fix: Make it push pushable

.gitignore

@@ -6,3 +6,5 @@ caddy/data/
 caddy/config/
 
 filebrowser/
+
+.claude/

caddy/Caddyfile

@@ -73,10 +73,25 @@ uptime.sauravdhakal.com.np {
     reverse_proxy localhost:3001
 }
 
-# Gitea — VPN only, it's your private git server
+# -----------------------------------------------
+# Gitea — PUBLIC WEB UI
+# Gitea's built-in auth handles write restrictions
+# -----------------------------------------------
+
 gitea.sauravdhakal.com.np {
-    bind 100.81.85.182
+    # Allow public access (no bind = all interfaces)
-    reverse_proxy localhost:3000
+
+    # Security headers
+    header {
+        X-Content-Type-Options nosniff
+        X-Frame-Options DENY
+        Referrer-Policy strict-origin-when-cross-origin
+    }
+
+    reverse_proxy localhost:3000 {
+        header_up X-Real-IP {remote_host}
+        header_up X-Forwarded-For {remote_host}
+    }
 }
 
 # Woodpecker CI — VPN only
@@ -108,6 +123,11 @@ dozzle.sauravdhakal.com.np {
     bind 100.81.85.182
     reverse_proxy localhost:8888
 }
+
+docs.sauravdhakal.com.np {
+    bind 100.81.85.182
+    reverse_proxy localhost:3030
+}
 #
 # glances.sauravdhakal.com.np {
 #     bind 100.81.85.182

docker-compose.yml

@@ -12,6 +12,7 @@ include:
   - services/woodpecker.yml
   - services/gitea.yml
   - services/memos.yml
+  - services/docmost.yml
 
 networks:
   caddy_net:

services/docmost.yml

@@ -0,0 +1,44 @@
+services:
+  docmost:
+    image: docmost/docmost:latest
+    depends_on:
+      - docmost_db
+      - docmost_redis
+    environment:
+      - APP_URL=https://docs.sauravdhakal.com.np
+      - APP_SECRET=${DOCMOST_APP_SECRET}
+      - DATABASE_URL=postgresql://docmost:${DOCMOST_DB_PASSWORD}@docmost_db:5432/docmost
+      - REDIS_URL=redis://docmost_redis:6379
+    ports:
+      - "127.0.0.1:3030:3000"
+    restart: unless-stopped
+    volumes:
+      - /home/saurav/hetzner_self/data/docmost/storage:/app/data/storage
+    networks:
+      - docmost_internal
+
+
+  docmost_db:
+    image: postgres:18
+    environment:
+      - POSTGRES_DB=docmost
+      - POSTGRES_USER=docmost
+      - POSTGRES_PASSWORD=${DOCMOST_DB_PASSWORD}
+    restart: unless-stopped
+    volumes:
+      - /home/saurav/hetzner_self/data/docmost/db:/var/lib/postgresql
+    networks:
+      - docmost_internal
+
+  docmost_redis:
+    image: redis:8-alpine
+    command: ["redis-server", "--appendonly", "yes", "--maxmemory-policy", "noeviction"]
+    restart: unless-stopped
+    volumes:
+      - /home/saurav/hetzner_self/data/docmost/redis:/data
+    networks:
+      - docmost_internal
+
+networks:
+  docmost_internal:
+    driver: bridge

services/gitea.yml

@@ -14,6 +14,11 @@ services:
       - GITEA__server__ROOT_URL=https://gitea.sauravdhakal.com.np
       - GITEA__server__SSH_DOMAIN=gitea.sauravdhakal.com.np
       - GITEA__server__SSH_PORT=2222
-      - GITEA__service__DISABLE_REGISTRATION=true   # only you use this
+      # Allow public access but disable registration
+      - GITEA__service__DISABLE_REGISTRATION=true
+      # Require login to push (read is public)
+      - GITEA__repository__DISABLE_HTTP_GIT=false
+      - GITEA__security__INSTALL_LOCK=true
     volumes:
       - /home/saurav/hetzner_self/data/gitea:/data
+