Self-hosted AI stack: Gitea, runners and Ollama on a VPS

Create a project directory and a docker-compose.yml file that declares three services: gitea, ollama and runner. Place all volumes in a data/ subfolder to simplify backups.

mkdir -p ~/gitea-stack/data/{gitea,ollama,runner}
cd ~/gitea-stack

The file declares an internal ai-net network on which all three services communicate. Ollama is not exposed on the host: only the runner can reach it via the Docker network.

cat > docker-compose.yml << 'EOF'
version: "3.8"

networks:
  ai-net:
    driver: bridge

volumes:
  gitea-data:
  ollama-data:
  runner-data:

services:
  gitea:
    image: gitea/gitea:latest
    restart: unless-stopped
    networks: [ai-net]
    ports:
      - "3000:3000"
      - "2222:22"
    volumes:
      - gitea-data:/data
    environment:
      - GITEA__server__DOMAIN=git.yourdomain.com
      - GITEA__server__ROOT_URL=https://git.yourdomain.com
      - GITEA__actions__ENABLED=true

  ollama:
    image: ollama/ollama:latest
    restart: unless-stopped
    networks: [ai-net]
    volumes:
      - ollama-data:/root/.ollama

  runner:
    image: gitea/act_runner:latest
    restart: unless-stopped
    networks: [ai-net]
    volumes:
      - runner-data:/data
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - GITEA_INSTANCE_URL=http://gitea:3000
      - GITEA_RUNNER_REGISTRATION_TOKEN=${RUNNER_TOKEN}
      - GITEA_RUNNER_NAME=local-runner
      - OLLAMA_URL=http://ollama:11434
EOF

Start only Gitea first to complete the initial setup and generate the runner registration token.

docker compose up -d gitea

Open http://<vps-ip>:3000 in your browser, complete the setup wizard, then go to Site Administration → Actions → Runners to create a registration token. Note this token — you will need it in the next step.

Start Ollama and download your model. For a code review pipeline, qwen2.5-coder:7b or deepseek-coder:6.7b offer a good quality/resource ratio.

docker compose up -d ollama
# download a code model
docker exec gitea-stack-ollama-1 ollama pull qwen2.5-coder:7b
# verify the API responds on the internal network
docker run --rm --network gitea-stack_ai-net curlimages/curl \
  http://ollama:11434/api/tags

The JSON response lists available models — confirmation that the Ollama API is reachable from within the Docker internal network.

Create a .env file with the token retrieved in step 3, then start the runner.

echo "RUNNER_TOKEN=your_token_here" > .env
docker compose up -d runner
# verify the runner registered successfully
docker compose logs runner | tail -20

Check in Site Administration → Actions → Runners that your runner appears with Active status.

In a Gitea repository, create .gitea/workflows/review.yml. The workflow clones the code, calls Ollama's /api/chat endpoint via curl and posts the result as a pull request comment.

cat > .gitea/workflows/review.yml << 'EOF'
name: AI Code Review
on:
  pull_request:
    types: [opened, synchronize]

jobs:
  review:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Code review via Ollama
        run: |
          DIFF=$(git diff HEAD~1 --unified=5 | head -200)
          curl -s ${OLLAMA_URL:-http://ollama:11434}/api/chat \
            -H 'Content-Type: application/json' \
            -d "{\"model\": \"qwen2.5-coder:7b\", \"stream\": false,
                 \"messages\": [{\"role\": \"user\",
                 \"content\": \"Review this Git diff: $DIFF\"}]}" \
            | jq -r '.message.content'
EOF

Push this file to your Gitea forge — the runner detects it and runs the job on the internal network, without any Internet access.

Place Gitea behind nginx or Caddy with a Let's Encrypt certificate to expose the forge on git.yourdomain.com. Port 3000 should no longer be directly accessible from outside.

# minimal nginx example
cat > /etc/nginx/sites-available/gitea.conf << 'EOF'
server {
    listen 443 ssl;
    server_name git.yourdomain.com;
    ssl_certificate /etc/letsencrypt/live/git.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/git.yourdomain.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}
EOF
nginx -t && systemctl reload nginx

Ollama remains exclusively on the Docker internal network and is never exposed on the Internet.