refactor: Cloudflare Tunnel + frp SSH 中转变更

- 新增 cloudflared Docker 服务替代原 Bandwagon frp 方案
- 新增 frpc 转发 Git SSH 到阿里云 VPS
- 为所有服务添加 web entrypoint 路由（兼容 cloudflared HTTP）
- HedgeDoc 添加 X-Forwarded-Proto 中间件修复 CSP 登录问题
- Homepage 添加 xiteng.site 根域名路由
- Gitea 配置 SSH_DOMAIN=git.xiteng.site
- 更新 README 反映当前架构
- .gitignore: frpc.toml / credentials / letsencrypt

gitea/compose.yml

@@ -15,28 +15,37 @@ services:
     restart: unless-stopped
     env_file: ../.env
     environment:
-      USER_UID: 1000
-      USER_GID: 1000
+      USER_UID: 964
+      USER_GID: 964
       GITEA__database__DB_TYPE: postgres
       GITEA__database__HOST: db:5432
       GITEA__database__NAME: giteadb
       GITEA__database__USER: gitea
       GITEA__server__SSH_PORT: 22
+      GITEA__server__SSH_LISTEN_PORT: 22
+      GITEA__server__SSH_DOMAIN: git.xiteng.site
     volumes:
       - ./data:/data
     # 保留 SSH 端口以便通过 SSH 推送代码（可选），移除 HTTP 宿主端口，由 Traefik 暴露
     ports:
       - "3004:3000"
-      - "222:22"
     labels:
       # --- 1. Traefik 路由设置 ---
       - "traefik.enable=true"
       - "traefik.http.routers.gitea.rule=Host(`gitea.xiteng.site`)"
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
       - "traefik.http.routers.gitea.entrypoints=websecure"
-      # --- 新增：开启 TLS 并指定解析器 ---
+      # --- HTTP 入口（来自 cloudflared tunnel）---
+      - "traefik.http.routers.gitea-http.rule=Host(`gitea.xiteng.site`)"
+      - "traefik.http.routers.gitea-http.service=gitea"
+      - "traefik.http.routers.gitea-http.entrypoints=web"
+      # --- 开启 TLS 并指定解析器 ---
       - "traefik.http.routers.gitea.tls=true"
       - "traefik.http.routers.gitea.tls.certresolver=cfresolver"
+      # TCP Config (SSH)
+      - "traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)" # SNI must be * for SSH
+      - "traefik.tcp.routers.gitea-ssh.entrypoints=ssh"
+      - "traefik.tcp.services.gitea-ssh.loadbalancer.server.port=22"
       # --- 2. Homepage 自动发现设置 ---
       - "homepage.group=生产力工具"             # 分组名称
       - "homepage.name=Gitea"               # 显示名称