feat(deploy): add canonical Gitea recovery flows

infra/deploy-runner/fixtures/gitea-salvage/deployment/gitea-incident-salvage-v1.json

@@ -0,0 +1,112 @@
+{
+  "schemaVersion": "nodedc.gitea.incident-salvage.v1",
+  "action": "clean-state-salvage",
+  "component": "gitea",
+  "incidentId": "gitea-20260814",
+  "installRoot": "/volume1/docker/nodedc-gitea",
+  "compose": {
+    "file": "docker-compose.gitea.yml",
+    "project": "nodedc-gitea",
+    "service": "gitea",
+    "sha256": "2f031d5bfff4f42c73cabd8c94487ec3e4f1e1b0a96d3b7eec958904f735908a"
+  },
+  "runtime": {
+    "image": "docker.gitea.com/gitea:1.27.2-rootless@sha256:7de5f49ada687b8c8d2938f547cdb7634839764ba51f297457bae35cee3abd2c",
+    "imageId": "sha256:272085a806e6d182352cdb011c0ebab1d2efc7ec45247de84de5659c7bc5c4c6",
+    "repoDigest": "docker.gitea.com/gitea@sha256:7de5f49ada687b8c8d2938f547cdb7634839764ba51f297457bae35cee3abd2c",
+    "platform": "linux/amd64",
+    "pullPolicy": "never",
+    "entrypoint": "/usr/local/bin/gitea",
+    "runAs": "1000:1000",
+    "transport": "unix:/run/gitea/gitea.sock",
+    "networkMode": "none",
+    "ssh": "disabled-no-published-port",
+    "lfs": "unsupported-hard-stop",
+    "database": "new-sqlite-1.27.2-only",
+    "logging": "bounded-json-file-10m-x3",
+    "stopGracePeriod": "30s",
+    "candidateRestartPolicy": "no",
+    "acceptedRestartPolicy": "unless-stopped"
+  },
+  "decision": {
+    "schema": "nodedc.gitea.incident-decision/v2",
+    "manifestFile": "deployment/gitea-incident-salvage/confirmed-decision.json",
+    "manifestSha256": "dc9528462624158eb44218d37cc7054d551ca2d7ded562592982aa3f34c9fc2a",
+    "usersFile": "deployment/gitea-incident-salvage/users.decisions.csv",
+    "usersSha256": "e3b82f1073a86eea9e567edff062dd1689d21ec0edcf3ed92e844da9351ee8b6",
+    "repositoriesFile": "deployment/gitea-incident-salvage/repositories.decisions.csv",
+    "repositoriesSha256": "76b4bae2ab5cec490330c19bfc5ae9429abf7636705ae028c1c64fd54a6a0493",
+    "users": {
+      "active": 2,
+      "locked": 8,
+      "delete": 962
+    },
+    "repositories": {
+      "keep": 45,
+      "delete": 2013,
+      "dctouchPrivate": 32,
+      "silverPublic": 13
+    }
+  },
+  "snapshot": {
+    "root": "/volume1/.nodedc-security-snapshots/docker-gitea-incident-20260814",
+    "uuid": "f5a3fe3a-93ea-bb4d-847f-6221a6bcbc9f",
+    "readOnlyRequired": true,
+    "database": "gitea/gitea/gitea.db",
+    "databaseBytes": 182681600,
+    "databaseSha256": "8db9e74a5641662a808d8252c5d6c9de43fe9efd8687634bfbff2d4361a13052",
+    "repositoriesRoot": "gitea/git/repositories"
+  },
+  "trust": {
+    "legacyRootMounted": false,
+    "legacyDatabaseImported": false,
+    "legacyConfigImported": false,
+    "legacyCredentialsImported": false,
+    "artifactSecrets": "forbidden",
+    "runtimeSecrets": "runner-generated",
+    "repositorySelection": "exact-v2-rows-only",
+    "repositoryCopy": "same-filesystem-per-file-reflink-object-and-validated-ref-material-only",
+    "forbiddenRepositoryMaterial": [
+      "hooks",
+      "config",
+      "alternates",
+      "http-alternates",
+      "shallow",
+      "replace",
+      "grafts",
+      "worktrees",
+      "commondir",
+      "lfs"
+    ],
+    "unsupportedDatabaseState": "zero-material-rows-required-before-apply"
+  },
+  "identity": {
+    "preserveNumericUserIds": false,
+    "preserveNumericRepositoryIds": false,
+    "oldToNewIdMapping": "/volume1/docker/nodedc-gitea/audit/identity-map.json",
+    "emails": "new-local-noreply-only",
+    "passwordHashes": "never-imported",
+    "activeBootstrapCredentials": "root-only-runner-state-require-change",
+    "lockedCredentials": "fresh-random-discarded-and-login-prohibited",
+    "twoFactorAuthentication": "not-configured-by-transition"
+  },
+  "externalPrerequisites": {
+    "legacyContainer": "exact-inspect-pin-required-stopped-restart-no",
+    "publicProxy": "reviewed-nginx-uds-bridge-and-dsm-loopback-upstream",
+    "firewall": "legacy-isolation-retained-and-loopback-3000-ready",
+    "candidatePublicationGate": "socket-parent-uid1000-gid1023-mode0700",
+    "publishAction": "runner-chmod-socket-parent-0750-after-internal-acceptance",
+    "mustPassBeforeApply": true
+  },
+  "acceptance": {
+    "users": "exact-10-row-by-row",
+    "repositories": "exact-45-row-by-row-and-visibility",
+    "credentialsSessionsKeysWebhooksActions": "zero",
+    "git": "fsck-all-and-public-smart-http-smoke",
+    "registration": "closed",
+    "ssh": "disabled",
+    "network": "none-no-ports",
+    "publicHttps": "required-before-ledger-success"
+  },
+  "rollback": "stop-remove-candidate-prove-absent-quarantine-new-root-never-start-legacy"
+}

infra/deploy-runner/fixtures/gitea-salvage/deployment/gitea-incident-salvage-v2.json

@@ -0,0 +1,117 @@
+{
+  "schemaVersion": "nodedc.gitea.incident-salvage.v2",
+  "action": "clean-state-salvage",
+  "component": "gitea",
+  "incidentId": "gitea-20260814",
+  "installRoot": "/volume1/docker/nodedc-gitea",
+  "compose": {
+    "file": "docker-compose.gitea.yml",
+    "project": "nodedc-gitea",
+    "service": "gitea",
+    "sha256": "2f031d5bfff4f42c73cabd8c94487ec3e4f1e1b0a96d3b7eec958904f735908a"
+  },
+  "runtime": {
+    "image": "docker.gitea.com/gitea:1.27.2-rootless@sha256:7de5f49ada687b8c8d2938f547cdb7634839764ba51f297457bae35cee3abd2c",
+    "imageId": "sha256:272085a806e6d182352cdb011c0ebab1d2efc7ec45247de84de5659c7bc5c4c6",
+    "repoDigest": "docker.gitea.com/gitea@sha256:7de5f49ada687b8c8d2938f547cdb7634839764ba51f297457bae35cee3abd2c",
+    "platform": "linux/amd64",
+    "pullPolicy": "never",
+    "entrypoint": "/usr/local/bin/gitea",
+    "runAs": "1000:1000",
+    "transport": "unix:/run/gitea/gitea.sock",
+    "networkMode": "none",
+    "ssh": "disabled-no-published-port",
+    "lfs": "disabled-pending-reachable-pointer-physical-sha-verifier",
+    "database": "new-sqlite-1.27.2-only",
+    "logging": "bounded-json-file-10m-x3",
+    "stopGracePeriod": "30s",
+    "candidateRestartPolicy": "no",
+    "acceptedRestartPolicy": "unless-stopped"
+  },
+  "decision": {
+    "schema": "nodedc.gitea.incident-decision/v2",
+    "manifestFile": "deployment/gitea-incident-salvage/confirmed-decision.json",
+    "manifestSha256": "dc9528462624158eb44218d37cc7054d551ca2d7ded562592982aa3f34c9fc2a",
+    "usersFile": "deployment/gitea-incident-salvage/users.decisions.csv",
+    "usersSha256": "e3b82f1073a86eea9e567edff062dd1689d21ec0edcf3ed92e844da9351ee8b6",
+    "repositoriesFile": "deployment/gitea-incident-salvage/repositories.decisions.csv",
+    "repositoriesSha256": "76b4bae2ab5cec490330c19bfc5ae9429abf7636705ae028c1c64fd54a6a0493",
+    "users": {
+      "active": 2,
+      "locked": 8,
+      "delete": 962
+    },
+    "repositories": {
+      "keep": 45,
+      "delete": 2013,
+      "dctouchPrivate": 32,
+      "silverPublic": 13
+    }
+  },
+  "disposition": {
+    "schema": "nodedc.gitea.incident-disposition.v1",
+    "file": "deployment/gitea-incident-salvage/confirmed-disposition-v1.json",
+    "sha256": "0a066724bcf6e4933133db6cab6cc273393e3c262dd00dda0bbf9ceebd84f78c"
+  },
+  "snapshot": {
+    "root": "/volume1/.nodedc-security-snapshots/docker-gitea-incident-20260814",
+    "uuid": "f5a3fe3a-93ea-bb4d-847f-6221a6bcbc9f",
+    "readOnlyRequired": true,
+    "database": "gitea/gitea/gitea.db",
+    "databaseBytes": 182681600,
+    "databaseSha256": "8db9e74a5641662a808d8252c5d6c9de43fe9efd8687634bfbff2d4361a13052",
+    "repositoriesRoot": "gitea/git/repositories"
+  },
+  "trust": {
+    "legacyRootMounted": false,
+    "legacyDatabaseImported": false,
+    "legacyConfigImported": false,
+    "legacyCredentialsImported": false,
+    "artifactSecrets": "forbidden",
+    "runtimeSecrets": "runner-generated",
+    "repositorySelection": "exact-v2-rows-only",
+    "repositoryCopy": "same-filesystem-per-file-reflink-object-and-validated-ref-material-only",
+    "forbiddenRepositoryMaterial": [
+      "hooks",
+      "config",
+      "alternates",
+      "http-alternates",
+      "shallow",
+      "replace",
+      "grafts",
+      "worktrees",
+      "commondir",
+      "lfs"
+    ],
+    "unsupportedDatabaseState": "confirmed-disposition-bound-no-legacy-row-import-verifiers-pending"
+  },
+  "identity": {
+    "preserveNumericUserIds": false,
+    "preserveNumericRepositoryIds": false,
+    "oldToNewIdMapping": "/volume1/docker/nodedc-gitea/audit/identity-map.json",
+    "emails": "new-local-noreply-only",
+    "passwordHashes": "never-imported",
+    "activeBootstrapCredentials": "root-only-runner-state-require-change",
+    "lockedCredentials": "fresh-random-discarded-and-login-prohibited",
+    "twoFactorAuthentication": "not-configured-by-transition"
+  },
+  "externalPrerequisites": {
+    "legacyContainer": "exact-inspect-pin-required-stopped-restart-no",
+    "publicProxy": "reviewed-nginx-uds-bridge-and-dsm-loopback-upstream",
+    "firewall": "legacy-isolation-retained-and-loopback-3000-ready",
+    "candidatePublicationGate": "socket-parent-uid1000-gid1023-mode0700",
+    "publishAction": "runner-chmod-socket-parent-0750-after-internal-acceptance",
+    "mustPassBeforeApply": true
+  },
+  "acceptance": {
+    "users": "exact-10-row-by-row",
+    "repositories": "exact-45-row-by-row-and-visibility",
+    "credentialsSessionsKeysWebhooksActions": "zero",
+    "git": "fsck-all-and-public-smart-http-smoke",
+    "registration": "closed",
+    "ssh": "disabled",
+    "network": "none-no-ports",
+    "publicHttps": "required-before-ledger-success"
+  },
+  "rollback": "stop-remove-candidate-prove-absent-quarantine-new-root-never-start-legacy"
+}

infra/deploy-runner/fixtures/gitea-salvage/deployment/gitea-incident-salvage-v3.json

@@ -0,0 +1,123 @@
+{
+  "schemaVersion": "nodedc.gitea.incident-salvage.v3",
+  "action": "clean-state-salvage",
+  "component": "gitea",
+  "incidentId": "gitea-20260814",
+  "installRoot": "/volume1/docker/nodedc-gitea",
+  "compose": {
+    "file": "docker-compose.gitea.yml",
+    "project": "nodedc-gitea",
+    "service": "gitea",
+    "sha256": "2f031d5bfff4f42c73cabd8c94487ec3e4f1e1b0a96d3b7eec958904f735908a"
+  },
+  "runtime": {
+    "image": "docker.gitea.com/gitea:1.27.2-rootless@sha256:7de5f49ada687b8c8d2938f547cdb7634839764ba51f297457bae35cee3abd2c",
+    "imageId": "sha256:272085a806e6d182352cdb011c0ebab1d2efc7ec45247de84de5659c7bc5c4c6",
+    "repoDigest": "docker.gitea.com/gitea@sha256:7de5f49ada687b8c8d2938f547cdb7634839764ba51f297457bae35cee3abd2c",
+    "platform": "linux/amd64",
+    "pullPolicy": "never",
+    "entrypoint": "/usr/local/bin/gitea",
+    "runAs": "1000:1000",
+    "transport": "unix:/run/gitea/gitea.sock",
+    "networkMode": "none",
+    "ssh": "disabled-no-published-port",
+    "lfs": "disabled-pending-reachable-pointer-physical-sha-verifier",
+    "database": "new-sqlite-1.27.2-only",
+    "logging": "bounded-json-file-10m-x3",
+    "stopGracePeriod": "30s",
+    "candidateRestartPolicy": "no",
+    "acceptedRestartPolicy": "unless-stopped"
+  },
+  "decision": {
+    "schema": "nodedc.gitea.incident-decision/v2",
+    "manifestFile": "deployment/gitea-incident-salvage/confirmed-decision.json",
+    "manifestSha256": "dc9528462624158eb44218d37cc7054d551ca2d7ded562592982aa3f34c9fc2a",
+    "usersFile": "deployment/gitea-incident-salvage/users.decisions.csv",
+    "usersSha256": "e3b82f1073a86eea9e567edff062dd1689d21ec0edcf3ed92e844da9351ee8b6",
+    "repositoriesFile": "deployment/gitea-incident-salvage/repositories.decisions.csv",
+    "repositoriesSha256": "76b4bae2ab5cec490330c19bfc5ae9429abf7636705ae028c1c64fd54a6a0493",
+    "users": {
+      "active": 2,
+      "locked": 8,
+      "delete": 962
+    },
+    "repositories": {
+      "keep": 45,
+      "delete": 2013,
+      "dctouchPrivate": 32,
+      "silverPublic": 13
+    }
+  },
+  "disposition": {
+    "schema": "nodedc.gitea.incident-disposition.v1",
+    "file": "deployment/gitea-incident-salvage/confirmed-disposition-v1.json",
+    "sha256": "0a066724bcf6e4933133db6cab6cc273393e3c262dd00dda0bbf9ceebd84f78c"
+  },
+  "snapshot": {
+    "root": "/volume1/.nodedc-security-snapshots/docker-gitea-incident-20260814",
+    "uuid": "f5a3fe3a-93ea-bb4d-847f-6221a6bcbc9f",
+    "readOnlyRequired": true,
+    "database": "gitea/gitea/gitea.db",
+    "databaseBytes": 182681600,
+    "databaseSha256": "8db9e74a5641662a808d8252c5d6c9de43fe9efd8687634bfbff2d4361a13052",
+    "repositoriesRoot": "gitea/git/repositories"
+  },
+  "trust": {
+    "legacyRootMounted": false,
+    "legacyDatabaseImported": false,
+    "legacyConfigImported": false,
+    "legacyCredentialsImported": false,
+    "artifactSecrets": "forbidden",
+    "runtimeSecrets": "runner-generated",
+    "repositorySelection": "exact-v2-rows-only",
+    "repositoryCopy": "same-filesystem-per-file-reflink-object-and-validated-ref-material-only",
+    "forbiddenRepositoryMaterial": [
+      "hooks",
+      "config",
+      "alternates",
+      "http-alternates",
+      "shallow",
+      "replace",
+      "grafts",
+      "worktrees",
+      "commondir",
+      "lfs"
+    ],
+    "unsupportedDatabaseState": "closure-disposition-bound-plan-report-review-and-verifiers-pending"
+  },
+  "identity": {
+    "preserveNumericUserIds": false,
+    "preserveNumericRepositoryIds": false,
+    "oldToNewIdMapping": "/volume1/docker/nodedc-gitea/audit/identity-map.json",
+    "emails": "new-local-noreply-only",
+    "passwordHashes": "never-imported",
+    "activeBootstrapCredentials": "root-only-runner-state-require-change",
+    "lockedCredentials": "fresh-random-discarded-and-login-prohibited",
+    "twoFactorAuthentication": "not-configured-by-transition"
+  },
+  "externalPrerequisites": {
+    "legacyContainer": "exact-inspect-pin-required-stopped-restart-no",
+    "publicProxy": "reviewed-nginx-uds-bridge-and-dsm-loopback-upstream",
+    "firewall": "legacy-isolation-retained-and-loopback-3000-ready",
+    "candidatePublicationGate": "socket-parent-uid1000-gid1023-mode0700",
+    "publishAction": "runner-chmod-socket-parent-0750-after-internal-acceptance",
+    "mustPassBeforeApply": true
+  },
+  "acceptance": {
+    "users": "exact-10-row-by-row",
+    "repositories": "exact-45-row-by-row-and-visibility",
+    "credentialsSessionsKeysWebhooksActions": "zero",
+    "git": "fsck-all-and-public-smart-http-smoke",
+    "registration": "closed",
+    "ssh": "disabled",
+    "network": "none-no-ports",
+    "publicHttps": "required-before-ledger-success"
+  },
+  "rollback": "stop-remove-candidate-prove-absent-quarantine-new-root-never-start-legacy",
+  "closureDisposition": {
+    "file": "deployment/gitea-incident-salvage/confirmed-closure-disposition-v1.json",
+    "predecessorArtifactSha256": "d6870b5583a2f329eadb4e6cda65fdf4d271532df5ffbf8bfb1403968a434672",
+    "schema": "nodedc.gitea.incident-closure-disposition.v1",
+    "sha256": "7ed66d9848268431a703fe24b22c41afbaa7c5ff48949604d6fc448d93e0d243"
+  }
+}

infra/deploy-runner/fixtures/gitea-salvage/deployment/gitea-incident-salvage/confirmed-closure-disposition-v1.json

@@ -0,0 +1 @@
+{"activation":{"allowedOperation":"canonical-plan-only","applyFrozen":true,"freezeBoundary":"before-candidate-root-creation"},"authority":{"policyScope":"access-collaboration-issue-pr-attachment-release-label-project-unit-package-action-closure","source":"owner-instruction-in-current-incident-thread","state":"confirmed-policy-evidence-review-pending"},"closureReport":{"expectedBytes":null,"expectedSha256":null,"reviewState":"canonical-plan-output-unreviewed","schema":"nodedc.gitea.salvage-closure-inventory/v1"},"incidentId":"gitea-20260814","policies":{"accessCollaboration":{"accessCache":"DROP_RESET_RECOMPUTE","actorEvidence":"old-user-id-mode-and-kept-deleted-class-only","collaboration":"RECREATE_ONLY_KEPT_ACTORS_AFTER_REVIEWED_OLD_TO_NEW_ID_MAP","deletedActors":962,"keptActors":10,"legacyRowsImported":false,"sensitiveUserPayloadExported":false},"attachments":{"databaseManifest":"ID_UUID_RELATIONS_DECLARED_SIZE_ONLY","filenameOrContentExported":false,"legacyRowsImported":false,"physicalDisposition":"VERIFY_BYTES_THEN_SANITIZED_IMMUTABLE_ARCHIVE_ONLY","physicalPresenceClaimed":false},"issuesPullRequestsMetadata":{"archive":"SANITIZED_IMMUTABLE_ARCHIVE_ONLY","legacyRowsImported":false,"payloadExportedInPlan":false,"planEvidence":"PER_REPOSITORY_COUNTS_ACTOR_CLASSES_TEXT_BYTE_LENGTHS_ONLY","subrelationClosure":{"commentHistoryMerger":"SCHEMA_BOUND_EXACT_RELATION_COUNTS_AND_CLASSES","externalAuthors":"PRESENCE_AND_NAME_BYTE_LENGTHS_ONLY_NO_LOCAL_USER_MAPPING","legacyRowsImported":false,"teamRelations":"EXACT_ROW_TEAM_ORG_IDS_SEALED_HOLD_AND_BLOCK_IF_PRESENT"},"tables":["comment","issue","issue_assignees","issue_content_history","issue_dependency","issue_label","issue_user","issue_watch","notification","project","project_board","project_issue","pull_auto_merge","pull_request","reaction","review","review_state","stopwatch","tracked_time"]},"packagesActions":{"actionsTarget":"DISABLED","legacyPayloadSecretTokenLogImported":false,"packageTarget":"DISABLED","physicalDisposition":"DROP_ONLY_AFTER_SCHEMA_RELATION_AND_PHYSICAL_CLOSURE_VERIFIER","planEvidence":"RELATIONSHIP_COUNTS_AND_SAFE_DECLARED_SIZES_ONLY"},"releasesLabelsProjects":{"archive":"SANITIZED_IMMUTABLE_ARCHIVE_ONLY","legacyRowsImported":false,"payloadExportedInPlan":false},"repositoryState":{"cachedAccessCountersStarsWatches":"DROP_RESET_RECOMPUTE","legacyHooksWebhooksKeysTokensSessionsCredentialsSecrets":"IMPORT_ZERO","topics":"VERIFIED_SEMANTIC_EMPTY_REBUILD_ZERO"},"units":{"actionsType10":"DISABLED_ZERO_TARGET_ROWS","disabledTypes":[6,7,9,10],"enabledCleanTypes":[1,2,3,4,5,8],"legacyConfigImported":false,"legacyRowsImported":false,"packagesType9":"DISABLED_ZERO_TARGET_ROWS"}},"predecessor":{"artifactSha256":"d6870b5583a2f329eadb4e6cda65fdf4d271532df5ffbf8bfb1403968a434672","dispositionFile":"deployment/gitea-incident-salvage/confirmed-disposition-v1.json","dispositionSha256":"0a066724bcf6e4933133db6cab6cc273393e3c262dd00dda0bbf9ceebd84f78c"},"remainingBlockers":["attachment-physical-verifier-pending","candidate-root-activation-hard-frozen","closure-report-review-pin-pending","collaboration-kept-user-mapping-verifier-pending","forensic-ref-archive-verifier-pending","issue-pr-metadata-sanitized-archive-verifier-pending","lfs-reachable-pointer-physical-verifier-pending","package-action-physical-closure-verifier-pending","reference-manifest-fsck-reachability-verifier-pending","repository-object-reconstruction-verifier-pending","target-unit-policy-acceptance-pending","unsupported-schema-catalog-verifier-pending"],"schemaVersion":"nodedc.gitea.incident-closure-disposition.v1","scope":{"deletedRepositories":2013,"deletedUsers":962,"keptRepositories":45,"keptUsers":10},"sourceEvidence":{"databaseSha256":"8db9e74a5641662a808d8252c5d6c9de43fe9efd8687634bfbff2d4361a13052","identityDecisionManifestSha256":"dc9528462624158eb44218d37cc7054d551ca2d7ded562592982aa3f34c9fc2a","referenceManifestSha256":"9cddaf0e4d4cf22dd264a6ae589ccc50d29e07f85c55e9d34b14627cecb8a311","semanticTopicsSha256":"df6e3612186234bfcf3c172ef4e0fff933baaa691a510f9780ebf9e21c8d4d05","snapshotUuid":"f5a3fe3a-93ea-bb4d-847f-6221a6bcbc9f","unsupportedRepositoryReportSha256":"4b2cecf88c62fc5c4a43419885e88a01c9f9aac03133afb19dae0a7caef106ac","unsupportedSchemaCatalogSha256":"b5e3b6776926c4f1627fafd882362ed0ef986bfc86fc6ac6507a43976531b6db"}}

infra/deploy-runner/fixtures/gitea-salvage/docker-compose.gitea.yml

@@ -0,0 +1,62 @@
+name: nodedc-gitea
+
+services:
+  gitea:
+    image: docker.gitea.com/gitea:1.27.2-rootless@sha256:7de5f49ada687b8c8d2938f547cdb7634839764ba51f297457bae35cee3abd2c
+    platform: linux/amd64
+    pull_policy: never
+    network_mode: none
+    user: "1000:1000"
+    entrypoint:
+      - /usr/local/bin/gitea
+    command:
+      - web
+      - --config
+      - /etc/gitea/app.ini
+    restart: "no"
+    stop_grace_period: 30s
+    init: true
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 512
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    environment:
+      USER: git
+      HOME: /data/gitea
+      GITEA_WORK_DIR: /data/gitea
+      GITEA_CUSTOM: /data/gitea
+    volumes:
+      - type: bind
+        source: /volume1/docker/nodedc-gitea/data
+        target: /data
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-gitea/config
+        target: /etc/gitea
+        read_only: true
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-gitea/socket
+        target: /run/gitea
+        bind:
+          create_host_path: false
+    secrets:
+      - gitea_secret_key
+      - gitea_internal_token
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,nodev,size=256m
+
+secrets:
+  gitea_secret_key:
+    file: /volume1/docker/nodedc-gitea/secrets/secret-key
+  gitea_internal_token:
+    file: /volume1/docker/nodedc-gitea/secrets/internal-token

infra/deploy-runner/fixtures/gitea/deployment/gitea-fresh-install-v1.json

@@ -0,0 +1,42 @@
+{
+  "schemaVersion": "nodedc.gitea.fresh-install.v1",
+  "action": "fresh-install",
+  "component": "gitea",
+  "installRoot": "/volume1/docker/nodedc-gitea",
+  "compose": {
+    "file": "docker-compose.gitea.yml",
+    "project": "nodedc-gitea",
+    "service": "gitea",
+    "sha256": "25868a40996c405543b4627d06499b68f43556e607d839e969a400b0bc0ddadb"
+  },
+  "runtime": {
+    "image": "docker.gitea.com/gitea:1.27.1-rootless@sha256:89dc3c214b3992e5bb01e05ad21139d7a8b302d3ea3d8942d3f7e904e92af148",
+    "platform": "linux/amd64",
+    "pullPolicy": "never",
+    "minimumComposeVersion": "2.20.1",
+    "transport": "unix:/run/gitea/gitea.sock",
+    "socketBind": "/volume1/docker/nodedc-gitea/socket:/run/gitea",
+    "ssh": "disabled-no-published-port",
+    "database": "fresh-sqlite-only",
+    "lfs": "disabled-pending-reviewed-restore-transition",
+    "networkMode": "none",
+    "logging": "bounded-json-file-10m-x3",
+    "stopGracePeriod": "30s"
+  },
+  "trust": {
+    "artifactSecrets": "forbidden",
+    "runtimeSecrets": "runner-managed-file-mounts",
+    "legacyRootAccess": "forbidden",
+    "legacyDatabaseImport": "forbidden",
+    "legacyRepositoryImport": "forbidden"
+  },
+  "reverseProxyPrerequisite": {
+    "managedOutsideArtifact": true,
+    "requiredDsmUpstream": "127.0.0.1:3000",
+    "requiredNginxBridge": "/usr/local/etc/nginx/conf.d/http.nodedc-gitea-uds.conf",
+    "requiredNginxBridgeSha256": "164f37a12a4f91e656cf20bd5b109978d16d723bdfde236653722aaf820780c9",
+    "requiredUnixUpstream": "/volume1/docker/nodedc-gitea/socket/gitea.sock",
+    "mustBeCompletedBeforeApply": true
+  },
+  "rollback": "stop-candidate-preserve-fresh-runtime-state-and-restore-source"
+}

infra/deploy-runner/fixtures/gitea/docker-compose.gitea.yml

@@ -0,0 +1,128 @@
+name: nodedc-gitea
+
+services:
+  gitea:
+    image: docker.gitea.com/gitea:1.27.1-rootless@sha256:89dc3c214b3992e5bb01e05ad21139d7a8b302d3ea3d8942d3f7e904e92af148
+    platform: linux/amd64
+    pull_policy: never
+    network_mode: none
+    user: "1000:1000"
+    restart: unless-stopped
+    stop_grace_period: 30s
+    init: true
+    read_only: true
+    cap_drop:
+      - ALL
+    security_opt:
+      - no-new-privileges:true
+    pids_limit: 512
+    logging:
+      driver: json-file
+      options:
+        max-size: "10m"
+        max-file: "3"
+    environment:
+      GITEA_WORK_DIR: /var/lib/gitea
+      GITEA__database__DB_TYPE: sqlite3
+      GITEA__database__PATH: /var/lib/gitea/data/gitea.db
+      GITEA__server__DOMAIN: git.dcserve.ru
+      GITEA__server__ROOT_URL: https://git.dcserve.ru/
+      GITEA__server__PROTOCOL: http+unix
+      GITEA__server__HTTP_ADDR: /run/gitea/gitea.sock
+      GITEA__server__UNIX_SOCKET_PERMISSION: "0666"
+      GITEA__server__LOCAL_ROOT_URL: http://unix/
+      GITEA__server__DISABLE_SSH: "true"
+      GITEA__server__START_SSH_SERVER: "false"
+      GITEA__server__SSH_CREATE_AUTHORIZED_KEYS_FILE: "false"
+      GITEA__server__LFS_START_SERVER: "false"
+      GITEA__server__LFS_ALLOW_PURE_SSH: "false"
+      GITEA__server__OFFLINE_MODE: "true"
+      GITEA__server__LANDING_PAGE: login
+      GITEA__security__INSTALL_LOCK: "true"
+      GITEA__security__SECRET_KEY_URI: file:/run/secrets/gitea_secret_key
+      GITEA__security__INTERNAL_TOKEN_URI: file:/run/secrets/gitea_internal_token
+      GITEA__security__REVERSE_PROXY_LIMIT: "1"
+      GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: 127.0.0.0/8,::1/128
+      GITEA__security__DISABLE_GIT_HOOKS: "true"
+      GITEA__security__DISABLE_WEBHOOKS: "true"
+      GITEA__security__IMPORT_LOCAL_PATHS: "false"
+      GITEA__security__ONLY_ALLOW_PUSH_IF_GITEA_ENVIRONMENT_SET: "true"
+      GITEA__security__PASSWORD_HASH_ALGO: argon2
+      GITEA__security__MIN_PASSWORD_LENGTH: "16"
+      GITEA__security__PASSWORD_COMPLEXITY: lower,upper,digit,spec
+      GITEA__security__TWO_FACTOR_AUTH: enforced
+      GITEA__security__DISABLE_QUERY_AUTH_TOKEN: "true"
+      GITEA__security__ALLOWED_HOST_LIST: loopback
+      GITEA__service__DISABLE_REGISTRATION: "true"
+      GITEA__service__REQUIRE_SIGNIN_VIEW: "true"
+      GITEA__service__SHOW_REGISTRATION_BUTTON: "false"
+      GITEA__service__DEFAULT_KEEP_EMAIL_PRIVATE: "true"
+      GITEA__service__DEFAULT_ALLOW_CREATE_ORGANIZATION: "false"
+      GITEA__service__DEFAULT_USER_IS_RESTRICTED: "true"
+      GITEA__service__DEFAULT_USER_VISIBILITY: private
+      GITEA__service__ALLOWED_USER_VISIBILITY_MODES: private
+      GITEA__service__DEFAULT_ORG_VISIBILITY: private
+      GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION: "false"
+      GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION_API: "false"
+      GITEA__service__ENABLE_REVERSE_PROXY_AUTO_REGISTRATION: "false"
+      GITEA__service__ENABLE_NOTIFY_MAIL: "false"
+      GITEA__service__ENABLE_BASIC_AUTHENTICATION: "false"
+      GITEA__admin__DISABLE_REGULAR_ORG_CREATION: "true"
+      GITEA__admin__USER_DISABLED_FEATURES: deletion,manage_ssh_keys,manage_gpg_keys,change_username
+      GITEA__repository__FORCE_PRIVATE: "true"
+      GITEA__repository__DEFAULT_PRIVATE: private
+      GITEA__repository__USER_MAX_CREATION_LIMIT: "0"
+      GITEA__repository__ORG_MAX_CREATION_LIMIT: "0"
+      GITEA__repository__ENABLE_PUSH_CREATE_USER: "false"
+      GITEA__repository__ENABLE_PUSH_CREATE_ORG: "false"
+      GITEA__repository__DISABLE_MIGRATIONS: "true"
+      GITEA__repository__ALLOW_ADOPTION_OF_UNADOPTED_REPOSITORIES: "false"
+      GITEA__repository__ALLOW_DELETION_OF_UNADOPTED_REPOSITORIES: "false"
+      GITEA__repository__DISABLE_HTTP_GIT: "false"
+      GITEA__repository.upload__ENABLED: "false"
+      GITEA__attachment__ENABLED: "false"
+      GITEA__actions__ENABLED: "false"
+      GITEA__packages__ENABLED: "false"
+      GITEA__oauth2__ENABLED: "false"
+      GITEA__oauth2_client__ENABLE_AUTO_REGISTRATION: "false"
+      GITEA__openid__ENABLE_OPENID_SIGNIN: "false"
+      GITEA__openid__ENABLE_OPENID_SIGNUP: "false"
+      GITEA__federation__ENABLED: "false"
+      GITEA__mailer__ENABLED: "false"
+      GITEA__session__COOKIE_SECURE: "true"
+      GITEA__session__SAME_SITE: strict
+      GITEA__api__ENABLE_SWAGGER: "false"
+      GITEA__migrations__ALLOW_LOCALNETWORKS: "false"
+      GITEA__migrations__SKIP_TLS_VERIFY: "false"
+      GITEA__cors__ENABLED: "false"
+      GITEA__metrics__ENABLED: "false"
+      GITEA__cron.update_checker__ENABLED: "false"
+      GITEA__log__MODE: console
+      GITEA__log__LEVEL: Info
+    volumes:
+      - type: bind
+        source: /volume1/docker/nodedc-gitea/data
+        target: /var/lib/gitea
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-gitea/config
+        target: /etc/gitea
+        bind:
+          create_host_path: false
+      - type: bind
+        source: /volume1/docker/nodedc-gitea/socket
+        target: /run/gitea
+        bind:
+          create_host_path: false
+    secrets:
+      - gitea_secret_key
+      - gitea_internal_token
+    tmpfs:
+      - /tmp:rw,noexec,nosuid,nodev,size=256m
+
+secrets:
+  gitea_secret_key:
+    file: /volume1/docker/nodedc-gitea/secrets/secret-key
+  gitea_internal_token:
+    file: /volume1/docker/nodedc-gitea/secrets/internal-token