commit 24ded53e9c41f419b911126e7106760ef787a12f
Author: mich3000 <sepulmichael@hotmail.com>
Date:   Wed Nov 4 16:58:24 2026 +0100

    portainer-ce stack

diff --git a/README.md b/README.md
new file mode 100644
index 0000000..f550450
--- /dev/null
+++ b/README.md
@@ -0,0 +1,34 @@
+# portainer
+
+Portainer CE stack, ready to deploy directly or through the gittea push-to-deploy CI.
+
+## Run it directly
+
+```bash
+docker compose up -d
+```
+
+Open `https://localhost:9443` and create the admin user on first run (first visit wins — nobody can register afterwards).
+
+## Test it through Gitea (gittea CI)
+
+1. Create an empty repo in Gitea (e.g. `portainer`, `main` branch).
+2. If not done yet, add the webhook to the repo:
+   - URL: `http://deployer:9000/deploy`
+   - Secret: `WEBHOOK_SECRET` from the gittea `.env`
+   - Trigger: push events
+3. Push this folder:
+
+```bash
+git remote add origin http://<gitea-host>:<port>/<user>/portainer.git
+git push -u origin main
+```
+
+4. The deployer clones the repo and runs `docker compose up -d` on every push that touches non-doc files. Watch it: `docker logs -f gittea-deployer`.
+
+## Notes
+
+- Only the compose file is needed; no `deploy.sh` in the repo means the deployer uses plain `docker compose`.
+- Port 9443 is configurable: `PORTAINER_HTTPS_PORT=9444 docker compose up -d`.
+- Port 9000 is intentionally not published (deployer default port).
+- Portainer manages the same Docker daemon the deployer uses — both mount `docker.sock` (root-equivalent access).
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..7579a94
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,17 @@
+services:
+  portainer:
+    image: portainer/portainer-ce:2.45.3-alpine
+    container_name: portainer
+    restart: unless-stopped
+    ports:
+      - "${PORTAINER_HTTPS_PORT:-9443}:9443"   # web UI (HTTPS)
+      # - "8000:8000"                          # edge agents (optional)
+      # - "9000:9000"                          # legacy HTTP: avoid, conflicts with the deployer
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - portainer-data:/data
+    security_opt:
+      - no-new-privileges:true
+
+volumes:
+  portainer-data: