schema_version: 6
publication_status: published

slug: gitea
name: Gitea
tagline: A lightweight Git service for repositories, issues, and collaboration
summary: >-
  Gitea hosts Git repositories, pull requests, issues, wikis, and package registries on your own server. This recipe uses the official image and PostgreSQL, disables open registration, and binds web and SSH to localhost.

status: active
editorial_status: experimental

links:
  website: https://about.gitea.com/
  source: https://github.com/go-gitea/gitea
  documentation: https://docs.gitea.com/
  issues: https://github.com/go-gitea/gitea/issues

classification:
  categories:
    - Development
  tags:
    - git
    - code-hosting
    - collaboration
    - devops
  implementation_languages:
    - Go
  alternatives_to:
    - GitHub
    - GitLab
    - Bitbucket

license:
  spdx: MIT
  kind: open_source
  restrictions: []
  notes: null

localization:
  ui_languages:
    - en
    - ru
  docs_languages:
    - en

clients:
  web: true
  android: false
  ios: false
  desktop: false

auth:
  oidc: native
  saml: none
  two_factor: native
  proxy_header: true

requirements:
  architectures:
    - amd64
    - arm64
  min_cpu_cores: 1
  min_ram_mb: 512
  recommended_ram_mb: 1024
  min_disk_gb: 5
  gpu:
    required: false
    supported: false
  database: postgresql
  dependencies: []

operations:
  install_difficulty: 3
  installation_levels:
    home: partial
    vps: partial
    reliable: partial
  maintenance_difficulty: 3
  backup_supported: true
  restore_tested: true
  healthcheck: true
  reverse_proxy_required: true
  update_complexity: manual_steps

recipe:
  id: gitea-compose
  version: 3
  compose_file: compose.yaml
  env_example: .env.example
  installation: installation.md
  troubleshooting: troubleshooting.md
  supported_docker_compose: ">=2.24.0"
  application_version: 28.2.0
  images:
    - name: docker.gitea.com/gitea
      tag_source: pinned
    - name: postgres
      tag_source: pinned
  tested_at: "2026-10-25"
  tested_architectures:
    amd64: passed
    arm64: not_tested
  smoke_test: full
  check_history:
    - tested_at: "2026-10-25"
      application_version: 28.2.0
      recipe_version: 3
      tested_architectures:
        amd64: passed
        arm64: not_tested
      smoke_test: full
      restore_tested: true
    - tested_at: "2026-10-09"
      application_version: 28.1.0
      recipe_version: 2
      tested_architectures:
        amd64: passed
        arm64: not_tested
      smoke_test: full
      restore_tested: false
    - tested_at: "2026-09-20"
      application_version: 1.27.3
      recipe_version: 1
      tested_architectures:
        amd64: passed
        arm64: not_tested
      smoke_test: full
      restore_tested: false
    - tested_at: "2026-09-03"
      application_version: 1.27.3
      recipe_version: 1
      tested_architectures:
        amd64: passed
        arm64: passed
      smoke_test: full
      restore_tested: false
  license: MIT
  smoke_test_limitations:
    - The application smoke test, including backup and restore, passed on amd64 on 2026-10-25. arm64 were not tested in this run.
    - The amd64 smoke creates a private repository, removes it, and restores both its PostgreSQL rows and Git files; SSH pushes, OIDC, Actions runners, and external integrations are not exercised.

security:
  public_exposure: supported
  default_bind: localhost
  privileged: false
  host_network: false
  docker_socket: false
  known_risks:
    - A Git service stores source code, SSH keys, tokens, and webhooks; public web access requires HTTPS, timely updates, and strong account protection.
    - Public SSH increases the attack surface and is bound to localhost in this recipe; expose it deliberately and restrict it with a firewall.
    - Gitea Actions and a runner are not configured; executing untrusted workflows requires a separate isolation model.
  assessment:
    status: not_assessed
    assessed_at: null

upstream:
  release_source: github
  repository: go-gitea/gitea
  last_release_at: "2026-10-18"
  last_checked_at: "2026-10-25T15:19:46.635Z"
  stars: 57748
  stars_checked_at: "2026-09-01T16:15:41Z"
  releases_last_year: 18
  releases_checked_at: "2026-10-25T15:19:46.635Z"

update_tracking:
  releases:
    status: current
    checked_at: "2026-10-25T15:19:46.635Z"
    latest_version: 28.2.0
  critical_vulnerabilities:
    status: findings
    checked_at: "2026-10-25T15:21:03.910Z"
    critical_count: 1
    scanner: trivy
    ids:
      - CVE-2025-68121
  breaking_updates:
    status: unknown
    checked_at: null
  compose_changes:
    status: not_tracked
    checked_at: null
  outdated_images:
    status: current
    checked_at: "2026-10-25T15:19:46.635Z"
    images: []
update_policy:
  # The recipe uses Gitea's current official docker.gitea.com registry, which
  # catalogctl cannot query, and PostgreSQL has an independent version.
  images: []
  compose: null

content:
  description: description.md
  logo: assets/logo.svg
  screenshots:
    - file: assets/dashboard.webp
      alt: Signed-in dashboard with the contribution calendar, a feed of recent pushes, issues and a release, and the repository list beside it
    - file: assets/repository.webp
      alt: Repository page in dark theme with the file list and each file's last commit, the description panel, the licence, the latest release and the language breakdown
    - file: assets/issues.webp
      alt: Issue list with five open issues and one closed, each with its colour-coded label, milestone and author
    - file: assets/pull-request.webp
      alt: Pull request in dark theme showing eight added lines of an alert rule highlighted in the diff, with the review controls above it
    - file: assets/commits.webp
      alt: Commit history of the main branch with the author, short hash, message, release tag and date of each commit
  updated_at: "2026-10-25"