services:
  server:
    image: docker.gitea.com/gitea:1.25.1
    container_name: gitea
    environment:
      - USER_UID=1000
      - USER_GID=1000
      # Database
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=db:5432
      - GITEA__database__USER=gitea
      - GITEA__database__PASSWD=gitea
      - GITEA__database__NAME=gitea
      #Server
      - GITEA__server__ROOT_URL=https://gitea.forust.xyz
      - GITEA__server__SSH_DOMAIN=gitssh.forust.xyz
      - GITEA__server__SSH_PORT=2221
      # Mailer
      - GITEA__mailer__ENABLED=true
      - GITEA__mailer__FROM=${SERVICE_EMAIL}
      - GITEA__mailer__SMTP_ADDR=${MAILER_ADDR}:465
      - GITEA__mailer__USER=${SERVICE_EMAIL}
      - GITEA__mailer__PASSWD=${GITEA_SMTP_PASS}
      - GITEA__mailer__PROTOCOL=SMTP
      - GITEA__service__REGISTER_EMAIL_CONFIRM=true
      - GITEA__service__ENABLE_NOTIFY_MAIL=true
    restart: always
    networks:
      - gitea-db
      - proxy
    volumes:
      - ./gitea-data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=proxy"

      # Prod Router
      - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
      - "traefik.http.routers.gitea.entrypoints=websecure"
      - "traefik.http.routers.gitea.middlewares=security-headers@file"
      - "traefik.http.routers.gitea.service=gitea"
      - "traefik.http.routers.gitea.tls=true"
      - "traefik.http.services.gitea.loadbalancer.server.port=3000"

      # Local Router
      - "traefik.http.routers.gitea-local.rule=Host(`gitea.workstation.internal`) || Host(`gitea.internal`)"
      - "traefik.http.routers.gitea-local.entrypoints=websecure"
      - "traefik.http.routers.gitea-local.middlewares=security-headers@file"
      - "traefik.http.routers.gitea-local.service=gitea"
      - "traefik.http.routers.gitea-local.tls=true"

      # Dev Router
      - "traefik.http.routers.gitea-dev.rule=Host(`gitea.gigaforust.internal`)"
      - "traefik.http.routers.gitea-dev.entrypoints=websecure"
      - "traefik.http.routers.gitea-dev.middlewares=security-headers@file"
      - "traefik.http.routers.gitea-dev.service=gitea"
      - "traefik.http.routers.gitea-dev.tls=true"
      - "traefik.tcp.routers.gitea.entrypoints=ssh"
      - "traefik.tcp.routers.gitea.rule=HostSNI(`*`)"
      - "traefik.tcp.services.gitea.loadbalancer.server.port=22"
    ports:
      - "2221:22"
    depends_on:
      - db

  runner:
    image: gitea/act_runner:0.2.11
    container_name: gitea-runner
    restart: always
    depends_on:
      - server
    env_file:
      - .env
    networks:
      - gitea-db
    environment:
      - GITEA_INSTANCE_URL=http://server:3000
      - GITEA_RUNNER_REGISTRATION_TOKEN=${BASIC-RUNNER_TOKEN}
      - GITEA_RUNNER_NAME=basic-runner
      - GITEA_RUNNER_LABELS=docker:docker://node:20-bookworm,ubuntu-latest:docker://node:20-bookworm
    volumes:
      - ./gitea-runner:/data
      - /var/run/docker.sock:/var/run/docker.sock

  db:
    image: docker.io/library/postgres:14
    restart: always
    environment:
      - POSTGRES_USER=gitea
      - POSTGRES_PASSWORD=gitea
      - POSTGRES_DB=gitea
    networks:
      - gitea-db
    volumes:
      - ./gitea-db/:/var/lib/postgresql/data

networks:
  gitea-db:
    external: false
  proxy:
    external: true