<!-- SPDX-License-Identifier: GPL-3.0-or-later -->

# MokoGIT git stack (staged for `.vault`)

This directory is the **staged server compose** for the MokoGIT git service, laid out to match the
target `.vault/stacks/git/{prod,rc,dev}/` structure so it can be dropped into `.vault` when the
restructure resumes.

## Ownership split

- **This repo** (the Gitea fork) builds + pushes the **image** (`mokoconsulting/mokogit`, tiers
  `mokogit` / `-rc` / `-dev`) via its own CI.
- **`.vault`** (`MokoConsulting/.vault`, `/opt/.vault` on the Beelink) owns the **server compose +
  config** that RUNS those containers. `.vault` is the single source of truth for the box.

## Layout

```
deploy/git/
  VERSION                 # per-stack version (xx.xx.xx)
  prod/  { docker-compose.yml, VERSION, .env.example }   -> container mokogit,     /opt/mokogit/prod, db mokogit
  rc/    { docker-compose.yml, VERSION, .env.example }   -> container mokogit-rc,  /opt/mokogit/rc,   db mokogit_rc
  dev/   { docker-compose.yml, VERSION, .env.example }   -> container mokogit-dev, /opt/mokogit/dev,  db mokogit_dev
```

Versioning follows MokoOrgStandards `xx.xx.xx` (see repo-root `VERSIONING.md`). Each tier and the
stack carry a `VERSION` file.

## ⚠️ Not yet live — reconcile first

These composes are **modeled on the documented live config**, not copied from the running box, so
they are **NOT guaranteed byte-accurate**. Before dropping into `.vault`:

1. **DIFF against the live** `/opt/mokogitea/docker-compose.yml` (run with `docker compose -p
   gitea-dev`). Reconcile every line tagged `RECONCILE` in the compose: exact volume/conf layout
   (live app.ini is at `${GIT_DATA_DIR}/conf/app.ini`), host ports, the DB host reachability (DB is
   **host MySQL**; app DB user is `mokogitea`), the docker network name, and any `act_runner` /
   `depends_on` wiring (note: `depends_on` uses the prod service key — mismatches caused a past
   outage).
2. **Secrets stay external** — every host/secret value is `${VAR}`; real values go in a **gitignored
   `.env`** or Gitea Actions secrets, never committed. `.env.example` files carry only placeholders.

## Do NOT relocate yet

The `.vault` restructure is **PAUSED** on server drift (partly from the mokogitea→mokogit rebrand
leaving the box tree dirty) and an **open critical secrets-in-git issue** in `.vault` history. Moving
the git compose onto the box now risks breaking the `--ff-only` pull. Relocation happens when the
restructure resumes — coordinate first. Until then git keeps running from `/opt/mokogitea` +
`/opt/gitea-dev` (the old locations).