Move Gitea secrets to environment variables

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -115,6 +115,9 @@ services:
             - GITEA__database__NAME=${POSTGRES_GITEA_DB}
             - GITEA__database__USER=${POSTGRES_USER}
             - GITEA__database__PASSWD=${POSTGRES_PASSWORD}
+            - GITEA__server__LFS_JWT_SECRET=${GITEA_LFS_JWT_SECRET}
+            - GITEA__security__INTERNAL_TOKEN=${GITEA_INTERNAL_TOKEN}
+            - GITEA__oauth2__JWT_SECRET=${GITEA_OAUTH2_JWT_SECRET}
             - USER_UID=1000
             - USER_GID=1000
         restart: always

gitea/config/app.ini

@@ -25,7 +25,7 @@ SSH_LISTEN_PORT = 2222
 BUILTIN_SSH_SERVER_USER = git
 LFS_START_SERVER = true
 DOMAIN = stppi.local
-LFS_JWT_SECRET = XHIJprS_aMv0tizioZpUD38GGqTtNMFXMz1R6LuPvjU
+LFS_JWT_SECRET =
 OFFLINE_MODE = true
 
 [database]
@@ -34,7 +34,7 @@ DB_TYPE = postgres
 HOST = db
 NAME = gitea
 USER = postgres
-PASSWD = password
+PASSWD =
 SCHEMA = 
 SSL_MODE = disable
 LOG_SQL = false
@@ -60,7 +60,7 @@ INSTALL_LOCK = true
 SECRET_KEY = 
 REVERSE_PROXY_LIMIT = 1
 REVERSE_PROXY_TRUSTED_PROXIES = *
-INTERNAL_TOKEN = eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYmYiOjE3NzEyNDMyMTd9.yHsgFcEwDNWmZebftpe8tpWRFa5aR5tkpQuVYybeVaY
+INTERNAL_TOKEN =
 PASSWORD_HASH_ALGO = pbkdf2
 
 [service]
@@ -95,4 +95,4 @@ DEFAULT_MERGE_STYLE = merge
 DEFAULT_TRUST_MODEL = committer
 
 [oauth2]
-JWT_SECRET = pYiwW8xxGi23gysl2pa-02Cf567Z5ERvR6DDFGIn2iQ
+JWT_SECRET =

readme.md

@@ -127,4 +127,8 @@ ICECAST_MOUNT=
 
 DOMAIN=
 EMAIL=
+
+GITEA_LFS_JWT_SECRET=
+GITEA_INTERNAL_TOKEN=
+GITEA_OAUTH2_JWT_SECRET=
 ```