diff --git a/hosts/home-morefine/docker/gitea/secrets.sops.yaml b/hosts/home-morefine/docker/gitea/secrets.sops.yaml
new file mode 100644
index 0000000..a1a3b0f
--- /dev/null
+++ b/hosts/home-morefine/docker/gitea/secrets.sops.yaml
@@ -0,0 +1,27 @@
+GITEA__DATABASE__PASSWD: ENC[AES256_GCM,data:oz74ifdKLHoMwVPi,iv:FO4sQtxeZnS6rLdKNiYV7BQzD/CYxS0cFLOY6XlMN1o=,tag:RQWrFLeRGNLgIPOwqdQn3Q==,type:str]
+GITEA__MAILER__USER: ENC[AES256_GCM,data:ncQqsxcGSa6IOgZQrF6DJWbC,iv:DUbefGGFVTauVnsHCEeYudC+remQ7KKj0VPlta5falo=,tag:hVil4jjuTujXs4Ni4GiP5g==,type:str]
+GITEA__MAILER__PASSWD: ENC[AES256_GCM,data:mPTwvEpuiOZS5s18KNykWA==,iv:vU7ixAiFZ0R4JxIPcvKUXG6xFUxXrCfQu5nXUUP592E=,tag:KwKlT+wfghUnraVT4f90Lg==,type:str]
+sops:
+    age:
+        - recipient: age1ua9qahphsqf2x8ew2n4umapp23a66t0eccccc0d5etp82n8tsqgsfc8qjk
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsa2xqVkU5TDg5anZnK3lG
+            S2JOamZkVmpxQjI1SW9rMm5scVNSM0lsNUNJCjViU3ZlcWI0dnBUUUd5NjRhQUtz
+            TUNoTTRYZy9yZmdCdzg3M0pGci96NlUKLS0tIGM3RjlmZXI0YmhsYTdQMDNwNkpy
+            cXYrbWFhQUlWUDg4SWl1R0R1VGFtTW8K/lOkbAEAzA7aGkMj+9v3Vny1SMleyfl2
+            M1BRsK3M6LA4o3nEjvf0z69pmUvElWe0yzlGJg5QKHucxnfn4ke80g==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1nw388umnlxfj3cg9lqjyltghfx6w709nam8s2x826c3nxla9famq3uya73
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6WWhCZy9KYy85Tlk0WVVp
+            TWV1ZHVkUTcwNGpNK3FkbnowRFQ4MFFTeHlrCnU0RXZkZEkrZ25tY2dLbDMvdXNU
+            NW5zSTl4eXBkNC9KUS82c2k0bDBtZTQKLS0tIDdIcXROVElWNjhmU3U5NHVQWjha
+            cjVDblpqVUtBYUQwR3RCVzdLSmgrMU0KELylj3gznnKe6vHrnBCl/EqLt2l0ekKC
+            PAEF0LsOhhbJWmjmjU8T3K73Bp25HMp6Pv/Yvt6VLwUqvzuZYxWyYg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-02-13T09:40:36Z"
+    mac: ENC[AES256_GCM,data:JrHRcLxlCBnzFr3QdfBpv3sEGqSgT8CSMIUyUSQAmH/XT1fqYL8gQMpjjjSvKFfDUNDDdG/3hRzo1d0QbflxXRWbuRwdeBgfNnjMr+gA7abQDcZkfloWu2mjXWvhKLfB/8pj9pvQtsXjL8FmHT3f8Tqwhu7kGY+JyF0a+drXckc=,iv:YOgI17N2FfTtW+Qvnq6M/EqTTBbFRu9oKdOH/r3SSNk=,tag:J1k+p/guQLAYctafaxDKUQ==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.11.0