---
tags:
  - GIT
  - CI/CD
  - CI-CD
---
🔒 Part 1: Inject Gitea Secrets into Compose Files Safely

Hardcoding sensitive data like passwords, API keys, or database credentials into your Git repository is a major security risk. Instead, you should store them in Gitea and pass them dynamically at runtime. [[1](https://www.softrams.com/post/deploying-kong-gateway-in-db-less-mode-on-kubernetes), [2](https://medium.com/@saumya07013/safely-managing-secrets-in-containers-best-practices-and-strategies-1b71e49b1525), [3](https://www.howtogeek.com/devops/how-to-protect-sensitive-secrets-and-credentials-in-your-git-repository/), [4](https://glmdev.medium.com/code-freedom-with-gitea-drone-ci-part-i-4b9dfbce1514)]

1. Add Secrets to Gitea

2. Go to your repository in Gitea.
3. Navigate to **Settings** ➡️ **Actions** ➡️ **Secrets**.
4. Click **貯/Add Secret**.
5. Add your variables (e.g., Key: `MYSQL_PASSWORD`, Value: `super_secret_password_123`). [[1](https://blog.devgenius.io/setting-up-a-simple-ci-cd-with-django-gitea-jenkins-and-of-course-docker-ab883972efb5), [2](https://testautomationu.applitools.com/observability-for-test-automation/chapter11.html), [3](https://medium.com/google-developer-experts/how-to-store-sensitive-data-on-gcp-d96e4e545224)]

6. Update Your `docker-compose.yml`

Configure your Compose file to look for standard environment variables. Do not include default values here.

	services:
	  database:
	    image: mysql:8.0
	    environment:
	      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
	      - MYSQL_PASSWORD=${DB_PASSWORD}

3. Update Your Gitea Workflow File

You can map Gitea Secrets into an environment block right inside your workflow step. When `docker compose` runs, it will read those variables from the runner's system environment and inject them into the container definition. [[1](https://www.dataquest.io/blog/intro-to-docker-compose/)]

      - name: Verify Compose File Validity
        env:
          # Map Gitea Secrets to the environment variables expected by your compose file
          DB_ROOT_PASSWORD: ${{ secrets.MYSQL_ROOT_PASSWORD }}
          DB_PASSWORD: ${{ secrets.MYSQL_PASSWORD }}
        run: |
          echo "Injecting secrets and testing configuration..."
          docker compose config