#### NETWORKS
networks:
  docker-traefik_front_network:
    external: true
  back_network:
    driver: bridge
    attachable: true
    external: false

#### SERVICES
services:
  gitea:
    container_name: gitea-app
    hostname: gitea-app
    image: ${GITEA_IMAGE_TAG}
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=postgres:5432
      - GITEA__database__NAME=${POSTGRE_DB_NAME}
      - GITEA__database__USER=${POSTGRE_DB_USER}
      - GITEA__database__PASSWD=${POSTGRE_DB_PASSWORD}
      - GITEA__database__LOG_SQL=true
      - GITEA__database__SCHEMA=public
      - GITEA__database__SSL_MODE=disable
      - GITEA__mailer__ENABLED=true
      - GITEA__mailer__FROM=gitea@tips-of-mine.fr
      - GITEA__mailer__PROTOCOL=smtps
      - GITEA__mailer__SMTP_ADDR=relaissmtp.tips-of-mine.fr
      - GITEA__mailer__SMTP_PORT=25
      - GITEA__mailer__USER=
      - GITEA__mailer__PASSWD=
      - GITEA__admin__USER=${GITEA_ADMIN_USERNAME}
      - GITEA__admin__PASSWORD=${GITEA_ADMIN_PASSWORD}
      - GITEA__admin__EMAIL=${GITEA_ADMIN_EMAIL}
      - GITEA__server__DOMAIN=${GITEA_HOSTNAME}
      - GITEA__server__SSH_DOMAIN=${GITEA_HOSTNAME}
      - GITEA__server__ROOT_URL=${GITEA_URL}
      - GITEA__server__HTTP_PORT=${GITEA_HTTP_PORT}
      - GITEA__server__SSH_PORT=${GITEA_SHELL_SSH_PORT}
      - GITEA__server__SSH_LISTEN_PORT=22
      - GITEA__actions__ENABLED=true
      - GITEA__metrics__ENABLED=true
      - GITEA__metrics__ENABLED_ISSUE_BY_REPOSITORY=true
      - GITEA__metrics__ENABLED_ISSUE_BY_LABEL=true
      - GITEA__service__DISABLE_REGISTRATION=false
      - GITEA__service__REQUIRE_SIGNIN_VIEW=true
      - GITEA__service__REGISTER_EMAIL_CONFIRM=true
      - GITEA__service__ENABLE_NOTIFY_MAIL=true
      - GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=false
      - GITEA__service__ENABLE_CAPTCHA=true
      - GITEA__service__DEFAULT_KEEP_EMAIL_PRIVATE=false
      - GITEA__service__DEFAULT_ALLOW_CREATE_ORGANIZATION=true
      - GITEA__service__DEFAULT_ENABLE_TIMETRACKING=true
      - GITEA__service__NO_REPLY_ADDRESS=${GITEA_NOREPLY_EMAIL}
      - GITEA__repository__ENABLE_PUSH_CREATE_USER=true
      - GITEA__repository__ENABLE_PUSH_CREATE_ORG=true
      - GITEA__RUN_MODE=prod
      - GITEA__APP_NAME=Gitea for me
    restart: always
    networks:
      - back_network
      - docker-traefik_front_network
    volumes:
      - ./gitea:/data:rw
      - ./custom:/app/gitea/custom:rw
      - ./log:/app/gitea/log:rw
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "3080:3000"
      - "222:22"
    depends_on:
      postgres:
        condition: service_healthy
        restart: true
    healthcheck:
      test: ["CMD", "curl", "-f", "http://gitea.traefik.me/"]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 90s
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=traefik_front_network"
# HTTP
      - "traefik.http.routers.gitea-http.entrypoints=http"
      - "traefik.http.routers.gitea-http.rule=Host(`gitea.traefik.me`)"
      - "traefik.http.routers.gitea-http.priority=39"
# HTTPS
      - "traefik.http.routers.gitea-https.entrypoints=https"
      - "traefik.http.routers.gitea-https.rule=Host(`gitea.traefik.me`)"
      - "traefik.http.routers.gitea-https.tls=true"
#      - "traefik.http.routers.gitea-https.tls.certresolver=myresolver"
      - "traefik.http.routers.gitea-https.service=gitea-service"
      - "traefik.http.routers.gitea-https.priority=40"
# TCP
      - "traefik.tcp.routers.gitea-ssh.entrypoints=ssh"
      - "traefik.tcp.routers.gitea-ssh.rule=HostSNI(`gitea.traefik.me`)"
      - "traefik.tcp.routers.gitea-ssh.service=gitea-ssh-service"
      - "traefik.tcp.routers.gitea-ssh.tls=true"
#      - "traefik.tcp.routers.gitea-ssh.tls.certresolver=myresolver"
# Middleware
# Service
      - "traefik.http.services.gitea-service.loadbalancer.server.port=3000"
      - "traefik.http.services.gitea-https-service.loadbalancer.server.scheme=https"
#      - "traefik.http.services.gitea-https.loadbalancer.passhostheader=true"
#      - "traefik.http.services.gitea-https.loadbalancer.healthcheck.path=/foo"
      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.hostname=gitea.traefik.me"
      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.interval=30"
      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.method=foobar"
#      - "traefik.http.services.gitea-https.loadbalancer.healthcheck.status=42"
#      - "traefik.http.services.gitea-https.loadbalancer.healthcheck.port=42"
#      - "traefik.http.services.gitea-https.loadbalancer.healthcheck.scheme=http"
      - "traefik.http.services.gitea-https-service.loadbalancer.healthcheck.timeout=10"
      - "traefik.tcp.services.gitea-ssh-service.loadbalancer.server.port=22"
#      - "traefik.tcp.services.gitea-ssh.loadbalancer.server.tls=true"
#      - "traefik.tcp.services.gitea-ssh.loadbalancer.proxyprotocol.version=1"

### postgres
  postgres:
    container_name: gitea-postgres
    hostname: gitea-postgres
    image: ${POSTGRES_IMAGE_TAG}
    environment:
      PGDATA: ${POSTGRE_DB_DATA}
      POSTGRES_DB: ${POSTGRE_DB_NAME}
      POSTGRES_PASSWORD: ${POSTGRE_DB_PASSWORD}
      POSTGRES_USER: ${POSTGRE_DB_USER}
      TZ: Europe/Paris
    restart: unless-stopped
    networks:
      - back_network
    volumes:
      - ./data:/var/lib/postgresql/data:rw
    healthcheck:
      test: [ "CMD", "pg_isready", "-q", "-d", "${POSTGRE_DB_NAME}", "-U", "${POSTGRE_DB_USER}" ]
      interval: 10s
      timeout: 5s
      retries: 3
      start_period: 60s

### adminer
  adminer:
    container_name: gitea-adminer
    hostname: gitea-adminer
    image: ${ADMINER_IMAGE_TAG}
    restart: always
    networks:
    - back_network
    - docker-traefik_front_network
    depends_on:
      postgres:
        condition: service_healthy
        restart: true
    labels:
      - "traefik.enable=true"
      - "traefik.docker.network=docker-traefik_front_network"
# HTTP
      - "traefik.http.routers.adminer-http.entrypoints=http"
      - "traefik.http.routers.adminer-http.rule=Host(`gitea-adminer.traefik.me`)"
      - "traefik.http.routers.adminer-http.priority=41"
# HTTPS
      - "traefik.http.routers.adminer-https.entrypoints=https"
      - "traefik.http.routers.adminer-https.rule=Host(`gitea-adminer.traefik.me`)"
      - "traefik.http.routers.adminer-https.tls=true"
#      - "traefik.http.routers.adminer-https.tls.certresolver=myresolver"
      - "traefik.http.routers.adminer-https.service=adminer-service"
      - "traefik.http.routers.adminer-https.priority=42"
# TCP
# Middleware
# Service
      - "traefik.http.services.adminer-service.loadbalancer.server.port=80800"
      - "traefik.http.services.adminer-https-service.loadbalancer.server.scheme=https"
#      - "traefik.http.services.adminer-https.loadbalancer.passhostheader=true"
#      - "traefik.http.services.adminer-https.loadbalancer.healthcheck.path=/foo"
      - "traefik.http.services.adminer-https-service.loadbalancer.healthcheck.hostname=gitea-adminer.traefik.me"
      - "traefik.http.services.adminer-https-service.loadbalancer.healthcheck.interval=30"
      - "traefik.http.services.adminer-https-service.loadbalancer.healthcheck.method=foobar"
#      - "traefik.http.services.adminer-https.loadbalancer.healthcheck.status=42"
#      - "traefik.http.services.adminer-https.loadbalancer.healthcheck.port=42"
#      - "traefik.http.services.adminer-https.loadbalancer.healthcheck.scheme=http"
      - "traefik.http.services.adminer-https-service.loadbalancer.healthcheck.timeout=10"

### backups
  backups:
    container_name: gitea-postgres-backup
    hostname: gitea-postgres-backup
    image: ${POSTGRES_IMAGE_TAG}
    command: >-
      sh -c 'sleep $BACKUP_INIT_SLEEP &&
      while true; do
        pg_dump -h postgres -p 5432 -d $POSTGRE_DB_NAME -U $POSTGRE_DB_USER | gzip > $POSTGRES_BACKUPS_PATH/$POSTGRES_BACKUP_NAME-$(date "+%Y-%m-%d_%H-%M").gz &&
        tar -zcpf $DATA_BACKUPS_PATH/$DATA_BACKUP_NAME-$(date "+%Y-%m-%d_%H-%M").tar.gz $DATA_PATH &&
        find $POSTGRES_BACKUPS_PATH -type f -mtime +$POSTGRES_BACKUP_PRUNE_DAYS | xargs rm -f &&
        find $DATA_BACKUPS_PATH -type f -mtime +$DATA_BACKUP_PRUNE_DAYS | xargs rm -f;
        sleep $BACKUP_INTERVAL; done'
    environment:
      GITEA_DB_NAME: ${POSTGRE_DB_NAME}
      GITEA_DB_USER: ${POSTGRE_DB_USER}
      PGPASSWORD: ${POSTGRE_DB_PASSWORD}
      BACKUP_INIT_SLEEP: ${BACKUP_INIT_SLEEP}
      BACKUP_INTERVAL: ${BACKUP_INTERVAL}
      POSTGRES_BACKUP_PRUNE_DAYS: ${POSTGRES_BACKUP_PRUNE_DAYS}
      DATA_BACKUP_PRUNE_DAYS: ${DATA_BACKUP_PRUNE_DAYS}
      POSTGRES_BACKUPS_PATH: ${POSTGRES_BACKUPS_PATH}
      DATA_BACKUPS_PATH: ${DATA_BACKUPS_PATH}
      DATA_PATH: ${DATA_PATH}
      POSTGRES_BACKUP_NAME: ${POSTGRES_BACKUP_NAME}
      DATA_BACKUP_NAME: ${DATA_BACKUP_NAME}
    restart: unless-stopped
    networks:
      - back_network
    volumes:
      - ./backup/data:/var/lib/postgresql/data
      - ./backup/gitea:${DATA_PATH}
      - ./backup/backups:${DATA_BACKUPS_PATH}
      - ./backup/database:${POSTGRES_BACKUPS_PATH}
    depends_on:
      postgres:
        condition: service_healthy
        restart: true

### runner
  runner:
    container_name: gitea-runner
    hostname: gitea-runner
    image: ${GITEA_RUNNER_IMAGE_TAG}
    environment:
      - GITEA_INSTANCE_URL=${GITEA_URL}
      - CONFIG_FILE=/config.yaml
      - GITEA_RUNNER_REGISTRATION_TOKEN=8CZ3Sd2VHITGIA1Xr2bo5j8l5Pj1EvTblTCeDmJU
    restart: unless-stopped
    networks:
      - back_network
    volumes:
      - ./data-runner/act_runner:/data
      - ./config.yaml:/config.yaml
      - ./data-runner/cache:/root/.cache
      - /etc/ssl/certs/:/etc/ssl/certs/
      - /var/run/docker.sock:/var/run/docker.sock
    privileged: true
    depends_on:
      gitea:
        condition: service_healthy
        restart: true