diff --git a/SETUP.md b/SETUP.md
index bd1c16e..14f3540 100644
--- a/SETUP.md
+++ b/SETUP.md
@@ -654,6 +654,42 @@ sudo docker run -d --name <name> --restart=always \
 ```
 Then wire it into Apache per §4's pattern.
 
+### Gitea
+
+```bash
+sudo mkdir -p /srv/gitea/data
+# pick a uid/gid that doesn't collide with an existing host account -
+# check with `getent passwd <uid>` first (e.g. this host's vmail user
+# is already 1000:1000, so 1010:1010 was used instead)
+sudo chown 1010:1010 /srv/gitea/data
+
+sudo docker run -d --name gitea --restart=always \
+  -v /srv/gitea/data:/data \
+  -p 127.0.0.1:8083:3000 \
+  -e USER_UID=1010 -e USER_GID=1010 \
+  -e TZ=Europe/Berlin \
+  gitea/gitea:<pin an exact version, not :latest>
+```
+First run creates `/data/gitea/conf/app.ini` (or bring in an existing one,
+e.g. when migrating from elsewhere — see `README.md`'s "Gitea" section for
+how this host's instance was migrated from `vlda-01`). Key settings if
+setting up fresh via the web installer, or to check/fix after migrating
+an existing `app.ini`:
+```ini
+[server]
+DOMAIN = git.jayfield.org
+SSH_DOMAIN = git.jayfield.org
+ROOT_URL = https://git.jayfield.org/
+DISABLE_SSH = true   ; HTTPS-only, avoids exposing a second public port
+                      ; for a protocol nothing here actually uses
+```
+Set the DNS `A` record and Apache vhost per §2/§4 before running
+`certbot --apache -d git.jayfield.org`. **Also add
+`RequestHeader set X-Forwarded-Proto "https"` to the `:443` vhost** (same
+as Nextcloud below) — without it, Gitea can't tell the Apache→container
+hop was originally HTTPS and generates `http://` clone URLs even though
+`ROOT_URL` says otherwise.
+
 ### Nextcloud (data-hosting-focused, minimal — core Files app only)
 
 ```bash