Gitignore gitea app.ini and remove INTERNAL_TOKEN from template

Runtime config (app.ini) should not be tracked since secrets are
injected via env vars in docker-compose. The template remains as
source of truth. INTERNAL_TOKEN is removed from the template as
it is set exclusively via GITEA__security__INTERNAL_TOKEN env var.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.gitignore

@@ -7,6 +7,7 @@ backend/token/
 .env
 
 gitea/data/*
+gitea/config/app.ini
 
 # Gitea runner
 gitea-runner/.runner

gitea/config/app.ini

@@ -1,98 +0,0 @@
-APP_NAME = Gitea: Git with a cup of tea
-RUN_USER = git
-RUN_MODE = prod
-WORK_PATH = /var/lib/gitea
-
-[repository]
-ROOT = /var/lib/gitea/git/repositories
-
-[repository.local]
-LOCAL_COPY_PATH = /tmp/gitea/local-repo
-
-[repository.upload]
-TEMP_PATH = /tmp/gitea/uploads
-
-[server]
-APP_DATA_PATH = /var/lib/gitea
-SSH_DOMAIN = adam-french.co.uk
-HTTP_PORT = 3000
-ROOT_URL = https://adam-french.co.uk/gitea/
-DISABLE_SSH = false
-; In rootless gitea container only internal ssh server is supported
-START_SSH_SERVER = true
-SSH_PORT = 2222
-SSH_LISTEN_PORT = 2222
-BUILTIN_SSH_SERVER_USER = git
-LFS_START_SERVER = true
-DOMAIN = stppi.local
-LFS_JWT_SECRET =
-OFFLINE_MODE = true
-
-[database]
-PATH = /var/lib/gitea/data/gitea.db
-DB_TYPE = postgres
-HOST = db
-NAME = gitea
-USER = postgres
-PASSWD =
-SCHEMA = 
-SSL_MODE = disable
-LOG_SQL = false
-
-[session]
-PROVIDER_CONFIG = /var/lib/gitea/data/sessions
-PROVIDER = file
-
-[picture]
-AVATAR_UPLOAD_PATH = /var/lib/gitea/data/avatars
-REPOSITORY_AVATAR_UPLOAD_PATH = /var/lib/gitea/data/repo-avatars
-
-[attachment]
-PATH = /var/lib/gitea/data/attachments
-
-[log]
-ROOT_PATH = /var/lib/gitea/data/log
-MODE = console
-LEVEL = info
-
-[security]
-INSTALL_LOCK = true
-SECRET_KEY = 
-REVERSE_PROXY_LIMIT = 1
-REVERSE_PROXY_TRUSTED_PROXIES = *
-INTERNAL_TOKEN =
-PASSWORD_HASH_ALGO = pbkdf2
-
-[service]
-DISABLE_REGISTRATION = true
-REQUIRE_SIGNIN_VIEW = false
-REGISTER_EMAIL_CONFIRM = false
-ENABLE_NOTIFY_MAIL = false
-ALLOW_ONLY_EXTERNAL_REGISTRATION = false
-ENABLE_CAPTCHA = false
-DEFAULT_KEEP_EMAIL_PRIVATE = false
-DEFAULT_ALLOW_CREATE_ORGANIZATION = true
-DEFAULT_ENABLE_TIMETRACKING = true
-NO_REPLY_ADDRESS = noreply.localhost
-
-[lfs]
-PATH = /var/lib/gitea/git/lfs
-
-[mailer]
-ENABLED = false
-
-[openid]
-ENABLE_OPENID_SIGNIN = true
-ENABLE_OPENID_SIGNUP = true
-
-[cron.update_checker]
-ENABLED = false
-
-[repository.pull-request]
-DEFAULT_MERGE_STYLE = merge
-
-[repository.signing]
-DEFAULT_TRUST_MODEL = committer
-
-[oauth2]
-JWT_SECRET =

gitea/config/app.ini.template

@@ -60,7 +60,6 @@ INSTALL_LOCK = true
 SECRET_KEY = 
 REVERSE_PROXY_LIMIT = 1
 REVERSE_PROXY_TRUSTED_PROXIES = *
-INTERNAL_TOKEN =
 PASSWORD_HASH_ALGO = pbkdf2
 
 [service]