diff --git a/.github/workflows/build.yml b/.gitea/workflows/build.yml
similarity index 83%
rename from .github/workflows/build.yml
rename to .gitea/workflows/build.yml
index 8791783..104ef5e 100644
--- a/.github/workflows/build.yml
+++ b/.gitea/workflows/build.yml
@@ -4,7 +4,6 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
   workflow_dispatch: {}
 
 env:
@@ -12,9 +11,9 @@ env:
   NODE_VERSION: "20.x"
   PYTHON_VERSION: "3.11"
   DOTNET_VERSION: "8.0.x"
-  # The provider's go.mod carries a local `replace` for the upstream Terraform
+  # provider/go.mod carries a local `replace` for the upstream Terraform
   # provider, so it has to sit next to this checkout under this exact name.
-  UPSTREAM_REPO: maxvojtkov/terraform-provider-dokploy
+  UPSTREAM_REPO: usr_unknown/terraform-provider-dokploy
   UPSTREAM_DIR: dokploy-teraform
 
 jobs:
@@ -31,6 +30,7 @@ jobs:
         with:
           repository: ${{ env.UPSTREAM_REPO }}
           path: ${{ env.UPSTREAM_DIR }}
+          token: ${{ secrets.GITEA_TOKEN }}
 
       - uses: actions/setup-go@v5
         with:
@@ -61,6 +61,9 @@ jobs:
         working-directory: pulumi-dokploy
         run: make provider
 
+      # schema.json and bridge-metadata.json are checked in and carry no
+      # version, so they only change when the mapping does. A diff here means
+      # someone edited resources.go without re-running `make tfgen`.
       - name: Fail if the checked-in schema is stale
         working-directory: pulumi-dokploy
         run: git diff --exit-code -- provider/cmd/pulumi-resource-dokploy/schema.json
diff --git a/.gitea/workflows/release.yml b/.gitea/workflows/release.yml
new file mode 100644
index 0000000..5674c7f
--- /dev/null
+++ b/.gitea/workflows/release.yml
@@ -0,0 +1,143 @@
+name: release
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+env:
+  GO_VERSION: "1.25.x"
+  NODE_VERSION: "20.x"
+  PYTHON_VERSION: "3.11"
+  DOTNET_VERSION: "8.0.x"
+  UPSTREAM_REPO: usr_unknown/terraform-provider-dokploy
+  UPSTREAM_DIR: dokploy-teraform
+  # Everything below authenticates with the token Gitea injects into every
+  # run, so releasing needs no configured secrets at all.
+  GITEA_HOST: gitea.coolify.vojtkov.dev
+  GITEA_OWNER: usr_unknown
+
+jobs:
+  # The plugin binaries. Pulumi resolves them from this release via the
+  # PluginDownloadURL baked into the schema, so this has to land before anyone
+  # installs an SDK.
+  plugin:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: pulumi-dokploy
+          fetch-depth: 0
+
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ env.UPSTREAM_REPO }}
+          path: ${{ env.UPSTREAM_DIR }}
+          token: ${{ secrets.GITEA_TOKEN }}
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - uses: goreleaser/goreleaser-action@v6
+        with:
+          version: latest
+          args: release --clean
+          workdir: pulumi-dokploy
+        env:
+          GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
+
+  sdks:
+    needs: plugin
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          path: pulumi-dokploy
+
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ env.UPSTREAM_REPO }}
+          path: ${{ env.UPSTREAM_DIR }}
+          token: ${{ secrets.GITEA_TOKEN }}
+
+      - uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ env.PYTHON_VERSION }}
+
+      - uses: actions/setup-dotnet@v4
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+
+      - name: Derive version from tag
+        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
+
+      - name: Build SDKs
+        working-directory: pulumi-dokploy
+        run: make build_sdks VERSION=${{ env.VERSION }}
+
+      - name: Publish to the Gitea npm registry
+        working-directory: pulumi-dokploy/sdk/nodejs/bin
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          cat > .npmrc <<EOF
+          @maxvojtkov:registry=https://${GITEA_HOST}/api/packages/${GITEA_OWNER}/npm/
+          //${GITEA_HOST}/api/packages/${GITEA_OWNER}/npm/:_authToken=${TOKEN}
+          EOF
+          npm publish
+
+      - name: Publish to the Gitea PyPI registry
+        working-directory: pulumi-dokploy/sdk/python
+        env:
+          TWINE_USERNAME: ${{ env.GITEA_OWNER }}
+          TWINE_PASSWORD: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          python -m pip install --upgrade build twine
+          python -m build
+          python -m twine upload \
+            --repository-url "https://${GITEA_HOST}/api/packages/${GITEA_OWNER}/pypi" \
+            dist/*
+
+      - name: Publish to the Gitea NuGet registry
+        working-directory: pulumi-dokploy/sdk/dotnet
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          dotnet pack --configuration Release --output ./nupkg
+          dotnet nuget push ./nupkg/*.nupkg \
+            --source "https://${GITEA_HOST}/api/packages/${GITEA_OWNER}/nuget/index.json" \
+            --api-key "$TOKEN" --skip-duplicate
+
+      # The Go SDK's module path stays github.com/maxvojtkov/..., which no
+      # amount of Gitea hosting changes. Uploading it to Gitea's Go registry is
+      # what makes that path resolvable anyway: consumers point GOPROXY here.
+      #
+      # A module zip must have every entry prefixed `<module>@<version>/` and
+      # must contain no directory entries at all -- hence `zip -D`, without
+      # which `go get` fails with "has unexpected file".
+      - name: Publish the Go SDK to the Gitea Go registry
+        working-directory: pulumi-dokploy
+        env:
+          TOKEN: ${{ secrets.GITEA_TOKEN }}
+        run: |
+          set -euo pipefail
+          MODULE=github.com/maxvojtkov/pulumi-dokploy/sdk
+          STAGE="$(mktemp -d)"
+          DEST="$STAGE/$MODULE@v${VERSION}"
+          mkdir -p "$DEST"
+          cp sdk/go.mod sdk/go.sum "$DEST/"
+          cp -R sdk/go "$DEST/"
+          (cd "$STAGE" && zip -qrD "$STAGE/sdk.zip" . -x 'sdk.zip')
+          curl -fsSL -X PUT \
+            --user "${GITEA_OWNER}:${TOKEN}" \
+            --upload-file "$STAGE/sdk.zip" \
+            "https://${GITEA_HOST}/api/packages/${GITEA_OWNER}/go/upload"
+          echo "Published $MODULE@v${VERSION}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
deleted file mode 100644
index 4e9716b..0000000
--- a/.github/workflows/release.yml
+++ /dev/null
@@ -1,121 +0,0 @@
-name: release
-
-on:
-  push:
-    tags:
-      - "v*.*.*"
-
-permissions:
-  contents: write
-
-env:
-  GO_VERSION: "1.25.x"
-  NODE_VERSION: "20.x"
-  PYTHON_VERSION: "3.11"
-  DOTNET_VERSION: "8.0.x"
-  UPSTREAM_REPO: maxvojtkov/terraform-provider-dokploy
-  UPSTREAM_DIR: dokploy-teraform
-
-jobs:
-  # Publishes the plugin binaries. Pulumi resolves them from this release via
-  # the provider's `github://api.github.com/maxvojtkov/pulumi-dokploy` URL.
-  plugin:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          path: pulumi-dokploy
-          fetch-depth: 0
-
-      - uses: actions/checkout@v4
-        with:
-          repository: ${{ env.UPSTREAM_REPO }}
-          path: ${{ env.UPSTREAM_DIR }}
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - uses: goreleaser/goreleaser-action@v6
-        with:
-          version: latest
-          args: release --clean
-          workdir: pulumi-dokploy
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  sdks:
-    needs: plugin
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          path: pulumi-dokploy
-
-      - uses: actions/checkout@v4
-        with:
-          repository: ${{ env.UPSTREAM_REPO }}
-          path: ${{ env.UPSTREAM_DIR }}
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: ${{ env.NODE_VERSION }}
-          registry-url: https://registry.npmjs.org
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: ${{ env.PYTHON_VERSION }}
-
-      - uses: actions/setup-dotnet@v4
-        with:
-          dotnet-version: ${{ env.DOTNET_VERSION }}
-
-      - name: Derive version from tag
-        run: echo "VERSION=${GITHUB_REF_NAME#v}" >> "$GITHUB_ENV"
-
-      - name: Build SDKs
-        working-directory: pulumi-dokploy
-        run: make build_sdks VERSION=${{ env.VERSION }}
-
-      - name: Publish to npm
-        working-directory: pulumi-dokploy/sdk/nodejs/bin
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Publish to PyPI
-        working-directory: pulumi-dokploy/sdk/python
-        run: |
-          python -m pip install --upgrade build twine
-          python -m build
-          python -m twine upload dist/*
-        env:
-          TWINE_USERNAME: __token__
-          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
-
-      - name: Publish to NuGet
-        working-directory: pulumi-dokploy/sdk/dotnet
-        run: |
-          dotnet pack --configuration Release --output ./nupkg
-          dotnet nuget push ./nupkg/*.nupkg \
-            --source https://api.nuget.org/v3/index.json \
-            --api-key "$NUGET_PUBLISH_KEY" --skip-duplicate
-        env:
-          NUGET_PUBLISH_KEY: ${{ secrets.NUGET_PUBLISH_KEY }}
-
-      # Go modules are consumed straight from the repository, so the generated
-      # SDK has to be committed and tagged as `sdk/vX.Y.Z`.
-      - name: Commit and tag the Go SDK
-        working-directory: pulumi-dokploy
-        run: |
-          git config user.name  "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-          git add sdk provider/cmd/pulumi-resource-dokploy/schema.json \
-                  provider/cmd/pulumi-resource-dokploy/bridge-metadata.json
-          git diff --cached --quiet || git commit -m "chore: SDKs for v${{ env.VERSION }}"
-          git tag "sdk/v${{ env.VERSION }}"
-          git push origin HEAD:main --tags
diff --git a/.goreleaser.yml b/.goreleaser.yml
index b0c4781..8ee3e91 100644
--- a/.goreleaser.yml
+++ b/.goreleaser.yml
@@ -1,7 +1,12 @@
 # Builds the provider plugin for every platform Pulumi supports and publishes
-# the archives to a GitHub release. The archive names must match what
-# `PluginDownloadURL: github://api.github.com/maxvojtkov/pulumi-dokploy`
-# expects, so do not rename them.
+# the archives to a Gitea release.
+#
+# Pulumi fetches these itself, from the PluginDownloadURL baked into the
+# schema. Given
+#   https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}
+# it appends `pulumi-resource-dokploy-v<version>-<os>-<arch>.tar.gz`, which is
+# exactly what the archive name_template below produces. Rename one and you
+# must rename the other, or `pulumi up` fails with a 404 on plugin install.
 version: 2
 
 project_name: pulumi-dokploy
@@ -44,12 +49,20 @@ snapshot:
   version_template: "{{ .Version }}-SNAPSHOT"
 
 changelog:
-  use: github
+  use: git
+  sort: asc
   filters:
     exclude:
       - "^docs:"
       - "^chore:"
       - "^test:"
 
+gitea_urls:
+  api: https://gitea.coolify.vojtkov.dev/api/v1
+  download: https://gitea.coolify.vojtkov.dev
+
 release:
+  gitea:
+    owner: usr_unknown
+    name: pulumi-dokploy
   prerelease: auto
diff --git a/README.md b/README.md
index 2993e51..816da37 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@ redirects, basic auth, registries, SSH keys, certificates and backup
 destinations.
 
 This is a *bridged* provider. All of the behaviour lives in
-[`terraform-provider-dokploy`](https://github.com/maxvojtkov/terraform-provider-dokploy);
+[`terraform-provider-dokploy`](https://gitea.coolify.vojtkov.dev/usr_unknown/terraform-provider-dokploy);
 [`pulumi-terraform-bridge`](https://github.com/pulumi/pulumi-terraform-bridge)
 turns it into a Pulumi package with typed SDKs for TypeScript, Python, Go and
 .NET. The two providers stay in lockstep — a resource added upstream shows up
@@ -57,23 +57,52 @@ new dokploy.Domain("api", {
 
 ## Installing
 
-The SDKs are published per language; the plugin binary is resolved
-automatically from this repository's GitHub releases.
+The SDKs live in this Gitea instance's package registries, and the plugin
+binary is resolved automatically from this repository's Gitea releases — the
+download URL is baked into the schema, so `pulumi up` fetches it without any
+configuration.
+
+The SDKs do need one-time registry configuration, because none of these
+package managers know about a private host by default.
+
+**TypeScript / JavaScript**
 
 ```bash
-# TypeScript / JavaScript
+npm config set @maxvojtkov:registry \
+  https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/npm/
 npm install @maxvojtkov/pulumi-dokploy
+```
 
-# Python
-pip install pulumi_dokploy
+**Python**
 
-# Go
-go get github.com/maxvojtkov/pulumi-dokploy/sdk/go/dokploy
+```bash
+pip install pulumi_dokploy \
+  --index-url https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/pypi/simple
+```
 
-# .NET
+**.NET**
+
+```bash
+dotnet nuget add source \
+  https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/nuget/index.json \
+  --name gitea-dokploy
 dotnet add package Maxvojtkov.Dokploy
 ```
 
+**Go** — the module path stays `github.com/maxvojtkov/...` even though nothing
+is hosted on GitHub, so point the proxy at Gitea and skip the public checksum
+database for that path:
+
+```bash
+export GOPROXY=https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/go,direct
+export GONOSUMDB='github.com/maxvojtkov/*'
+go get github.com/maxvojtkov/pulumi-dokploy/sdk/go/dokploy
+```
+
+If the registries are private, add credentials the usual way for each tool —
+an `_authToken` in `.npmrc`, `--extra-index-url` with basic auth for pip, and
+`--username`/`--password` on the `dotnet nuget add source`.
+
 Before the first release, build and install it locally instead:
 
 ```bash
@@ -130,7 +159,7 @@ Like the Terraform provider, this one manages *configuration*, not *rollouts*.
 Creating an `Application` writes its definition; it does not build or start
 anything.
 
-[`dokploy-deploy-action`](https://github.com/maxvojtkov/dokploy-deploy-action)
+[`dokploy-deploy-action`](https://gitea.coolify.vojtkov.dev/usr_unknown/dokploy-deploy-action)
 covers the other half on GitHub Actions and Gitea Actions: it triggers a
 deployment, waits for the build, and fails the job when the deployment fails.
 Export the application id from your stack and hand it over.
@@ -140,7 +169,7 @@ export const apiApplicationId = api.id;
 ```
 
 ```yaml
-- uses: maxvojtkov/dokploy-deploy-action@v1
+- uses: https://gitea.coolify.vojtkov.dev/usr_unknown/dokploy-deploy-action@v1
   with:
     host: ${{ secrets.DOKPLOY_HOST }}
     api-key: ${{ secrets.DOKPLOY_API_KEY }}
@@ -163,7 +192,7 @@ Pulumi conventions applied on top:
   instead — see [`examples/typescript/webService.ts`](examples/typescript/webService.ts),
   which is a port of that module.
 
-The [known API quirks](https://github.com/maxvojtkov/terraform-provider-dokploy#known-api-quirks)
+The [known API quirks](https://gitea.coolify.vojtkov.dev/usr_unknown/terraform-provider-dokploy#known-api-quirks)
 documented upstream apply here unchanged, because it is the same code doing the
 work.
 
@@ -200,11 +229,16 @@ replace github.com/maxvojtkov/terraform-provider-dokploy => ../../dokploy-terafo
 ```
 
 so the two repositories can be developed side by side. CI reproduces that
-layout by checking the upstream provider out as a sibling directory. Once
-`terraform-provider-dokploy` is tagged on GitHub, drop the `replace` and pin a
-real version instead:
+layout by checking the upstream provider out as a sibling directory.
+
+The `replace` is load-bearing here, not just a convenience: the module path
+says `github.com`, but the code lives on Gitea, and Go has no way to discover
+that on its own. It can go away once the upstream provider is published to
+Gitea's Go registry, at which point the module resolves through `GOPROXY`:
 
 ```bash
+export GOPROXY=https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/go,direct
+export GONOSUMDB='github.com/maxvojtkov/*'
 cd provider && go mod edit -dropreplace github.com/maxvojtkov/terraform-provider-dokploy \
   && go get github.com/maxvojtkov/terraform-provider-dokploy@v0.1.0
 ```
@@ -221,10 +255,20 @@ Tag the repository and the `release` workflow does the rest:
 git tag v0.1.0 && git push origin v0.1.0
 ```
 
-It publishes plugin binaries to a GitHub release via GoReleaser, pushes the
-npm / PyPI / NuGet packages, and commits and tags the Go SDK as `sdk/v0.1.0`.
-The workflow needs three repository secrets: `NPM_TOKEN`, `PYPI_API_TOKEN` and
-`NUGET_PUBLISH_KEY`.
+GoReleaser publishes the plugin binaries to a Gitea release first — Pulumi
+resolves the plugin from there, so it has to exist before anyone installs an
+SDK — and then the four SDKs go to this instance's npm, PyPI, NuGet and Go
+registries.
+
+**No secrets to configure.** Every step authenticates with `secrets.GITEA_TOKEN`,
+which Gitea injects into each run automatically.
+
+Two things the workflow depends on:
+
+- A registered `act_runner` with an `ubuntu-latest` label, and enough of a
+  toolchain for Go, Node, Python and .NET.
+- The upstream `terraform-provider-dokploy` repository being readable by that
+  token, since the `replace` directive needs it checked out as a sibling.
 
 ## License
 
diff --git a/provider/cmd/pulumi-resource-dokploy/schema.json b/provider/cmd/pulumi-resource-dokploy/schema.json
index 4b299d7..ec93821 100644
--- a/provider/cmd/pulumi-resource-dokploy/schema.json
+++ b/provider/cmd/pulumi-resource-dokploy/schema.json
@@ -11,11 +11,11 @@
         "category/cloud",
         "category/infrastructure"
     ],
-    "homepage": "https://github.com/maxvojtkov/pulumi-dokploy",
+    "homepage": "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy",
     "license": "MPL-2.0",
     "attribution": "This Pulumi package is based on the [`dokploy` Terraform Provider](https://github.com/maxvojtkov/terraform-provider-dokploy).",
-    "repository": "https://github.com/maxvojtkov/pulumi-dokploy",
-    "pluginDownloadURL": "github://api.github.com/maxvojtkov/pulumi-dokploy",
+    "repository": "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy",
+    "pluginDownloadURL": "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
     "publisher": "maxvojtkov",
     "meta": {
         "moduleFormat": "(.*)(?:/[^/]*)"
@@ -38,7 +38,7 @@
         "nodejs": {
             "packageName": "@maxvojtkov/pulumi-dokploy",
             "packageDescription": "A Pulumi package for creating and managing Dokploy resources. Based on terraform-provider-dokploy: version v0.1.0",
-            "readme": "\u003e This provider is a derived work of the [Terraform Provider](https://github.com/maxvojtkov/terraform-provider-dokploy)\n\u003e distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,\n\u003e first check the [`pulumi-dokploy` repo](https://github.com/maxvojtkov/pulumi-dokploy/issues); however, if that doesn't turn up anything,\n\u003e please consult the source [`terraform-provider-dokploy` repo](https://github.com/maxvojtkov/terraform-provider-dokploy/issues).",
+            "readme": "\u003e This provider is a derived work of the [Terraform Provider](https://github.com/maxvojtkov/terraform-provider-dokploy)\n\u003e distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,\n\u003e first check the [`pulumi-dokploy` repo](https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/issues); however, if that doesn't turn up anything,\n\u003e please consult the source [`terraform-provider-dokploy` repo](https://github.com/maxvojtkov/terraform-provider-dokploy/issues).",
             "dependencies": {
                 "@pulumi/pulumi": "^3.0.0"
             },
@@ -55,7 +55,7 @@
             "requires": {
                 "pulumi": "\u003e=3.0.0,\u003c4.0.0"
             },
-            "readme": "\u003e This provider is a derived work of the [Terraform Provider](https://github.com/maxvojtkov/terraform-provider-dokploy)\n\u003e distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,\n\u003e first check the [`pulumi-dokploy` repo](https://github.com/maxvojtkov/pulumi-dokploy/issues); however, if that doesn't turn up anything,\n\u003e please consult the source [`terraform-provider-dokploy` repo](https://github.com/maxvojtkov/terraform-provider-dokploy/issues).",
+            "readme": "\u003e This provider is a derived work of the [Terraform Provider](https://github.com/maxvojtkov/terraform-provider-dokploy)\n\u003e distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,\n\u003e first check the [`pulumi-dokploy` repo](https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/issues); however, if that doesn't turn up anything,\n\u003e please consult the source [`terraform-provider-dokploy` repo](https://github.com/maxvojtkov/terraform-provider-dokploy/issues).",
             "compatibility": "tfbridge20",
             "respectSchemaVersion": true,
             "pyproject": {
diff --git a/provider/resources.go b/provider/resources.go
index ac4c967..cc992af 100644
--- a/provider/resources.go
+++ b/provider/resources.go
@@ -51,14 +51,18 @@ func Provider(version string) tfbridge.ProviderInfo {
 			"category/cloud", "category/infrastructure",
 		},
 		License:    "MPL-2.0",
-		Homepage:   "https://github.com/maxvojtkov/pulumi-dokploy",
-		Repository: "https://github.com/maxvojtkov/pulumi-dokploy",
+		Homepage:   "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy",
+		Repository: "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy",
 		GitHubOrg:  "maxvojtkov",
 		Version:    version,
 
-		// This is not a Pulumi-published provider, so the plugin binary is
-		// resolved from GitHub releases rather than the Pulumi CDN.
-		PluginDownloadURL: "github://api.github.com/maxvojtkov/pulumi-dokploy",
+		// This is not a Pulumi-published provider, so the plugin binary comes
+		// from this repository's Gitea releases rather than the Pulumi CDN.
+		// Pulumi interpolates ${VERSION}, trims the trailing slash, then
+		// appends pulumi-resource-dokploy-v<version>-<os>-<arch>.tar.gz -- so
+		// this has to stay in step with the archive name_template in
+		// .goreleaser.yml.
+		PluginDownloadURL: "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
 
 		TFProviderVersion: version,
 		MetadataInfo:      tfbridge.NewProviderMetadata(bridgeMetadata),
diff --git a/sdk/dotnet/Application.cs b/sdk/dotnet/Application.cs
index de9d978..638df77 100644
--- a/sdk/dotnet/Application.cs
+++ b/sdk/dotnet/Application.cs
@@ -612,7 +612,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "buildSecrets",
diff --git a/sdk/dotnet/Certificate.cs b/sdk/dotnet/Certificate.cs
index 047c99b..3ea3b32 100644
--- a/sdk/dotnet/Certificate.cs
+++ b/sdk/dotnet/Certificate.cs
@@ -72,7 +72,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "privateKey",
diff --git a/sdk/dotnet/Compose.cs b/sdk/dotnet/Compose.cs
index c7ee1b8..44bcd5b 100644
--- a/sdk/dotnet/Compose.cs
+++ b/sdk/dotnet/Compose.cs
@@ -300,7 +300,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
             };
             var merged = CustomResourceOptions.Merge(defaultOptions, options);
             // Override the ID if one was specified for consistency with other language SDKs.
diff --git a/sdk/dotnet/Destination.cs b/sdk/dotnet/Destination.cs
index 47ceaf5..2cd5dc3 100644
--- a/sdk/dotnet/Destination.cs
+++ b/sdk/dotnet/Destination.cs
@@ -96,7 +96,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "secretAccessKey",
diff --git a/sdk/dotnet/Domain.cs b/sdk/dotnet/Domain.cs
index f8189e3..bdad7ae 100644
--- a/sdk/dotnet/Domain.cs
+++ b/sdk/dotnet/Domain.cs
@@ -138,7 +138,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
             };
             var merged = CustomResourceOptions.Merge(defaultOptions, options);
             // Override the ID if one was specified for consistency with other language SDKs.
diff --git a/sdk/dotnet/Environment.cs b/sdk/dotnet/Environment.cs
index 5f8ec89..3654a90 100644
--- a/sdk/dotnet/Environment.cs
+++ b/sdk/dotnet/Environment.cs
@@ -72,7 +72,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
             };
             var merged = CustomResourceOptions.Merge(defaultOptions, options);
             // Override the ID if one was specified for consistency with other language SDKs.
diff --git a/sdk/dotnet/MariaDb.cs b/sdk/dotnet/MariaDb.cs
index f80a62d..6bc2acd 100644
--- a/sdk/dotnet/MariaDb.cs
+++ b/sdk/dotnet/MariaDb.cs
@@ -240,7 +240,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "databasePassword",
diff --git a/sdk/dotnet/Maxvojtkov.Dokploy.csproj b/sdk/dotnet/Maxvojtkov.Dokploy.csproj
index d1202c6..a6a928b 100644
--- a/sdk/dotnet/Maxvojtkov.Dokploy.csproj
+++ b/sdk/dotnet/Maxvojtkov.Dokploy.csproj
@@ -6,8 +6,8 @@
     <Company>maxvojtkov</Company>
     <Description>A Pulumi package for creating and managing Dokploy resources</Description>
     <PackageLicenseExpression>MPL-2.0</PackageLicenseExpression>
-    <PackageProjectUrl>https://github.com/maxvojtkov/pulumi-dokploy</PackageProjectUrl>
-    <RepositoryUrl>https://github.com/maxvojtkov/pulumi-dokploy</RepositoryUrl>
+    <PackageProjectUrl>https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy</PackageProjectUrl>
+    <RepositoryUrl>https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy</RepositoryUrl>
     <PackageIcon>logo.png</PackageIcon>
     <Version>0.1.0</Version>
 
diff --git a/sdk/dotnet/Mongo.cs b/sdk/dotnet/Mongo.cs
index f8f5938..eccd79f 100644
--- a/sdk/dotnet/Mongo.cs
+++ b/sdk/dotnet/Mongo.cs
@@ -234,7 +234,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "databasePassword",
diff --git a/sdk/dotnet/Mount.cs b/sdk/dotnet/Mount.cs
index 9952396..2f5d9b3 100644
--- a/sdk/dotnet/Mount.cs
+++ b/sdk/dotnet/Mount.cs
@@ -84,7 +84,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
             };
             var merged = CustomResourceOptions.Merge(defaultOptions, options);
             // Override the ID if one was specified for consistency with other language SDKs.
diff --git a/sdk/dotnet/MySql.cs b/sdk/dotnet/MySql.cs
index 52e85eb..7f748b0 100644
--- a/sdk/dotnet/MySql.cs
+++ b/sdk/dotnet/MySql.cs
@@ -240,7 +240,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "databasePassword",
diff --git a/sdk/dotnet/Port.cs b/sdk/dotnet/Port.cs
index 5038380..bad4b03 100644
--- a/sdk/dotnet/Port.cs
+++ b/sdk/dotnet/Port.cs
@@ -66,7 +66,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
             };
             var merged = CustomResourceOptions.Merge(defaultOptions, options);
             // Override the ID if one was specified for consistency with other language SDKs.
diff --git a/sdk/dotnet/Postgres.cs b/sdk/dotnet/Postgres.cs
index 5f0330f..db7c25d 100644
--- a/sdk/dotnet/Postgres.cs
+++ b/sdk/dotnet/Postgres.cs
@@ -234,7 +234,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "databasePassword",
diff --git a/sdk/dotnet/Project.cs b/sdk/dotnet/Project.cs
index 62fbb7b..b0385f6 100644
--- a/sdk/dotnet/Project.cs
+++ b/sdk/dotnet/Project.cs
@@ -72,7 +72,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
             };
             var merged = CustomResourceOptions.Merge(defaultOptions, options);
             // Override the ID if one was specified for consistency with other language SDKs.
diff --git a/sdk/dotnet/Provider.cs b/sdk/dotnet/Provider.cs
index 4d80ddc..8976794 100644
--- a/sdk/dotnet/Provider.cs
+++ b/sdk/dotnet/Provider.cs
@@ -49,7 +49,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "apiKey",
diff --git a/sdk/dotnet/README.md b/sdk/dotnet/README.md
index e7dbe6e..816da37 100644
--- a/sdk/dotnet/README.md
+++ b/sdk/dotnet/README.md
@@ -6,7 +6,7 @@ redirects, basic auth, registries, SSH keys, certificates and backup
 destinations.
 
 This is a *bridged* provider. All of the behaviour lives in
-[`terraform-provider-dokploy`](https://github.com/maxvojtkov/terraform-provider-dokploy);
+[`terraform-provider-dokploy`](https://gitea.coolify.vojtkov.dev/usr_unknown/terraform-provider-dokploy);
 [`pulumi-terraform-bridge`](https://github.com/pulumi/pulumi-terraform-bridge)
 turns it into a Pulumi package with typed SDKs for TypeScript, Python, Go and
 .NET. The two providers stay in lockstep — a resource added upstream shows up
@@ -49,6 +49,7 @@ new dokploy.Domain("api", {
 - [Installing](#installing)
 - [Configuration](#configuration)
 - [Resources and data sources](#resources-and-data-sources)
+- [Deploying from CI](#deploying-from-ci)
 - [Differences from the Terraform provider](#differences-from-the-terraform-provider)
 - [Examples](#examples)
 - [Development](#development)
@@ -56,23 +57,52 @@ new dokploy.Domain("api", {
 
 ## Installing
 
-The SDKs are published per language; the plugin binary is resolved
-automatically from this repository's GitHub releases.
+The SDKs live in this Gitea instance's package registries, and the plugin
+binary is resolved automatically from this repository's Gitea releases — the
+download URL is baked into the schema, so `pulumi up` fetches it without any
+configuration.
+
+The SDKs do need one-time registry configuration, because none of these
+package managers know about a private host by default.
+
+**TypeScript / JavaScript**
 
 ```bash
-# TypeScript / JavaScript
+npm config set @maxvojtkov:registry \
+  https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/npm/
 npm install @maxvojtkov/pulumi-dokploy
+```
 
-# Python
-pip install pulumi_dokploy
+**Python**
 
-# Go
-go get github.com/maxvojtkov/pulumi-dokploy/sdk/go/dokploy
+```bash
+pip install pulumi_dokploy \
+  --index-url https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/pypi/simple
+```
 
-# .NET
+**.NET**
+
+```bash
+dotnet nuget add source \
+  https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/nuget/index.json \
+  --name gitea-dokploy
 dotnet add package Maxvojtkov.Dokploy
 ```
 
+**Go** — the module path stays `github.com/maxvojtkov/...` even though nothing
+is hosted on GitHub, so point the proxy at Gitea and skip the public checksum
+database for that path:
+
+```bash
+export GOPROXY=https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/go,direct
+export GONOSUMDB='github.com/maxvojtkov/*'
+go get github.com/maxvojtkov/pulumi-dokploy/sdk/go/dokploy
+```
+
+If the registries are private, add credentials the usual way for each tool —
+an `_authToken` in `.npmrc`, `--extra-index-url` with basic auth for pip, and
+`--username`/`--password` on the `dotnet nuget add source`.
+
 Before the first release, build and install it locally instead:
 
 ```bash
@@ -123,6 +153,30 @@ pulumi config set --secret dokploy:apiKey "$DOKPLOY_API_KEY"
 Data sources: `getProject`, `getProjects`, `getEnvironment`, `getApplication`,
 `getServers`.
 
+## Deploying from CI
+
+Like the Terraform provider, this one manages *configuration*, not *rollouts*.
+Creating an `Application` writes its definition; it does not build or start
+anything.
+
+[`dokploy-deploy-action`](https://gitea.coolify.vojtkov.dev/usr_unknown/dokploy-deploy-action)
+covers the other half on GitHub Actions and Gitea Actions: it triggers a
+deployment, waits for the build, and fails the job when the deployment fails.
+Export the application id from your stack and hand it over.
+
+```ts
+export const apiApplicationId = api.id;
+```
+
+```yaml
+- uses: https://gitea.coolify.vojtkov.dev/usr_unknown/dokploy-deploy-action@v1
+  with:
+    host: ${{ secrets.DOKPLOY_HOST }}
+    api-key: ${{ secrets.DOKPLOY_API_KEY }}
+    application-id: ${{ steps.stack.outputs.apiApplicationId }}
+    docker-image: ghcr.io/acme/api:${{ github.sha }}
+```
+
 ## Differences from the Terraform provider
 
 Everything is a mechanical translation of the Terraform provider, with three
@@ -138,7 +192,7 @@ Pulumi conventions applied on top:
   instead — see [`examples/typescript/webService.ts`](examples/typescript/webService.ts),
   which is a port of that module.
 
-The [known API quirks](https://github.com/maxvojtkov/terraform-provider-dokploy#known-api-quirks)
+The [known API quirks](https://gitea.coolify.vojtkov.dev/usr_unknown/terraform-provider-dokploy#known-api-quirks)
 documented upstream apply here unchanged, because it is the same code doing the
 work.
 
@@ -175,11 +229,16 @@ replace github.com/maxvojtkov/terraform-provider-dokploy => ../../dokploy-terafo
 ```
 
 so the two repositories can be developed side by side. CI reproduces that
-layout by checking the upstream provider out as a sibling directory. Once
-`terraform-provider-dokploy` is tagged on GitHub, drop the `replace` and pin a
-real version instead:
+layout by checking the upstream provider out as a sibling directory.
+
+The `replace` is load-bearing here, not just a convenience: the module path
+says `github.com`, but the code lives on Gitea, and Go has no way to discover
+that on its own. It can go away once the upstream provider is published to
+Gitea's Go registry, at which point the module resolves through `GOPROXY`:
 
 ```bash
+export GOPROXY=https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/go,direct
+export GONOSUMDB='github.com/maxvojtkov/*'
 cd provider && go mod edit -dropreplace github.com/maxvojtkov/terraform-provider-dokploy \
   && go get github.com/maxvojtkov/terraform-provider-dokploy@v0.1.0
 ```
@@ -196,10 +255,20 @@ Tag the repository and the `release` workflow does the rest:
 git tag v0.1.0 && git push origin v0.1.0
 ```
 
-It publishes plugin binaries to a GitHub release via GoReleaser, pushes the
-npm / PyPI / NuGet packages, and commits and tags the Go SDK as `sdk/v0.1.0`.
-The workflow needs three repository secrets: `NPM_TOKEN`, `PYPI_API_TOKEN` and
-`NUGET_PUBLISH_KEY`.
+GoReleaser publishes the plugin binaries to a Gitea release first — Pulumi
+resolves the plugin from there, so it has to exist before anyone installs an
+SDK — and then the four SDKs go to this instance's npm, PyPI, NuGet and Go
+registries.
+
+**No secrets to configure.** Every step authenticates with `secrets.GITEA_TOKEN`,
+which Gitea injects into each run automatically.
+
+Two things the workflow depends on:
+
+- A registered `act_runner` with an `ubuntu-latest` label, and enough of a
+  toolchain for Go, Node, Python and .NET.
+- The upstream `terraform-provider-dokploy` repository being readable by that
+  token, since the `replace` directive needs it checked out as a sibling.
 
 ## License
 
diff --git a/sdk/dotnet/Redirect.cs b/sdk/dotnet/Redirect.cs
index 24588c2..66d6342 100644
--- a/sdk/dotnet/Redirect.cs
+++ b/sdk/dotnet/Redirect.cs
@@ -66,7 +66,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
             };
             var merged = CustomResourceOptions.Merge(defaultOptions, options);
             // Override the ID if one was specified for consistency with other language SDKs.
diff --git a/sdk/dotnet/Redis.cs b/sdk/dotnet/Redis.cs
index ba01305..3edc173 100644
--- a/sdk/dotnet/Redis.cs
+++ b/sdk/dotnet/Redis.cs
@@ -222,7 +222,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "databasePassword",
diff --git a/sdk/dotnet/Registry.cs b/sdk/dotnet/Registry.cs
index 6ffc47a..8cf7291 100644
--- a/sdk/dotnet/Registry.cs
+++ b/sdk/dotnet/Registry.cs
@@ -84,7 +84,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "password",
diff --git a/sdk/dotnet/Security.cs b/sdk/dotnet/Security.cs
index 3e32b39..e4d1e7f 100644
--- a/sdk/dotnet/Security.cs
+++ b/sdk/dotnet/Security.cs
@@ -60,7 +60,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "password",
diff --git a/sdk/dotnet/SshKey.cs b/sdk/dotnet/SshKey.cs
index 2a23544..b9f96c0 100644
--- a/sdk/dotnet/SshKey.cs
+++ b/sdk/dotnet/SshKey.cs
@@ -72,7 +72,7 @@ namespace Maxvojtkov.Dokploy
             var defaultOptions = new CustomResourceOptions
             {
                 Version = Utilities.Version,
-                PluginDownloadURL = "github://api.github.com/maxvojtkov/pulumi-dokploy",
+                PluginDownloadURL = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}",
                 AdditionalSecretOutputs =
                 {
                     "privateKey",
diff --git a/sdk/dotnet/Utilities.cs b/sdk/dotnet/Utilities.cs
index 462db25..cc7fae0 100644
--- a/sdk/dotnet/Utilities.cs
+++ b/sdk/dotnet/Utilities.cs
@@ -53,7 +53,7 @@ namespace Maxvojtkov.Dokploy
         {
             var dst = src ?? new global::Pulumi.InvokeOptions{};
             dst.Version = src?.Version ?? Version;
-            dst.PluginDownloadURL = src?.PluginDownloadURL ?? "github://api.github.com/maxvojtkov/pulumi-dokploy";
+            dst.PluginDownloadURL = src?.PluginDownloadURL ?? "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}";
             return dst;
         }
 
@@ -61,7 +61,7 @@ namespace Maxvojtkov.Dokploy
         {
             var dst = src ?? new global::Pulumi.InvokeOutputOptions{};
             dst.Version = src?.Version ?? Version;
-            dst.PluginDownloadURL = src?.PluginDownloadURL ?? "github://api.github.com/maxvojtkov/pulumi-dokploy";
+            dst.PluginDownloadURL = src?.PluginDownloadURL ?? "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}";
             return dst;
         }
 
diff --git a/sdk/dotnet/pulumi-plugin.json b/sdk/dotnet/pulumi-plugin.json
index 367f36a..599eadc 100644
--- a/sdk/dotnet/pulumi-plugin.json
+++ b/sdk/dotnet/pulumi-plugin.json
@@ -2,5 +2,5 @@
   "resource": true,
   "name": "dokploy",
   "version": "0.1.0",
-  "server": "github://api.github.com/maxvojtkov/pulumi-dokploy"
+  "server": "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}"
 }
diff --git a/sdk/go/dokploy/internal/pulumiUtilities.go b/sdk/go/dokploy/internal/pulumiUtilities.go
index 594e44b..bbacf38 100644
--- a/sdk/go/dokploy/internal/pulumiUtilities.go
+++ b/sdk/go/dokploy/internal/pulumiUtilities.go
@@ -164,7 +164,7 @@ func callPlainInner(
 // PkgResourceDefaultOpts provides package level defaults to pulumi.OptionResource.
 func PkgResourceDefaultOpts(opts []pulumi.ResourceOption) []pulumi.ResourceOption {
 	defaults := []pulumi.ResourceOption{}
-	defaults = append(defaults, pulumi.PluginDownloadURL("github://api.github.com/maxvojtkov/pulumi-dokploy"))
+	defaults = append(defaults, pulumi.PluginDownloadURL("https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}"))
 	version := semver.MustParse("0.1.0")
 	if !version.Equals(semver.Version{}) {
 		defaults = append(defaults, pulumi.Version(version.String()))
@@ -175,7 +175,7 @@ func PkgResourceDefaultOpts(opts []pulumi.ResourceOption) []pulumi.ResourceOptio
 // PkgInvokeDefaultOpts provides package level defaults to pulumi.OptionInvoke.
 func PkgInvokeDefaultOpts(opts []pulumi.InvokeOption) []pulumi.InvokeOption {
 	defaults := []pulumi.InvokeOption{}
-	defaults = append(defaults, pulumi.PluginDownloadURL("github://api.github.com/maxvojtkov/pulumi-dokploy"))
+	defaults = append(defaults, pulumi.PluginDownloadURL("https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}"))
 	version := semver.MustParse("0.1.0")
 	if !version.Equals(semver.Version{}) {
 		defaults = append(defaults, pulumi.Version(version.String()))
diff --git a/sdk/go/dokploy/pulumi-plugin.json b/sdk/go/dokploy/pulumi-plugin.json
index 367f36a..599eadc 100644
--- a/sdk/go/dokploy/pulumi-plugin.json
+++ b/sdk/go/dokploy/pulumi-plugin.json
@@ -2,5 +2,5 @@
   "resource": true,
   "name": "dokploy",
   "version": "0.1.0",
-  "server": "github://api.github.com/maxvojtkov/pulumi-dokploy"
+  "server": "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}"
 }
diff --git a/sdk/nodejs/README.md b/sdk/nodejs/README.md
index c988461..3a1694f 100644
--- a/sdk/nodejs/README.md
+++ b/sdk/nodejs/README.md
@@ -1,4 +1,4 @@
 > This provider is a derived work of the [Terraform Provider](https://github.com/maxvojtkov/terraform-provider-dokploy)
 > distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,
-> first check the [`pulumi-dokploy` repo](https://github.com/maxvojtkov/pulumi-dokploy/issues); however, if that doesn't turn up anything,
+> first check the [`pulumi-dokploy` repo](https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/issues); however, if that doesn't turn up anything,
 > please consult the source [`terraform-provider-dokploy` repo](https://github.com/maxvojtkov/terraform-provider-dokploy/issues).
diff --git a/sdk/nodejs/package.json b/sdk/nodejs/package.json
index 1b31750..92ae5b0 100644
--- a/sdk/nodejs/package.json
+++ b/sdk/nodejs/package.json
@@ -11,8 +11,8 @@
         "category/cloud",
         "category/infrastructure"
     ],
-    "homepage": "https://github.com/maxvojtkov/pulumi-dokploy",
-    "repository": "https://github.com/maxvojtkov/pulumi-dokploy",
+    "homepage": "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy",
+    "repository": "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy",
     "license": "MPL-2.0",
     "scripts": {
         "build": "tsc"
@@ -28,6 +28,6 @@
         "resource": true,
         "name": "dokploy",
         "version": "0.1.0",
-        "server": "github://api.github.com/maxvojtkov/pulumi-dokploy"
+        "server": "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}"
     }
 }
diff --git a/sdk/nodejs/utilities.ts b/sdk/nodejs/utilities.ts
index 1eb5d8a..f323158 100644
--- a/sdk/nodejs/utilities.ts
+++ b/sdk/nodejs/utilities.ts
@@ -53,7 +53,7 @@ export function getVersion(): string {
 
 /** @internal */
 export function resourceOptsDefaults(): any {
-    return { version: getVersion(), pluginDownloadURL: "github://api.github.com/maxvojtkov/pulumi-dokploy" };
+    return { version: getVersion(), pluginDownloadURL: "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}" };
 }
 
 /** @internal */
diff --git a/sdk/python/README.md b/sdk/python/README.md
index e7dbe6e..816da37 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -6,7 +6,7 @@ redirects, basic auth, registries, SSH keys, certificates and backup
 destinations.
 
 This is a *bridged* provider. All of the behaviour lives in
-[`terraform-provider-dokploy`](https://github.com/maxvojtkov/terraform-provider-dokploy);
+[`terraform-provider-dokploy`](https://gitea.coolify.vojtkov.dev/usr_unknown/terraform-provider-dokploy);
 [`pulumi-terraform-bridge`](https://github.com/pulumi/pulumi-terraform-bridge)
 turns it into a Pulumi package with typed SDKs for TypeScript, Python, Go and
 .NET. The two providers stay in lockstep — a resource added upstream shows up
@@ -49,6 +49,7 @@ new dokploy.Domain("api", {
 - [Installing](#installing)
 - [Configuration](#configuration)
 - [Resources and data sources](#resources-and-data-sources)
+- [Deploying from CI](#deploying-from-ci)
 - [Differences from the Terraform provider](#differences-from-the-terraform-provider)
 - [Examples](#examples)
 - [Development](#development)
@@ -56,23 +57,52 @@ new dokploy.Domain("api", {
 
 ## Installing
 
-The SDKs are published per language; the plugin binary is resolved
-automatically from this repository's GitHub releases.
+The SDKs live in this Gitea instance's package registries, and the plugin
+binary is resolved automatically from this repository's Gitea releases — the
+download URL is baked into the schema, so `pulumi up` fetches it without any
+configuration.
+
+The SDKs do need one-time registry configuration, because none of these
+package managers know about a private host by default.
+
+**TypeScript / JavaScript**
 
 ```bash
-# TypeScript / JavaScript
+npm config set @maxvojtkov:registry \
+  https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/npm/
 npm install @maxvojtkov/pulumi-dokploy
+```
 
-# Python
-pip install pulumi_dokploy
+**Python**
 
-# Go
-go get github.com/maxvojtkov/pulumi-dokploy/sdk/go/dokploy
+```bash
+pip install pulumi_dokploy \
+  --index-url https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/pypi/simple
+```
 
-# .NET
+**.NET**
+
+```bash
+dotnet nuget add source \
+  https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/nuget/index.json \
+  --name gitea-dokploy
 dotnet add package Maxvojtkov.Dokploy
 ```
 
+**Go** — the module path stays `github.com/maxvojtkov/...` even though nothing
+is hosted on GitHub, so point the proxy at Gitea and skip the public checksum
+database for that path:
+
+```bash
+export GOPROXY=https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/go,direct
+export GONOSUMDB='github.com/maxvojtkov/*'
+go get github.com/maxvojtkov/pulumi-dokploy/sdk/go/dokploy
+```
+
+If the registries are private, add credentials the usual way for each tool —
+an `_authToken` in `.npmrc`, `--extra-index-url` with basic auth for pip, and
+`--username`/`--password` on the `dotnet nuget add source`.
+
 Before the first release, build and install it locally instead:
 
 ```bash
@@ -123,6 +153,30 @@ pulumi config set --secret dokploy:apiKey "$DOKPLOY_API_KEY"
 Data sources: `getProject`, `getProjects`, `getEnvironment`, `getApplication`,
 `getServers`.
 
+## Deploying from CI
+
+Like the Terraform provider, this one manages *configuration*, not *rollouts*.
+Creating an `Application` writes its definition; it does not build or start
+anything.
+
+[`dokploy-deploy-action`](https://gitea.coolify.vojtkov.dev/usr_unknown/dokploy-deploy-action)
+covers the other half on GitHub Actions and Gitea Actions: it triggers a
+deployment, waits for the build, and fails the job when the deployment fails.
+Export the application id from your stack and hand it over.
+
+```ts
+export const apiApplicationId = api.id;
+```
+
+```yaml
+- uses: https://gitea.coolify.vojtkov.dev/usr_unknown/dokploy-deploy-action@v1
+  with:
+    host: ${{ secrets.DOKPLOY_HOST }}
+    api-key: ${{ secrets.DOKPLOY_API_KEY }}
+    application-id: ${{ steps.stack.outputs.apiApplicationId }}
+    docker-image: ghcr.io/acme/api:${{ github.sha }}
+```
+
 ## Differences from the Terraform provider
 
 Everything is a mechanical translation of the Terraform provider, with three
@@ -138,7 +192,7 @@ Pulumi conventions applied on top:
   instead — see [`examples/typescript/webService.ts`](examples/typescript/webService.ts),
   which is a port of that module.
 
-The [known API quirks](https://github.com/maxvojtkov/terraform-provider-dokploy#known-api-quirks)
+The [known API quirks](https://gitea.coolify.vojtkov.dev/usr_unknown/terraform-provider-dokploy#known-api-quirks)
 documented upstream apply here unchanged, because it is the same code doing the
 work.
 
@@ -175,11 +229,16 @@ replace github.com/maxvojtkov/terraform-provider-dokploy => ../../dokploy-terafo
 ```
 
 so the two repositories can be developed side by side. CI reproduces that
-layout by checking the upstream provider out as a sibling directory. Once
-`terraform-provider-dokploy` is tagged on GitHub, drop the `replace` and pin a
-real version instead:
+layout by checking the upstream provider out as a sibling directory.
+
+The `replace` is load-bearing here, not just a convenience: the module path
+says `github.com`, but the code lives on Gitea, and Go has no way to discover
+that on its own. It can go away once the upstream provider is published to
+Gitea's Go registry, at which point the module resolves through `GOPROXY`:
 
 ```bash
+export GOPROXY=https://gitea.coolify.vojtkov.dev/api/packages/usr_unknown/go,direct
+export GONOSUMDB='github.com/maxvojtkov/*'
 cd provider && go mod edit -dropreplace github.com/maxvojtkov/terraform-provider-dokploy \
   && go get github.com/maxvojtkov/terraform-provider-dokploy@v0.1.0
 ```
@@ -196,10 +255,20 @@ Tag the repository and the `release` workflow does the rest:
 git tag v0.1.0 && git push origin v0.1.0
 ```
 
-It publishes plugin binaries to a GitHub release via GoReleaser, pushes the
-npm / PyPI / NuGet packages, and commits and tags the Go SDK as `sdk/v0.1.0`.
-The workflow needs three repository secrets: `NPM_TOKEN`, `PYPI_API_TOKEN` and
-`NUGET_PUBLISH_KEY`.
+GoReleaser publishes the plugin binaries to a Gitea release first — Pulumi
+resolves the plugin from there, so it has to exist before anyone installs an
+SDK — and then the four SDKs go to this instance's npm, PyPI, NuGet and Go
+registries.
+
+**No secrets to configure.** Every step authenticates with `secrets.GITEA_TOKEN`,
+which Gitea injects into each run automatically.
+
+Two things the workflow depends on:
+
+- A registered `act_runner` with an `ubuntu-latest` label, and enough of a
+  toolchain for Go, Node, Python and .NET.
+- The upstream `terraform-provider-dokploy` repository being readable by that
+  token, since the `replace` directive needs it checked out as a sibling.
 
 ## License
 
diff --git a/sdk/python/pulumi_dokploy/README.md b/sdk/python/pulumi_dokploy/README.md
index 4940984..3691d23 100644
--- a/sdk/python/pulumi_dokploy/README.md
+++ b/sdk/python/pulumi_dokploy/README.md
@@ -1,4 +1,4 @@
 > This provider is a derived work of the [Terraform Provider](https://github.com/maxvojtkov/terraform-provider-dokploy)
 > distributed under [MPL 2.0](https://www.mozilla.org/en-US/MPL/2.0/). If you encounter a bug or missing feature,
-> first check the [`pulumi-dokploy` repo](https://github.com/maxvojtkov/pulumi-dokploy/issues); however, if that doesn't turn up anything,
+> first check the [`pulumi-dokploy` repo](https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/issues); however, if that doesn't turn up anything,
 > please consult the source [`terraform-provider-dokploy` repo](https://github.com/maxvojtkov/terraform-provider-dokploy/issues).
\ No newline at end of file
diff --git a/sdk/python/pulumi_dokploy/_utilities.py b/sdk/python/pulumi_dokploy/_utilities.py
index cd045a0..9976fff 100644
--- a/sdk/python/pulumi_dokploy/_utilities.py
+++ b/sdk/python/pulumi_dokploy/_utilities.py
@@ -322,7 +322,7 @@ def deprecated(message: str) -> typing.Callable[[C], C]:
     return decorator
 
 def get_plugin_download_url():
-	return "github://api.github.com/maxvojtkov/pulumi-dokploy"
+	return "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}"
 
 def get_version():
      return _version_str
diff --git a/sdk/python/pulumi_dokploy/pulumi-plugin.json b/sdk/python/pulumi_dokploy/pulumi-plugin.json
index 367f36a..599eadc 100644
--- a/sdk/python/pulumi_dokploy/pulumi-plugin.json
+++ b/sdk/python/pulumi_dokploy/pulumi-plugin.json
@@ -2,5 +2,5 @@
   "resource": true,
   "name": "dokploy",
   "version": "0.1.0",
-  "server": "github://api.github.com/maxvojtkov/pulumi-dokploy"
+  "server": "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy/releases/download/v${VERSION}"
 }
diff --git a/sdk/python/pyproject.toml b/sdk/python/pyproject.toml
index c4576e3..90cb89b 100644
--- a/sdk/python/pyproject.toml
+++ b/sdk/python/pyproject.toml
@@ -9,8 +9,8 @@
   [project.license]
     text = "MPL-2.0"
   [project.urls]
-    Homepage = "https://github.com/maxvojtkov/pulumi-dokploy"
-    Repository = "https://github.com/maxvojtkov/pulumi-dokploy"
+    Homepage = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy"
+    Repository = "https://gitea.coolify.vojtkov.dev/usr_unknown/pulumi-dokploy"
 
 [build-system]
   requires = ["setuptools>=61.0"]