begin

.gitignore

@@ -0,0 +1,71 @@
+# ==== AСекрети та ключі ====
+*.pem
+*.key
+*.crt
+*.p12
+*.pfx
+.env
+.env.*
+*secrets*
+*credentials*
+
+# ====A Let's Encrypt / certbot ====
+**/letsencrypt/
+**/certbot/conf/
+**/certbot/www/
+**/acme.sh/
+
+# ==== Дані БД ====
+gitea/gitea-data/
+gitea/postgres-data/
+
+**/data/
+**/mysql-data/
+**/postgres-data/
+**/pgdata/
+**/*.sqlite
+**/*.sqlite3
+**/*.db
+**/*.db-journal
+
+# ==== Gitea внутрішні дані ====
+gitea-stack/gitea/data/
+gitea-stack/gitea/log/
+gitea-stack/gitea/gitea/conf/app.ini.bak
+
+# ==== Логи ====
+**/logs/
+*.logA
+
+# ==== Docker ====
+**/*.pid
+.docker/
+
+# ==== PHP ====
+**/vendor/
+**/node_modules/
+**/cache/
+**/*.cache
+
+# ==== Бекапи (якщо генеруються в цю ж папку) ====
+backups/
+*.sql
+*.sql.gz
+*.tar
+*.tar.gz
+*.zip
+
+# ==== OS / редактори ====
+.DS_Store
+Thumbs.db
+.vscoAde/
+.idea/
+*.swp
+
+# Python
+**/__pycache__/
+**/*.pyc
+**/*.pyo
+
+# Логи скриптів
+**/*.log

gitea/docker-compose.yml

@@ -0,0 +1,42 @@
+services:
+  gitea:
+    image: gitea/gitea:latest
+    container_name: gitea
+    environment:
+      - USER_UID=1000
+      - USER_GID=1000
+      - GITEA__database__DB_TYPE=postgres
+      - GITEA__database__HOST=db:5432
+      - GITEA__database__NAME=gitea
+      - GITEA__database__USER=gitea
+      - GITEA__database__PASSWD=${GITEA_DB_PASSWORD}
+      - GITEA__server__DOMAIN=git.riabenkyi.nl
+      - GITEA__server__ROOT_URL=https://git.riabenkyi.nl/
+      - GITEA__server__SSH_DOMAIN=git.riabenkyi.nl
+    restart: always
+    volumes:
+      - ./gitea-data:/data
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    ports:
+      - "222:22"        # SSH для git push/pull — потрібен зовні
+    networks:
+      - proxy-net
+      - default
+
+  db:
+    image: postgres:15
+    container_name: gitea-db
+    restart: always
+    environment:
+      - POSTGRES_USER=gitea
+      - POSTGRES_PASSWORD=${POSTGRES_PASSWORD}
+      - POSTGRES_DB=gitea
+    volumes:
+      - ./postgres-data:/var/lib/postgresql/data
+    networks:
+      - default
+
+networks:
+  proxy-net:
+    external: true

riabenkyi/.gitignore

@@ -0,0 +1,5 @@
+.env
+db/data/
+nginx/logs/
+php/logs/
+php/sessions/

riabenkyi/docker-compose.yml

@@ -0,0 +1,68 @@
+version: "3.9"
+
+services:
+  nginx:
+    image: nginx:1.27-alpine
+    container_name: riabenkyi_nginx
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - ./nginx/conf/default.conf:/etc/nginx/conf.d/default.conf:ro
+      - ./src:/var/www/html:ro
+      - ./nginx/logs:/var/log/nginx
+      - ./certbot/conf:/etc/letsencrypt
+      - ./certbot/www:/var/www/certbot
+    depends_on:
+      - php
+    networks:
+      - appnet
+      - proxy-net
+    restart: unless-stopped
+
+  php:
+    build: ./php
+    container_name: riabenkyi_php
+    volumes:
+      - /opt/apps/riabenkyi/src:/var/www/html
+      - /opt/apps/riabenkyi/php/sessions:/var/lib/php/sessions
+      - /opt/apps/riabenkyi/php/logs:/var/log/php
+    networks:
+      - appnet
+    restart: unless-stopped
+
+  empty:
+    image: alpine:3.20
+    container_name: riabenkyi_placeholder
+    command: ["sleep", "infinity"]
+    volumes:
+      - /opt/apps/riabenkyi/db/data:/data
+    networks:
+      - appnet
+    restart: unless-stopped
+
+  api:
+    build: ./python
+    container_name: riabenkyi_api
+    hostname: riabenkyi-api
+    volumes:
+      - ./python/app:/app
+    networks:
+      - appnet
+    restart: unless-stopped
+
+
+  certbot:
+    image: certbot/certbot
+    container_name: riabenkyi_certbot
+    volumes:
+      - ./certbot/conf:/etc/letsencrypt
+      - ./certbot/www:/var/www/certbot
+    entrypoint: "/bin/sh -c 'trap exit TERM; while :; do certbot renew; sleep 12h & wait $${!}; done;'"
+
+
+networks:
+  appnet:
+    driver: bridge
+  proxy-net:
+    external: true  

riabenkyi/nginx/conf/default.conf

@@ -0,0 +1,95 @@
+server {
+    listen 80;
+    server_name riabenkyi.nl www.riabenkyi.nl;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name riabenkyi.nl www.riabenkyi.nl;
+
+    ssl_certificate /etc/letsencrypt/live/riabenkyi.nl/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/riabenkyi.nl/privkey.pem;
+
+    root /var/www/html;
+    index index.php index.html;
+
+    location / {
+        try_files $uri $uri/ /index.php?$query_string;
+    }
+
+    location ~ \.php$ {
+        fastcgi_pass php:9000;
+        fastcgi_index index.php;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+        include fastcgi_params;
+    }
+}
+
+server {
+    listen 80;
+    server_name api.riabenkyi.nl;
+
+    location /.well-known/acme-challenge/ {
+        root /var/www/certbot;
+    }
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name api.riabenkyi.nl;
+
+    ssl_certificate /etc/letsencrypt/live/riabenkyi.nl/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/riabenkyi.nl/privkey.pem;
+
+    location / {
+        proxy_pass http://api:8000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 80;
+    server_name git.riabenkyi.nl;
+
+    location / {
+        proxy_pass http://gitea:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        client_max_body_size 512M;
+    }
+}
+
+server {
+    listen 443 ssl;
+    server_name git.riabenkyi.nl;
+
+    ssl_certificate /etc/letsencrypt/live/riabenkyi.nl/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/riabenkyi.nl/privkey.pem;
+
+    location / {
+        proxy_pass http://gitea:3000;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        client_max_body_size 512M;
+    }
+}

riabenkyi/php/Dockerfile

@@ -0,0 +1,5 @@
+FROM php:8.3-fpm-alpine
+
+WORKDIR /var/www/html
+
+# (docker-php-ext-install pdo_mysql)

riabenkyi/python/Dockerfile

@@ -0,0 +1,12 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY app/ .
+
+EXPOSE 8000
+
+CMD ["uvicorn", "main:app", "--host", "0.0.0.0", "--port", "8000"]

riabenkyi/python/app/main.py

@@ -0,0 +1,11 @@
+from fastapi import FastAPI
+
+app = FastAPI()
+
+@app.get("/")
+def read_root():
+    return {"status": "ok", "service": "riabenkyi-api"}
+
+@app.get("/health")
+def health():
+    return {"health": "ok"}

riabenkyi/python/requirements.txt

@@ -0,0 +1,2 @@
+fastapi==0.115.0
+uvicorn[standard]==0.30.6

riabenkyi/scripts/renew-and-reload.sh

@@ -0,0 +1,4 @@
+#!/bin/bash
+cd /opt/apps/riabenkyi
+docker compose run --rm --entrypoint "certbot" certbot renew --quiet
+docker compose exec nginx nginx -s reload

riabenkyi/src/index.php

@@ -0,0 +1,2 @@
+<?php
+echo "Hello from PHP container! Host: " . gethostname();