The server

Gitea here is a straightforward binary install: the gitea service listening on port 3000 , a lightweight database behind it, and its config in one file ( app.ini ). HAProxy at the edge publishes it as https://git.example.com . 
 GIT-Server (10.100.100.2)
 gitea (systemd service, :3000)
 config: /etc/gitea/app.ini
 fronted by HAProxy -> https://git.example.com
 
 It's deliberately modest — a single service, a single config file, a single port. That simplicity is a feature: when something needs checking, there's one process and one log to look at (and that log ships to the central store like everything else). 
 The Gitea Actions feature (its built-in CI, compatible with GitHub Actions syntax) is enabled here, with the actual job execution handled by a separate runner VM — that whole story is in CI/CD & the Container Registry over in the platform shelf. 
 
 Why we use this: a Git forge doesn't need to be heavy to be useful. One binary, one config, one port covers an astonishing amount — repos, users, the API, and CI — for a footprint a 2 GiB VM doesn't notice.