first commit

2022-05-21 08:16:04 +05:30
commit a990ee6cf5
1 changed files with 105 additions and 0 deletions
@@ -0,0 +1,105 @@
+# docker-compose file to start up gitea in https://git.bitsathy.ac.in
+# to start the container run:
+#    docker-compose up -d
+#
+# Create 3 traefik routers - for http LAN, Internet and ssh clients
+#  1. LAN (Internal) users: no auth in Traefik, use Gitea Google SSO only
+#  2. Internet users: Google SSO via traefik-forward-auth and also in Gitea (double login)
+#  3. SSH users: blocked in BIT firewall, so only internal access is available
+#
+# Note: This container uses bridge networking and cannot connect to the docker
+#       host over localhost (localhost of container is different from the host).
+#       Hence mysql/mariadb is accessed via unix socket.
+#
+# Note2: docker container name is sourced from the .env file in this directory.
+#
+# Note3: containrrr/watchtower service will auto update this container
+
+version: "2.4"
+
+services:
+  git:
+    image: gitea/gitea:1-rootless
+    container_name: git
+    restart: always
+    user: nobody
+
+#    ports:
+#      - 80:3000
+#      - 80:80
+#      - 443:443
+
+    volumes:
+      - /srv/git.bitsathy.ac.in/data:/var/lib/gitea
+      - /srv/git.bitsathy.ac.in/config:/etc/gitea
+      # - /var/run/mysqld:/var/run/mysqld
+      - /etc/timezone:/etc/timezone:ro
+
+    labels:
+      - com.centurylinklabs.watchtower.enable=true
+      - traefik.enable=true
+      # Internal LAN users, don't use any Google SSO and let Gitea handle the auth
+      - traefik.http.routers.git-internal.rule=Host(`git.cicd.goagain.me`) && ClientIP(`127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `100.64.0.0/10`)
+      - traefik.http.routers.git-internal.tls=true
+      - traefik.http.routers.git-internal.tls.certresolver=lets-encrypt
+      - traefik.http.routers.git-internal.service=git-internal
+      - traefik.http.services.git-internal.loadbalancer.server.port=3000
+
+      # External users from internet need to use Google SSO via forward-auth-proxy before Gitea auth
+      - traefik.http.routers.git-external.rule=Host(`git.cicd.goagain.me`)
+      - traefik.http.routers.git-external.tls=true
+      - traefik.http.routers.git-external.tls.certresolver=lets-encrypt
+      - traefik.http.routers.git-external.service=git-external
+      - traefik.http.services.git-external.loadbalancer.server.port=3000
+      # authenticate all requests before passing it to the backend servers
+      # - traefik.http.routers.git-external.middlewares=google-oauth2@file
+
+      # Access git via ssh, BIT firewall permits only http/https so this works only for LAN users
+      - traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)
+      - traefik.tcp.routers.gitea-ssh.entrypoints=ssh
+      - traefik.tcp.routers.gitea-ssh.service=gitea-ssh
+      - traefik.tcp.services.gitea-ssh.loadbalancer.server.port=2222
+
+
+  drone:
+      image: drone/drone:2
+      container_name: "drone"
+      volumes:
+        - ../../drone.bitsathy.ac.in/data:/var/lib/drone
+        - ../../drone.bitsathy.ac.in/data/sqlite3:/data
+      restart: always
+
+      env_file:
+        - ../../drone.bitsathy.ac.in/config/config_server
+
+      labels:
+        - com.centurylinklabs.watchtower.enable=true
+        - traefik.enable=true
+
+        - traefik.http.routers.drone-in.rule=Host(`drone.cicd.goagain.me`)
+        - traefik.http.routers.drone-in.tls=true
+        - traefik.http.routers.drone-in.tls.certresolver=lets-encrypt
+        - traefik.http.routers.drone-in.service=drone-in
+        - traefik.http.services.drone-in.loadbalancer.server.port=80
+      depends_on:
+        - git
+
+  runner:
+      image: drone/drone-runner-docker:1
+      volumes:
+        - /var/run/docker.sock:/var/run/docker.sock
+      env_file:
+
+         - ../../drone.bitsathy.ac.in/config/config_runner
+
+      restart: always
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.drone.rule=Host(`runner.goagain.me`)
+        - traefik.http.routers.runner.tls=true
+        - traefik.http.routers.runner.tls.certresolver=lets-encrypt
+        - traefik.http.services.runner.loadbalancer.server.port=3000
+      depends_on:
+        - drone   
+
+