first

.gitignore

@@ -0,0 +1,55 @@
+./data
+./git
+
+# -------------------------
+# SSH private keys
+# -------------------------
+id_*
+*.pem
+*.key
+*.private
+
+# -------------------------
+# SSH runtime files
+# -------------------------
+authorized_keys
+known_hosts
+known_hosts.old
+
+# -------------------------
+# Agent / sockets
+# -------------------------
+ssh-agent*
+*.sock
+
+# -------------------------
+# Backup / temp
+# -------------------------
+*.bak
+*.tmp
+*.swp
+*~
+
+# -------------------------
+# Logs
+# -------------------------
+*.log
+
+# -------------------------
+# OS files
+# -------------------------
+.DS_Store
+Thumbs.db
+
+# -------------------------
+# Editors
+# -------------------------
+.vscode/
+.idea/
+
+# -------------------------
+# Git safety
+# -------------------------
+.env
+*.env
+*.secret

Caddyfile

@@ -0,0 +1,15 @@
+{
+	email {$ACME_EMAIL}
+}
+
+git.tvheggland.no {
+	rate_limit {
+		zone git_zone {
+			key {remote_host}
+			events 30
+			window 10s
+		}
+	}
+
+	reverse_proxy gitea:3000
+}

Dockerfile

@@ -0,0 +1,10 @@
+FROM caddy:2-builder AS builder
+
+RUN --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=cache,target=/root/.cache/go-build \
+    xcaddy build \
+    --with github.com/mholt/caddy-ratelimit
+
+FROM caddy:2
+
+COPY --from=builder /usr/bin/caddy /usr/bin/caddy

docker-compose.yaml

@@ -0,0 +1,26 @@
+services:
+  caddy:
+    build: .
+    container_name: caddy
+    restart: unless-stopped
+    ports:
+      - "80:80"
+      - "443:443"
+    env_file:
+      - .env
+    volumes:
+      - ./Caddyfile:/etc/caddy/Caddyfile:ro
+      - caddy_data:/data
+      - caddy_config:/config
+    networks:
+      - caddy_net
+
+networks:
+  caddy_net:
+    external: true
+
+volumes:
+  caddy_data:
+    name: docker_caddy_data
+  caddy_config:
+    name: docker_caddy_config