diff --git a/caddy/Caddyfile b/caddy/Caddyfile
index d4f9b0e..b45b6bf 100644
--- a/caddy/Caddyfile
+++ b/caddy/Caddyfile
@@ -73,6 +73,29 @@ uptime.sauravdhakal.com.np {
     reverse_proxy localhost:3001
 }
 
+# Gitea — VPN only, it's your private git server
+gitea.sauravdhakal.com.np {
+    bind 100.81.85.182
+    reverse_proxy localhost:3000
+}
+
+# Woodpecker CI — VPN only
+ci.sauravdhakal.com.np {
+    bind 100.81.85.182
+    reverse_proxy localhost:8000
+}
+
+# Your site — public, with caching
+# sauravdhakal.com.np {
+#     root * /home/saurav/site/public
+#
+#     # This is where you learn caching
+#     header Cache-Control "public, max-age=3600"        # cache 1 hour by default
+#     header /static/* Cache-Control "public, max-age=31536000, immutable"  # assets forever
+#
+#     file_server
+#     encode gzip
+# }
 # dozzle.sauravdhakal.com.np {
 #     bind 100.81.85.182
 #     reverse_proxy localhost:8888
diff --git a/services/gitea.yml b/services/gitea.yml
new file mode 100644
index 0000000..a8b5162
--- /dev/null
+++ b/services/gitea.yml
@@ -0,0 +1,20 @@
+services:
+  gitea:
+    image: gitea/gitea:latest
+    restart: unless-stopped
+    user: "1000:1000"
+    ports:
+      - "127.0.0.1:3000:3000"
+      - "2222:22"               # git ssh — different port to avoid conflict
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - GITEA__database__DB_TYPE=sqlite3
+      - GITEA__database__PATH=/data/gitea/gitea.db
+      - GITEA__server__DOMAIN=gitea.sauravdhakal.com.np
+      - GITEA__server__ROOT_URL=https://gitea.sauravdhakal.com.np
+      - GITEA__server__SSH_DOMAIN=gitea.sauravdhakal.com.np
+      - GITEA__server__SSH_PORT=2222
+      - GITEA__service__DISABLE_REGISTRATION=true   # only you use this
+    volumes:
+      - /home/saurav/hetzner_self/data/gitea:/data
diff --git a/services/woodpecker.yml b/services/woodpecker.yml
new file mode 100644
index 0000000..4558d10
--- /dev/null
+++ b/services/woodpecker.yml
@@ -0,0 +1,25 @@
+services:
+  woodpecker-server:
+    image: woodpeckerci/woodpecker-server:latest
+    restart: unless-stopped
+    ports:
+      - "127.0.0.1:8000:8000"
+    environment:
+      - WOODPECKER_OPEN=false
+      - WOODPECKER_GITEA=true
+      - WOODPECKER_GITEA_URL=https://gitea.sauravdhakal.com.np
+      - WOODPECKER_GITEA_CLIENT=${WOODPECKER_GITEA_CLIENT}
+      - WOODPECKER_GITEA_SECRET=${WOODPECKER_GITEA_SECRET}
+      - WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}
+      - WOODPECKER_HOST=https://ci.sauravdhakal.com.np
+    volumes:
+      - /home/saurav/hetzner_self/data/woodpecker:/var/lib/woodpecker
+
+  woodpecker-agent:
+    image: woodpeckerci/woodpecker-agent:latest
+    restart: unless-stopped
+    environment:
+      - WOODPECKER_SERVER=woodpecker-server:9000
+      - WOODPECKER_AGENT_SECRET=${WOODPECKER_AGENT_SECRET}
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock    # agent runs hugo in docker