> ## Documentation Index
> Fetch the complete documentation index at: https://songbird.studiocollective.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Gitea on GCP (git.daw.club)

# Gitea on GCP (git.daw\.club)

Self-hosted Gitea instance for daw\.club project management, running on a GCE e2-small VM behind a global HTTPS load balancer.

## Architecture

```
                   ┌──────────────┐
  git.daw.club ──► │  Cloudflare  │  DNS (A record → LB IP)
                   └──────┬───────┘
                          │
                   ┌──────▼───────┐
                   │  GCP Global  │  Static IP: 34.117.234.171
                   │  HTTPS LB    │  Managed SSL cert (auto-renew)
                   │  + HTTP→HTTPS│  HTTP 301 redirect
                   └──────┬───────┘
                          │
                   ┌──────▼───────┐
                   │  GCE e2-small│  us-central1-a
                   │  Debian 12   │  30GB pd-ssd
                   │  Gitea 1.22.6│  Port 3000
                   │  SQLite + LFS│  /var/lib/gitea/data
                   └──────────────┘
```

## GCP Resources

| Resource               | Name                                        | Details                                                         |
| ---------------------- | ------------------------------------------- | --------------------------------------------------------------- |
| **Project**            | `gen-lang-client-0380481603`                |                                                                 |
| **VM**                 | `gitea-server`                              | e2-small, us-central1-a, Debian 12                              |
| **Static IP**          | `gitea-lb-ip`                               | 34.117.234.171 (global)                                         |
| **Instance Group**     | `gitea-ig`                                  | Unmanaged, us-central1-a                                        |
| **Health Check**       | `gitea-health-check`                        | HTTP :3000/, 30s interval                                       |
| **Backend Service**    | `gitea-gce-backend`                         | Global, EXTERNAL\_MANAGED                                       |
| **URL Map**            | `gitea-url-map`                             | Default → gitea-gce-backend                                     |
| **URL Map (redirect)** | `gitea-http-redirect`                       | HTTP 301 → HTTPS                                                |
| **SSL Cert**           | `gitea-cert`                                | Managed, git.daw\.club                                          |
| **HTTPS Proxy**        | `gitea-https-proxy`                         | → gitea-url-map                                                 |
| **HTTP Proxy**         | `gitea-http-proxy`                          | → gitea-http-redirect                                           |
| **Forwarding Rule**    | `gitea-https-rule`                          | :443 → gitea-https-proxy                                        |
| **Forwarding Rule**    | `gitea-http-rule`                           | :80 → gitea-http-proxy                                          |
| **Firewall**           | `allow-health-check`                        | tcp:3000 from GCP health check ranges                           |
| **Service Account**    | `gitea-cloudrun@...`                        | storage.objectAdmin on GCS buckets                              |
| **GCS Buckets**        | `songbird-gitea-data`, `songbird-gitea-lfs` | `songbird-gitea-lfs` mounted via gcsfuse for LFS object storage |

## VM Details

* **OS**: Debian 12
* **Gitea**: v1.22.6 (binary install at `/usr/local/bin/gitea`)
* **Config**: `/etc/gitea/app.ini`
* **Data**: `/var/lib/gitea/data/` (SQLite DB, repos)
* **LFS storage**: GCS bucket `songbird-gitea-lfs` (via gcsfuse mount at `/mnt/gcslfs`)
* **Service**: `systemd` unit `gitea.service`
* **User**: `git` (system user)

## Common Operations

```bash theme={null}
# SSH into the VM
gcloud compute ssh gitea-server --zone=us-central1-a --project=gen-lang-client-0380481603

# Check Gitea status
sudo systemctl status gitea

# View Gitea logs
sudo journalctl -u gitea -f

# Restart Gitea
sudo systemctl restart gitea

# Edit config (requires root)
sudo vim /etc/gitea/app.ini
sudo systemctl restart gitea

# Create admin user
sudo -u git /usr/local/bin/gitea admin user create \
  --config /etc/gitea/app.ini \
  --username admin \
  --password <password> \
  --email admin@daw.club \
  --admin

# Backup
sudo -u git /usr/local/bin/gitea dump --config /etc/gitea/app.ini
```

## Cost

* **GCE e2-small**: \~\$15/month (0.5 vCPU, 2GB RAM)
* **30GB pd-ssd**: \~\$5/month
* **Static IP**: Free (while attached to a running VM)
* **Load balancer**: \~\$18/month (forwarding rules + backend)
* **SSL cert**: Free (Google-managed)
* **GCS LFS storage**: \~\$0.02/GB/month (Standard class)
* **Total**: \~\$38/month (VM + disk + LB + GCS)

## DNS

Managed via Cloudflare:

* `git.daw.club` → A record → `34.117.234.171` (GCP LB static IP)
* Cloudflare proxy **disabled** (DNS only) — GCP LB handles SSL

## LFS on GCS

Git LFS objects are stored in the `songbird-gitea-lfs` GCS bucket via **gcsfuse**, which mounts the bucket as a local filesystem at `/mnt/gcslfs`. Gitea uses its standard `PATH`-based LFS storage pointing to the mount, so no HMAC keys or S3 credentials are needed — the VM's attached service account (`gitea-cloudrun@...`) provides authentication automatically.

The mount is managed by a systemd mount unit (`mnt-gcslfs.mount`) that starts before Gitea.

```bash theme={null}
# Check mount status
sudo systemctl status mnt-gcslfs.mount

# View mounted files
ls /mnt/gcslfs/

# Remount if needed
sudo systemctl restart mnt-gcslfs.mount
sudo systemctl restart gitea

# View gcsfuse logs
sudo journalctl -u mnt-gcslfs.mount -f
```

## Future: Cloud Run for Headless DAW

The GCS bucket `songbird-gitea-data` and Artifact Registry (`us-central1/songbird`) are already provisioned for future Cloud Run deployments of the headless DAW instances. The load balancer can be extended with additional URL map rules to route DAW traffic.