diff --git a/lotus-land-story/gitea.yml b/lotus-land-story/gitea.yml
new file mode 100644
index 0000000..ce347f7
--- /dev/null
+++ b/lotus-land-story/gitea.yml
@@ -0,0 +1,71 @@
+# https://docs.gitea.com/installation/install-with-docker#sshing-shim-with-authorized_keys
+
+- name: Set up Gitea
+  hosts: lotus-land-story
+  vars_files:
+    - vars.yml
+  vars:
+    version: 1.23.1
+  tasks:
+
+    - name: Create git user
+      ansible.builtin.user:
+        name: git
+        create_home: true
+      register: git_user
+
+    - name: Create ssh key
+      community.crypto.openssh_keypair:
+        path: "{{ git_user.home }}/.ssh/id_ecdsa"
+        type: ecdsa
+        owner: "{{ git_user.name }}"
+        group: "{{ git_user.group }}"
+      register: ssh_key
+
+    - name: Set authorized key
+      ansible.posix.authorized_key:
+        user: "{{ git_user.name }}"
+        state: present
+        key: "{{ ssh_key.public_key }}"
+
+    - name: Make /usr/local/bin/gitea
+      ansible.builtin.copy:
+        dest: /usr/local/bin/gitea
+        content: |
+          #!/bin/sh
+          ssh -p 2222 -o StrictHostKeyChecking=no git@127.0.0.1 "SSH_ORIGINAL_COMMAND=\"$SSH_ORIGINAL_COMMAND\" $0 $@"
+        mode: "0755"
+
+    - name: Make /mnt/lotus-land-story/gitea
+      ansible.builtin.file:
+        path: /mnt/lotus-land-story/gitea
+        state: directory
+        mode: "0755"
+        owner: "{{ git_user.uid }}"
+        group: "{{ git_user.group }}"
+
+    - name: Run Gitea
+      community.docker.docker_container:
+        name: gitea
+        image: docker.io/gitea/gitea:{{ version }}
+        restart: true
+        env:
+          USER_UID: "{{ git_user.uid }}"
+          USER_GID: "{{ git_user.group }}"
+          GITEA__mailer__PASSWD: "{{ gitea.mailer_password }}"
+        volumes:
+          - /mnt/lotus-land-story/gitea:/data
+          - /etc/timezone:/etc/timezone:ro
+          - /etc/localtime:/etc/localtime:ro
+          - /home/git/.ssh/:/data/git/.ssh
+        ports:
+          - "2222:22"
+        restart_policy: unless-stopped
+        networks:
+          - name: lotus_land_story
+
+  handlers:
+    - name: Import restarts
+      ansible.builtin.import_tasks: restarts.yml
+
+# vim: ft=yaml.ansible
diff --git a/lotus-land-story/main.yml b/lotus-land-story/main.yml
index 78da324..9833b81 100644
--- a/lotus-land-story/main.yml
+++ b/lotus-land-story/main.yml
@@ -106,6 +106,8 @@
 
 - name: Set up ufw
   hosts: lotus-land-story
+  tags:
+    - ufw
   tasks:
 
     - name: Get docker network for ufw
@@ -119,6 +121,12 @@
         from_ip: "{{ docker_network.network.IPAM.Config[0].Subnet }}"
       notify: Reload ufw
 
+    - name: Allow SSH access
+      community.general.ufw:
+        rule: allow
+        name: OpenSSH
+      notify: Reload ufw
+
   handlers:
     - name: Import restarts
       ansible.builtin.import_tasks: restarts.yml
diff --git a/lotus-land-story/templates/Caddyfile b/lotus-land-story/templates/Caddyfile
index dda8486..f346d95 100644
--- a/lotus-land-story/templates/Caddyfile
+++ b/lotus-land-story/templates/Caddyfile
@@ -133,6 +133,10 @@ docs {
 
 ### External
 
+git.kejadlen.dev
+	reverse_proxy gitea:3000
+}
+
 hey.kejadlen.dev
 	reverse_proxy gotosocial:8080
 
diff --git a/lotus-land-story/templates/authelia_configuration.yml b/lotus-land-story/templates/authelia_configuration.yml
index 227d252..eb309fd 100644
--- a/lotus-land-story/templates/authelia_configuration.yml
+++ b/lotus-land-story/templates/authelia_configuration.yml
@@ -60,18 +60,6 @@ identity_providers:
     clients:
       # https://www.authelia.com/reference/guides/generating-secure-values/#generating-a-random-password-hash
 
-      - client_id: grafana
-        client_name: Grafana
-        client_secret: $argon2id$v=19$m=65536,t=3,p=4$bHcAAorVdHuZzuz53WfAQA$x+pIDTo6SsGyY9JD4OZ7dT6pkEcPf8Yh6Yb7DXco8aQ
-        public: false
-        redirect_uris:
-          - https://grafana.{{ domain }}/login/generic_oauth
-        scopes:
-          - openid
-          - profile
-          - groups
-          - email
-
       - client_id: tailscale
         client_name: Tailscale
         client_secret: $argon2id$v=19$m=65536,t=3,p=4$RivlSdV1WE/NLfd3Pzrubw$ljSvHj9sb0byolv7fk5G3nL415nS7Ze2RMASwPgfBX0