Now that CONFIG_FILE is actually loaded by the daemon (see previous
commit), retest with the embedded cache server and default settings
instead of the dedicated cache-server/host.docker.internal workaround -
that whole setup was built to route around a config file that was
silently never being read in the first place.
The renamed gitea/runner project (v1.0.0+) is a straight rename of
act_runner with the binary renamed to gitea-runner. While inspecting
its run.sh, found the actual root cause of the cache config being
ignored all along: run.sh builds --config from the CONFIG_FILE env
var, not from any command: override - it always execs the binary
itself regardless of passed args. The runner service never set
CONFIG_FILE, so runner-config.yaml was never actually loaded by the
daemon despite being correctly mounted.
The cache-server subcommand only checks the literal external_secret
field at startup and errors out if just external_secret_file is set
(unlike the daemon, which handles _file fine). Move its config out of
git entirely - it now has to hold the actual secret value - generated
straight into .data on the VPS instead.
run.sh (act_runner's default image entrypoint) ignores any command args
entirely - it always registers then execs `act_runner daemon`
regardless, with no cache-server mode. The cache-server container was
silently running as a second runner daemon instead. Override the
entrypoint directly to tini + act_runner, skipping run.sh.
.ui.negative.message .header only tinted the header; the message body and
the warning/success/info variants had no color rule at all across every
Catppuccin theme.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Dark Frappé base (#303446) background with the pivoine.art peony
centered and padded. Replaces logo.svg/png, favicon.svg/png, and
apple-touch-icon.png.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Port 0 disabled the web UI but broke the built-in /readyz healthcheck.
Binding to 8025 keeps the UI accessible within the Docker network only
(no Traefik labels) and lets the container report healthy.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
IONOS rejects relay from VPS IPs when sender doesn't match authenticated
account. Switch gitea and passbolt FROM to the actual IONOS account address.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Docker binds to both [::]:22 and 0.0.0.0:22 without an explicit IP,
conflicting with sshd on [::]:22.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
74.7.243.196 was crawling valknar/home SVG icon tree at 1.8 req/s.
- Denylist the IP in fail2ban dynamic config
- Add rate-limit@file middleware to Gitea's Traefik router to throttle
future scrapers on public repos
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Mount templates/custom/ directly to Gitea's default GITEA_CUSTOM templates
path. No entrypoint override or envsubst needed.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Injects the Umami tracking script into every Gitea page using a custom
header.tmpl generated at startup via envsubst. Script URL and website ID
are externalized to UMAMI_SCRIPT_URL / UMAMI_WEBSITE_ID env vars.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Removes the watchtower container in favour of a host-side script that
runs daily at 2:00 AM via systemd timer. Mirrors the _backup pattern:
auto-discovers stacks, pulls images, recreates changed containers,
prunes dangling images, and notifies via n8n → Telegram.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Migrated 11 services from monolithic docker-compose project into independent stacks,
each with dedicated databases, minimal .env configuration, and bind-mount data volumes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
valknar
