# docker-compose file to start up gitea in https://git.bitsathy.ac.in
# to start the container run:
#    docker-compose up -d
#
# Create 3 traefik routers - for http LAN, Internet and ssh clients
#  1. LAN (Internal) users: no auth in Traefik, use Gitea Google SSO only
#  2. Internet users: Google SSO via traefik-forward-auth and also in Gitea (double login)
#  3. SSH users: blocked in BIT firewall, so only internal access is available
#
# Note: This container uses bridge networking and cannot connect to the docker
#       host over localhost (localhost of container is different from the host).
#       Hence mysql/mariadb is accessed via unix socket.
#
# Note2: docker container name is sourced from the .env file in this directory.
#
# Note3: containrrr/watchtower service will auto update this container

version: "2.4"

services:
  git:
    image: gitea/gitea:1-rootless
    container_name: git
    restart: always
    user: nobody

#    ports:
#      - 80:3000
#      - 80:80
#      - 443:443

    volumes:
      - /srv/git.bitsathy.ac.in/data:/var/lib/gitea
      - /srv/git.bitsathy.ac.in/config:/etc/gitea
      # - /var/run/mysqld:/var/run/mysqld
      - /etc/timezone:/etc/timezone:ro

    labels:
      - com.centurylinklabs.watchtower.enable=true
      - traefik.enable=true
      # Internal LAN users, don't use any Google SSO and let Gitea handle the auth
      - traefik.http.routers.git-internal.rule=Host(`git.cicd.goagain.me`) && ClientIP(`127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `100.64.0.0/10`)
      - traefik.http.routers.git-internal.tls=true
      - traefik.http.routers.git-internal.tls.certresolver=lets-encrypt
      - traefik.http.routers.git-internal.service=git-internal
      - traefik.http.services.git-internal.loadbalancer.server.port=3000

      # External users from internet need to use Google SSO via forward-auth-proxy before Gitea auth
      - traefik.http.routers.git-external.rule=Host(`git.bitsathy.ac.in`)
      - traefik.http.routers.git-external.tls=true
      - traefik.http.routers.git-external.tls.certresolver=lets-encrypt
      - traefik.http.routers.git-external.service=git-external
      - traefik.http.services.git-external.loadbalancer.server.port=3000
      # authenticate all requests before passing it to the backend servers
      # - traefik.http.routers.git-external.middlewares=google-oauth2@file

      # Access git via ssh, BIT firewall permits only http/https so this works only for LAN users
      - traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)
      - traefik.tcp.routers.gitea-ssh.entrypoints=ssh
      - traefik.tcp.routers.gitea-ssh.service=gitea-ssh
      - traefik.tcp.services.gitea-ssh.loadbalancer.server.port=2222


  drone:
      image: drone/drone:2
      container_name: "drone"
      volumes:
        - ../../drone.bitsathy.ac.in/data:/var/lib/drone
        - ../../drone.bitsathy.ac.in/data/sqlite3:/data
      restart: always
      env_file:
        - ../../drone.bitsathy.ac.in/config/config_server
      labels:
        - com.centurylinklabs.watchtower.enable=false
        - traefik.enable=true
        - traefik.http.routers.drone-in.rule=Host(`drone.bitsathy.ac.in`)
        - traefik.http.routers.drone-in.tls=true
        - traefik.http.routers.drone-in.tls.certresolver=lets-encrypt
        - traefik.http.routers.drone-in.service=drone-in
        - traefik.http.services.drone-in.loadbalancer.server.port=80
      depends_on:
        - git

  runner:
      image: drone/drone-runner-docker:1
      volumes:
        - /var/run/docker.sock:/var/run/docker.sock
      env_file:
         - ../../drone.bitsathy.ac.in/config/config_runner
      restart: always
      labels:
        - com.centurylinklabs.watchtower.enable=false
        - traefik.enable=true
        - traefik.http.routers.runner.tls=true
        - traefik.http.routers.runner.tls.certresolver=lets-encrypt
        - traefik.http.services.runner.loadbalancer.server.port=3000
      depends_on:
        - drone