version: "3"
services:
  server:
    image: gitea/gitea:1
    container_name: gitea
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__mailer__ENABLED=true
      - GITEA__mailer__FROM=git@{{ email_domains.updates }}
      - GITEA__mailer__PROTOCOL=smtps
      - GITEA__mailer__SMTP_ADDR={{ smtp.host }}
      - GITEA__mailer__SMTP_PORT=465
      - GITEA__mailer__USER={{ smtp.username }}
      - GITEA__mailer__PASSWD={{ vault_smtp.password }}
      # Legacy OpenID 2.0 login let anyone register despite DISABLE_REGISTRATION. Logins go through Pocket ID.
      - GITEA__openid__ENABLE_OPENID_SIGNIN=false
      - GITEA__openid__ENABLE_OPENID_SIGNUP=false
    restart: unless-stopped
    labels:
      mag37.dockcheck.update: true
    volumes:
      - gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 222:22
    extra_hosts:
      - '{{ subdomains.pocketid }}:{{ docker.hairpin_ip }}'
      - '{{ subdomains.git }}:{{ docker.hairpin_ip }}'
{% if lava_reserved | default(false) | bool %}
    networks:
      default:
        ipv4_address: {{ docker.gitea_ip }}
{% endif %}
  runner:
    image: gitea/act_runner:nightly
    restart: unless-stopped
    depends_on:
      - server
    environment:
      - CONFIG_FILE=/config.yaml
      - GITEA_INSTANCE_URL=http://gitea:3000
      - GITEA_RUNNER_REGISTRATION_TOKEN={{ vault_infrastructure.gitea_runner_key }}
      - GITEA_RUNNER_NAME=runner_1
      - GITEA_RUNNER_LABELS=docker
    extra_hosts:
      - '{{ subdomains.git }}:{{ docker.hairpin_ip }}'
    labels:
      mag37.dockcheck.update: true
    volumes:
      - ./runner-config.yaml:/config.yaml
      - ./data:/data
      # No Docker socket: jobs run inside this container (label docker:host),
      # and the socket would give every workflow root on the server.
      # Image builds go to the rootless BuildKit below through its socket at
      # /run/buildkit/buildkit/buildkitd.sock.
      - buildkit-run:/run/buildkit
      - {{ paths.stacks }}/caddy/site:/sites
  buildkitd:
    image: moby/buildkit:rootless
    restart: unless-stopped
    # Rootless BuildKit in an unprivileged container (see BuildKit's
    # docs/rootless.md). It listens only on a unix socket shared with the runner.
    command: ["--oci-worker-no-process-sandbox"]
    security_opt:
      - seccomp=unconfined
      - apparmor=unconfined
    extra_hosts:
      - '{{ subdomains.git }}:{{ docker.hairpin_ip }}'
    labels:
      mag37.dockcheck.update: true
    volumes:
      - buildkit-run:/run/user/1000
      - buildkit-cache:/home/user/.local/share/buildkit
volumes:
  gitea:
    driver: local
  buildkit-run:
  buildkit-cache:
networks:
  default:
    external: true
    name: {{ docker.network_name }}