diff --git a/aws_cdk/lib/aws_cdk-stack.ts b/aws_cdk/lib/aws_cdk-stack.ts
index 2dcfc99..e1f7d9b 100644
--- a/aws_cdk/lib/aws_cdk-stack.ts
+++ b/aws_cdk/lib/aws_cdk-stack.ts
@@ -31,8 +31,12 @@ export class AwsCdkStack extends cdk.Stack {
     securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.udp(5010), 'Allow WireGuard VPN');
     securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(51821), 'Allow WireGuard Web UI');
 
-    // Woodpecker CI
-    securityGroup.addIngressRule(ec2.Peer.ipv4('16.113.57.0/24'), ec2.Port.tcp(8000), 'Allow Woodpecker Web UI');
+    // Woodpecker CI (Port 8000 open to public; Nginx on EC2 handles path-based security)
+    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(8000), 'Allow Woodpecker Reverse Proxy');
+
+    // Forgejo Git Service (Port 3000 open to public)
+    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(3000), 'Allow Forgejo Web UI');
+    securityGroup.addIngressRule(ec2.Peer.anyIpv4(), ec2.Port.tcp(2222), 'Allow Forgejo SSH');
 
     // Django App Backends (Prod and Beta)
     securityGroup.addIngressRule(ec2.Peer.ipv4('16.113.57.0/24'), ec2.Port.tcp(8080), 'Allow Django Beta Backend');
diff --git a/forgejo/.env.example b/forgejo/.env.example
new file mode 100644
index 0000000..6bfa34d
--- /dev/null
+++ b/forgejo/.env.example
@@ -0,0 +1,8 @@
+# External URL for accessing your Forgejo instance (e.g. http://16.113.57.127:3000)
+FORGEJO_ROOT_URL=http://localhost:3000/
+
+# MySQL Database connection parameters
+FORGEJO_DB_HOST=your_mysql_host:3306
+FORGEJO_DB_NAME=your_mysql_db_name
+FORGEJO_DB_USER=your_mysql_user
+FORGEJO_DB_PASSWORD=your_mysql_password
diff --git a/forgejo/Dockerfile b/forgejo/Dockerfile
new file mode 100644
index 0000000..e23e66b
--- /dev/null
+++ b/forgejo/Dockerfile
@@ -0,0 +1,8 @@
+# Use the official Forgejo base image
+FROM codeberg.org/forgejo/forgejo:9
+
+# Expose the default HTTP port and SSH port
+EXPOSE 3000 22
+
+# Define volume for persistent data
+VOLUME ["/data"]
diff --git a/forgejo/docker-compose.yml b/forgejo/docker-compose.yml
new file mode 100644
index 0000000..32cf1d1
--- /dev/null
+++ b/forgejo/docker-compose.yml
@@ -0,0 +1,32 @@
+services:
+  forgejo:
+    image: codeberg.org/forgejo/forgejo:9
+    container_name: forgejo
+    restart: always
+    environment:
+      # General Server Settings
+      - FORGEJO__server__RUN_MODE=prod
+      - FORGEJO__server__ROOT_URL=${FORGEJO_ROOT_URL:-http://16.113.57.127:3000/}
+      - FORGEJO__server__HTTP_PORT=3000
+      - FORGEJO__server__DOMAIN=16.113.57.127
+      
+      # Database Configuration (MySQL/MariaDB connection)
+      - FORGEJO__database__DB_TYPE=mysql
+      - FORGEJO__database__HOST=${FORGEJO_DB_HOST}
+      - FORGEJO__database__NAME=${FORGEJO_DB_NAME}
+      - FORGEJO__database__USER=${FORGEJO_DB_USER}
+      - FORGEJO__database__PASSWD=${FORGEJO_DB_PASSWORD}
+      
+      # Disable installer screen since we configure via environment/app.ini
+      - FORGEJO__security__INSTALL_LOCK=true
+    ports:
+      # Expose Forgejo HTTP port publicly
+      - "3000:3000"
+      # Expose SSH port
+      - "2222:22"
+    volumes:
+      - forgejo-data:/data
+
+volumes:
+  forgejo-data:
+    driver: local
diff --git a/woodpecker/docker-compose.yml b/woodpecker/docker-compose.yml
new file mode 100644
index 0000000..7860129
--- /dev/null
+++ b/woodpecker/docker-compose.yml
@@ -0,0 +1,56 @@
+version: '3.8'
+
+services:
+  woodpecker-server:
+    image: woodpeckerci/woodpecker-server:v3
+    container_name: woodpecker-server
+    user: "0:0"
+    restart: always
+    ports:
+      # Bind only to localhost (127.0.0.1) on port 8001 so it's not publicly accessible directly
+      - "127.0.0.1:8001:8000"
+    environment:
+      # The public address of your Woodpecker CI instance (e.g. http://16.113.57.127:8000)
+      - WOODPECKER_HOST=http://16.113.57.127:8000
+      
+      # Disable open registration (requires users to be explicitly allowed)
+      - WOODPECKER_OPEN=false                      
+      
+      # Initial administrator account (e.g. your GitHub username)
+      - WOODPECKER_ADMIN=tripro-lab       
+      
+      # Restrict login to members of these GitHub organizations/users (comma-separated list)
+      - WOODPECKER_ORGS=tripro-lab 
+      
+      # Shared secret between server and agent (Generate one using: openssl rand -hex 32)
+      - WOODPECKER_AGENT_SECRET=ba33ff589a3b7f36ebb4b8c30eab29573d038adb2c64f3dab3ed5ae384d7f70e
+      
+      # GitHub OAuth Configuration (Create app in Github -> Developer Settings -> OAuth Apps)
+      - WOODPECKER_GITHUB=true
+      - WOODPECKER_GITHUB_CLIENT=Ov23liXzCGU0K7rytPN2
+      - WOODPECKER_GITHUB_SECRET=b915489c7ed2e149517b712f969f386bd2e8b2b4
+
+      # Database Configuration (MySQL Option B)
+      - WOODPECKER_DATABASE_DRIVER=mysql
+      - WOODPECKER_DATABASE_DATASOURCE=your_mysql_user:your_mysql_password@tcp(your_mysql_host:3306)/your_mysql_db_name?parseTime=true
+    volumes:
+      - woodpecker-server-data:/var/lib/woodpecker
+
+  woodpecker-agent:
+    image: woodpeckerci/woodpecker-agent:v3
+    container_name: woodpecker-agent
+    restart: always
+    depends_on:
+      - woodpecker-server
+    environment:
+      - WOODPECKER_SERVER=woodpecker-server:9000
+      # Must match the exact same secret defined in woodpecker-server above
+      - WOODPECKER_AGENT_SECRET=ba33ff589a3b7f36ebb4b8c30eab29573d038adb2c64f3dab3ed5ae384d7f70e
+      # Let the agent run Docker builds
+      - WOODPECKER_BACKEND=docker
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+
+volumes:
+  woodpecker-server-data:
+    driver: local