From ee39e0b1c6ea7d966bce92fc661d64d34ff18ea2 Mon Sep 17 00:00:00 2001
From: Lee <1633292@qq.com>
Date: Wed, 19 Aug 2026 18:16:40 +0800
Subject: [PATCH] =?UTF-8?q?=E9=99=90=E5=88=B6=20Gitea=20=E7=AB=AF=E5=8F=A3?=
 =?UTF-8?q?=E4=BB=85=E6=9C=AC=E6=9C=BA=E8=AE=BF=E9=97=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 deploy/README.md    | 2 +-
 deploy/compose.yaml | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/deploy/README.md b/deploy/README.md
index 3af7715..a5dbd50 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -5,7 +5,7 @@ The production stack lives at `/opt/tracecd` on `156.238.122.140` and is sized f
 ## Services
 
 - MySQL 8.0.40: Docker-only `tracecd-net`; no host port is published.
-- Gitea 1.22.6: host ports 3000 and 2222 are mapped, but remain blocked by the host firewall unless explicitly opened.
+- Gitea 1.22.6: host ports 3000 and 2222 are bound to loopback only until an authenticated public access method is chosen.
 - Gitea Actions runner: capacity 1, label `centos-env`, Docker socket access.
 - TraceCD: built by Gitea Actions, bound to `127.0.0.1:8080` and served by host Nginx.
 - Nginx: `t.1633292.cn` on port 80. Port 443 remains owned by Xray.
diff --git a/deploy/compose.yaml b/deploy/compose.yaml
index 88e4efa..30e558c 100644
--- a/deploy/compose.yaml
+++ b/deploy/compose.yaml
@@ -56,8 +56,8 @@ services:
       - ./data/gitea:/data
       - /etc/localtime:/etc/localtime:ro
     ports:
-      - "3000:3000"
-      - "2222:22"
+      - "127.0.0.1:3000:3000"
+      - "127.0.0.1:2222:22"
     networks:
       - tracecd-net
     mem_limit: 256m