name: gitea-agent-server

x-common: &common
  user: "10001:10001"
  restart: unless-stopped
  read_only: true
  stop_grace_period: 2m
  environment: &common-environment
    GITEA_SERVER_URL: ${GITEA_SERVER_URL:?Set GITEA_SERVER_URL in .env}
    GITEA_REPOSITORY: ${GITEA_REPOSITORY:?Set GITEA_REPOSITORY in .env}
    CI_AGENT_BOT_LOGIN: ${CI_AGENT_BOT_LOGIN:?Set CI_AGENT_BOT_LOGIN in .env}
    CI_AGENT_ALLOWED_ACTOR_IDS: ${CI_AGENT_ALLOWED_ACTOR_IDS:-}
    CI_AGENT_ALLOWED_ACTORS: ${CI_AGENT_ALLOWED_ACTORS:-}
    CI_AGENT_ALLOW_INSECURE_HTTP: true
    AGENT_DB_PATH: /var/lib/gitea-agent/state/agent.db
    AGENT_WORKSPACE_ROOT: /var/lib/gitea-agent/workspaces
  volumes:
    - ${AGENT_STATE_DIR:-./state/server}:/var/lib/gitea-agent/state
    - ${AGENT_WORKSPACE_DIR:-./state/workspaces}:/var/lib/gitea-agent/workspaces
  tmpfs:
    - /tmp:rw,nosuid,nodev,mode=1777

services:
  gitea-webhook-host:
    <<: *common
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      target: controller
    image: ${AGENT_CONTROLLER_IMAGE:-gitea-agent-controller:2.0.0}
    container_name: gitea-webhook-host
    environment:
      <<: *common-environment
      AGENT_HTTP_HOST: 0.0.0.0
      AGENT_HTTP_PORT: "8080"
      GITEA_WRITE_TOKEN_FILE: /run/secrets/gitea_write_token
      GITEA_WEBHOOK_SECRET_FILE: /run/secrets/gitea_webhook_secret
    secrets:
      - gitea_write_token
      - gitea_webhook_secret
    networks:
      - gitea-common
    healthcheck:
      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:8080/readyz').then(r=>{if(!r.ok)process.exit(1)})"]
      interval: 10s
      timeout: 3s
      retries: 6

  executor:
    <<: *common
    tmpfs:
      - /tmp:rw,nosuid,nodev,mode=1777
      - /var/lib/opencode-agent/state:rw,nosuid,nodev,noexec,mode=1777
    build:
      context: ..
      dockerfile: deploy/Dockerfile
      target: executor
    image: ${AGENT_EXECUTOR_IMAGE:-gitea-agent-executor:2.0.0}
    environment:
      <<: *common-environment
      GITEA_READ_TOKEN_FILE: /run/secrets/gitea_read_token
      XDG_DATA_HOME: /var/lib/opencode-agent/data
      XDG_STATE_HOME: /var/lib/opencode-agent/state
      XDG_CACHE_HOME: /var/lib/opencode-agent/cache
    secrets:
      - gitea_read_token
    volumes:
      - ${AGENT_STATE_DIR:-./state/server}:/var/lib/gitea-agent/state
      - ${AGENT_WORKSPACE_DIR:-./state/workspaces}:/var/lib/gitea-agent/workspaces
      - ${OPENCODE_DATA_DIR:-./state/opencode}:/var/lib/opencode-agent/data
      - ${CACHE_DIR:-./state/cache}:/var/lib/opencode-agent/cache
    depends_on:
      gitea-webhook-host:
        condition: service_healthy

secrets:
  gitea_write_token:
    file: ${GITEA_WRITE_TOKEN_FILE:-./secrets/gitea-write-token}
  gitea_read_token:
    file: ${GITEA_READ_TOKEN_FILE:-./secrets/gitea-read-token}
  gitea_webhook_secret:
    file: ${GITEA_WEBHOOK_SECRET_FILE:-./secrets/gitea-webhook-secret}

networks:
  default:
  gitea-common:
    external: true