mkdir -p gitea/{data,config}

cd gitea \
   && sudo chown 1000:1000 config/ data/

services:
  server:
    image: docker.gitea.com/gitea:1.25.2-rootless
    container_name: gitea
    restart: unless-stopped
    user: "1000"
    volumes:
      - ./data:/var/lib/gitea
      - ./config:/etc/gitea
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "127.0.0.1:33033:3000" # Gitea web & git with https
      - "127.0.0.1:11211:2222" # git with ssh

sudo docker compose up -d

server {
    listen 80;
    listen [::]:80;
    # git.your.domain
    server_name git.via.moe;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    http2 on;
    # git.your.domain
    server_name git.via.moe;

    # your TLS/SSL cert
    ssl_certificate /path/to/your/sslcert.pem;
    ssl_certificate_key /path/to/your/sslcert.key;
    
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ecdh_curve X25519:P-256:P-384;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CHACHA20-POLY1305:ECDHE+AES128:RSA+AES128:ECDHE+AES256:RSA+AES256';
    
    # for cloudflare cdn
    ssl_prefer_server_ciphers off;
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    
    # log
    access_log /var/log/nginx/gitea.access.log;
    error_log /var/log/nginx/gitea.error.log;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header Referrer-Policy "no-referrer-when-downgrade" always;
    add_header Content-Security-Policy "default-src 'self' http: https: data: blob: 'unsafe-inline'" always;

    location / {
        client_max_body_size 512M;
        proxy_pass http://127.0.0.1:33033;
        proxy_set_header Host $http_host;
        proxy_set_header X-Real-IP $realip_remote_addr;
        proxy_set_header X-Forwarded-For $realip_remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Connection $http_connection;
        proxy_set_header Upgrade $http_upgrade;
    }
}

# Add cloudflare gpg key
sudo mkdir -p --mode=0755 /usr/share/keyrings
curl -fsSL https://pkg.cloudflare.com/cloudflare-main.gpg | sudo tee /usr/share/keyrings/cloudflare-main.gpg >/dev/null

# Add this repo to your apt repositories
# Stable
echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list
# Nightly
echo 'deb [signed-by=/usr/share/keyrings/cloudflare-main.gpg] https://next.pkg.cloudflare.com/cloudflared any main' | sudo tee /etc/apt/sources.list.d/cloudflared.list

# install cloudflared
sudo apt-get update && sudo apt-get install cloudflared

# Windows
scoop install cloudflared

# macOS
brew install cloudflared

which cloudflared
# Windows
D:\Scoop\shims\cloudflared.exe

# 替换为实际的 SSH 域名
Host ssh.via.moe
  ProxyCommand D:\Scoop\shims\cloudflared.exe access ssh --hostname %h # 替换为具体的 cloudflared 路径

ssh -T [email protected]
The authenticity of host 'ssh.via.moe (<no hostip for proxy command>)' can't be established.
RSA key fingerprint is SHA256:h4/WtxI78LY5gT9N1akvOBAEvI1Oq8EEpENC9hTtB7g.
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'ssh.via.moe' (RSA) to the list of known hosts.
Hi there, Dejavu Moe! You've successfully authenticated with the key named Yubikey, but Gitea does not provide shell access.
If this is unexpected, please log in with password and setup Gitea under another user.