name: hopweb

services:
  postgres:
    image: postgres:17.6-alpine
    environment:
      POSTGRES_DB: gitea
      POSTGRES_USER: hopweb
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?copy .env.example to .env first}
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U hopweb -d gitea"]
      interval: 3s
      timeout: 3s
      retries: 20
    volumes:
      - postgres-data:/var/lib/postgresql/data
      - ./deploy/postgres/init:/docker-entrypoint-initdb.d:ro
    networks: [hopweb]

  gitea:
    image: docker.gitea.com/gitea:1.26.4
    depends_on:
      postgres:
        condition: service_healthy
    environment:
      USER_UID: "1000"
      USER_GID: "1000"
      GITEA__database__DB_TYPE: postgres
      GITEA__database__HOST: postgres:5432
      GITEA__database__NAME: gitea
      GITEA__database__USER: hopweb
      GITEA__database__PASSWD: ${POSTGRES_PASSWORD}
      GITEA__server__DOMAIN: ${GITEA_DOMAIN:-localhost}
      GITEA__server__ROOT_URL: ${GITEA_ROOT_URL:-http://localhost:3000/}
      GITEA__server__SSH_DOMAIN: ${GITEA_SSH_DOMAIN:-localhost}
      GITEA__server__SSH_PORT: ${GITEA_SSH_PORT:-2222}
      GITEA__server__DISABLE_SSH: ${GITEA_DISABLE_SSH:-false}
      GITEA__service__DISABLE_REGISTRATION: ${GITEA_DISABLE_REGISTRATION:-false}
      GITEA__actions__ENABLED: ${GITEA_ACTIONS_ENABLED:-true}
      GITEA__security__INSTALL_LOCK: "true"
      GITEA__webhook__ALLOWED_HOST_LIST: control-plane
    ports:
      - "${GITEA_HTTP_BIND:-0.0.0.0}:${GITEA_HTTP_PORT:-3000}:3000"
      - "${GITEA_SSH_BIND:-0.0.0.0}:${GITEA_SSH_PORT:-2222}:22"
    volumes:
      - gitea-data:/data
    networks: [hopweb]

  actions-runner:
    image: docker.io/gitea/act_runner:latest-dind
    depends_on:
      gitea:
        condition: service_started
    environment:
      GITEA_INSTANCE_URL: http://gitea:3000
      GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN:-}
      GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME:-cyphers-public}
      GITEA_RUNNER_LABELS: ${GITEA_RUNNER_LABELS:-ubuntu-latest:docker://gitea/runner-images:ubuntu-latest,ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04}
      CONFIG_FILE: /data/config.yaml
    cpus: "2.0"
    mem_limit: 4g
    pids_limit: 1024
    # Required by Docker-in-Docker. Workflow jobs run
    # inside that daemon and never receive the host's Docker socket.
    privileged: true
    volumes:
      - actions-runner-data:/data
    networks: [hopweb]

  control-plane:
    build:
      context: ./services/control-plane
    depends_on:
      postgres:
        condition: service_healthy
      gitea:
        condition: service_started
    environment:
      HOP_HTTP_ADDR: :8080
      HOP_DATABASE_URL: postgres://hopweb:${POSTGRES_PASSWORD}@postgres:5432/hop?sslmode=disable
      HOP_ADMIN_TOKEN: ${HOP_ADMIN_TOKEN:?set HOP_ADMIN_TOKEN in .env}
      HOP_GITEA_WEBHOOK_SECRET: ${HOP_GITEA_WEBHOOK_SECRET:?set HOP_GITEA_WEBHOOK_SECRET in .env}
      GITEA_BASE_URL: http://gitea:3000
      GITEA_API_TOKEN: ${GITEA_API_TOKEN:-}
    ports:
      - "${HOP_HTTP_BIND:-0.0.0.0}:${HOP_HTTP_PORT:-8080}:8080"
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://localhost:8080/readyz"]
      interval: 5s
      timeout: 3s
      retries: 20
    networks: [hopweb]

networks:
  hopweb:

volumes:
  actions-runner-data:
  gitea-data:
  postgres-data: