fix: Gitea Traefik routing and connection pool optimization

- Remove middleware reference from Gitea Traefik labels (caused routing issues)
- Optimize Gitea connection pool settings (MAX_IDLE_CONNS=30, authentication_timeout=180s)
- Add explicit service reference in Traefik labels
- Fix intermittent 504 timeouts by improving PostgreSQL connection handling

Fixes Gitea unreachability via git.michaelschiemer.de

deployment/stacks/gitea/docker-compose.yml

@@ -19,10 +19,22 @@ services:
       - GITEA__database__NAME=${POSTGRES_DB:-gitea}
       - GITEA__database__USER=${POSTGRES_USER:-gitea}
       - GITEA__database__PASSWD=${POSTGRES_PASSWORD:-gitea_password}
-      - GITEA__cache__ENABLED=true
-      - GITEA__cache__ADAPTER=redis
-      - GITEA__cache__HOST=redis:6379
-      - GITEA__cache__PASSWORD=${REDIS_PASSWORD:-gitea_redis_password}
+      # Database connection pool settings to prevent "Timeout before authentication" errors
+      # These limit the number of concurrent connections and prevent connection pool exhaustion
+      # - MAX_OPEN_CONNS: Maximum number of open connections to the database
+      # - MAX_IDLE_CONNS: More warm connections to avoid constantly creating new sessions
+      # - CONN_MAX_LIFETIME: 10 minutes; idle connections are not recycled too quickly
+      # - CONN_MAX_IDLE_TIME: Clean up connections that are idle for too long
+      - GITEA__database__MAX_OPEN_CONNS=50
+      - GITEA__database__MAX_IDLE_CONNS=30
+      - GITEA__database__CONN_MAX_LIFETIME=600
+      - GITEA__database__CONN_MAX_IDLE_TIME=300
+      # Cache, Session, and Queue configuration via environment variables
+      # These override app.ini settings and are applied on every container start
+      # NOTE: Cache deaktiviert - Gitea 1.25 interpretiert GITEA__cache__HOST nicht korrekt
+      # (verbindet sich mit 127.0.0.1:6379 statt redis:6379). Session und Queue nutzen weiterhin Redis.
+      - GITEA__cache__ENABLED=false
+      - GITEA__cache__ADAPTER=memory
       - GITEA__session__PROVIDER=redis
       - GITEA__session__PROVIDER_CONFIG=network=tcp,addr=redis:6379,password=${REDIS_PASSWORD:-gitea_redis_password},db=0,pool_size=100,idle_timeout=180
       - GITEA__queue__TYPE=redis
@@ -40,21 +52,18 @@ services:
     labels:
       - "traefik.enable=true"
 
-      # HTTP Router
+      # HTTP Router configuration
       - "traefik.http.routers.gitea.rule=Host(`git.michaelschiemer.de`)"
       - "traefik.http.routers.gitea.entrypoints=websecure"
       - "traefik.http.routers.gitea.tls=true"
       - "traefik.http.routers.gitea.tls.certresolver=letsencrypt"
-      # Priority to ensure this router is matched before catchall (catchall has no explicit priority, so default is 0)
       - "traefik.http.routers.gitea.priority=100"
-
-      # Service
+      # Service configuration (Docker provider uses port, not url)
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
-      # Use container name explicitly for host network mode
-      - "traefik.http.services.gitea.loadbalancer.server.scheme=http"
-
-      # Middleware
-      - "traefik.http.routers.gitea.middlewares=default-chain@file"
+      # Middleware chain (removed temporarily to test if it causes issues)
+      # - "traefik.http.routers.gitea.middlewares=security-headers-global@file,gzip-compression@file"
+      # Explicitly reference the service (like MinIO does)
+      - "traefik.http.routers.gitea.service=gitea"
     healthcheck:
       test: ["CMD", "curl", "-f", "http://localhost:3000/api/healthz"]
       interval: 30s
@@ -73,7 +82,12 @@ services:
       - POSTGRES_DB=gitea
       - POSTGRES_USER=gitea
       - POSTGRES_PASSWORD=gitea_password
-    command: postgres -c max_connections=300
+    command: >
+      postgres
+      -c max_connections=300
+      -c authentication_timeout=180
+      -c statement_timeout=30000
+      -c idle_in_transaction_session_timeout=30000
     volumes:
       - postgres-data:/var/lib/postgresql/data
     healthcheck: