refactor(compose): protect services and centralize routing

gitea/docker-compose.yml

@@ -3,6 +3,8 @@ services:
     image: ${GITEA_POSTGRES_IMAGE}
     container_name: gitea-postgres
     restart: unless-stopped
+    labels:
+      prune.protect: "true"
     environment:
       POSTGRES_DB: ${GITEA_DB_NAME}
       POSTGRES_USER: ${GITEA_DB_USER}
@@ -15,7 +17,6 @@ services:
 
   gitea:
     image: ${GITEA_IMAGE}
-    pull_policy: always
     container_name: gitea
     restart: unless-stopped
     depends_on:
@@ -79,19 +80,16 @@ services:
     ports:
       - "${GITEA_SSH_PORT}:${GITEA_SSH_PORT}"
     labels:
+      prune.protect: "true"
       traefik.enable: "true"
       traefik.docker.network: "${TRAEFIK_DOCKER_NETWORK}"
-      traefik.http.routers.gitea.rule: "Host(`${GITEA_DOMAIN}`)"
-      traefik.http.routers.gitea.entrypoints: "${TRAEFIK_ENTRYPOINT_SECURE}"
-      traefik.http.routers.gitea.tls: "true"
-      traefik.http.routers.gitea.tls.certresolver: "${TRAEFIK_CERTRESOLVER}"
-      traefik.http.routers.gitea.middlewares: "crowdsec-bouncer@file"
-      traefik.http.services.gitea.loadbalancer.server.port: "3000"
 
   gitea-runner:
     image: ${GITEA_RUNNER_IMAGE}
     container_name: gitea-act-runner
     restart: unless-stopped
+    labels:
+      prune.protect: "true"
     depends_on:
       - gitea
     environment:
@@ -107,6 +105,8 @@ services:
 
 networks:
   gitea:
+    labels:
+      prune.protect: "true"
     driver: bridge
   mail_internal:
     external: true