diff --git a/ops/gitea/README.md b/ops/gitea/README.md
new file mode 100644
index 0000000..e320e64
--- /dev/null
+++ b/ops/gitea/README.md
@@ -0,0 +1,27 @@
+# Gitea Operations
+
+This directory contains the versioned, non-secret Gitea deployment.
+
+## Current staging design
+
+- Gitea image: `docker.gitea.com/gitea:1.27.3-rootless`
+- Database: SQLite
+- Application data volume: `filepilot-gitea_gitea-data`
+- Configuration volume: `filepilot-gitea_gitea-config`
+- Temporary access: `127.0.0.1:3000`
+- Public backend port: none
+- Git-over-SSH: disabled
+
+The loopback mapping is temporary until the assignment domain, HTTPS proxy,
+and final hostname are configured.
+
+## Operations
+
+Start or update the service:
+
+```bash
+docker compose up -d
+docker compose ps
+docker compose logs --tail=100 gitea
+docker compose down
+```
\ No newline at end of file
diff --git a/ops/gitea/compose.yaml b/ops/gitea/compose.yaml
new file mode 100644
index 0000000..583c193
--- /dev/null
+++ b/ops/gitea/compose.yaml
@@ -0,0 +1,25 @@
+name: filepilot-gitea
+
+services:
+  gitea:
+    image: docker.gitea.com/gitea:1.27.3-rootless
+    container_name: filepilot-gitea
+    restart: unless-stopped
+    environment:
+      GITEA__database__DB_TYPE: sqlite3
+      GITEA__database__PATH: /var/lib/gitea/data/gitea.db
+      GITEA__server__DOMAIN: localhost
+      GITEA__server__ROOT_URL: http://localhost:3000/
+      GITEA__server__HTTP_PORT: 3000
+      GITEA__server__DISABLE_SSH: "true"
+      GITEA__service__DISABLE_REGISTRATION: "false"
+    ports:
+      - "127.0.0.1:3000:3000"
+    volumes:
+      - gitea-data:/var/lib/gitea
+      - gitea-config:/etc/gitea
+
+volumes:
+  gitea-data:
+  gitea-config:
+