106 lines
3.9 KiB
YAML
106 lines
3.9 KiB
YAML
# docker-compose file to start up gitea in https://git.bitsathy.ac.in
|
|
# to start the container run:
|
|
# docker-compose up -d
|
|
#
|
|
# Create 3 traefik routers - for http LAN, Internet and ssh clients
|
|
# 1. LAN (Internal) users: no auth in Traefik, use Gitea Google SSO only
|
|
# 2. Internet users: Google SSO via traefik-forward-auth and also in Gitea (double login)
|
|
# 3. SSH users: blocked in BIT firewall, so only internal access is available
|
|
#
|
|
# Note: This container uses bridge networking and cannot connect to the docker
|
|
# host over localhost (localhost of container is different from the host).
|
|
# Hence mysql/mariadb is accessed via unix socket.
|
|
#
|
|
# Note2: docker container name is sourced from the .env file in this directory.
|
|
#
|
|
# Note3: containrrr/watchtower service will auto update this container
|
|
|
|
version: "2.4"
|
|
|
|
services:
|
|
git:
|
|
image: gitea/gitea:1-rootless
|
|
container_name: git
|
|
restart: always
|
|
user: nobody
|
|
|
|
# ports:
|
|
# - 80:3000
|
|
# - 80:80
|
|
# - 443:443
|
|
|
|
volumes:
|
|
- /srv/git.bitsathy.ac.in/data:/var/lib/gitea
|
|
- /srv/git.bitsathy.ac.in/config:/etc/gitea
|
|
# - /var/run/mysqld:/var/run/mysqld
|
|
- /etc/timezone:/etc/timezone:ro
|
|
|
|
labels:
|
|
- com.centurylinklabs.watchtower.enable=true
|
|
- traefik.enable=true
|
|
# Internal LAN users, don't use any Google SSO and let Gitea handle the auth
|
|
- traefik.http.routers.git-internal.rule=Host(`git.cicd.goagain.me`) && ClientIP(`127.0.0.0/8`, `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`, `100.64.0.0/10`)
|
|
- traefik.http.routers.git-internal.tls=true
|
|
- traefik.http.routers.git-internal.tls.certresolver=lets-encrypt
|
|
- traefik.http.routers.git-internal.service=git-internal
|
|
- traefik.http.services.git-internal.loadbalancer.server.port=3000
|
|
|
|
# External users from internet need to use Google SSO via forward-auth-proxy before Gitea auth
|
|
- traefik.http.routers.git-external.rule=Host(`git.cicd.goagain.me`)
|
|
- traefik.http.routers.git-external.tls=true
|
|
- traefik.http.routers.git-external.tls.certresolver=lets-encrypt
|
|
- traefik.http.routers.git-external.service=git-external
|
|
- traefik.http.services.git-external.loadbalancer.server.port=3000
|
|
# authenticate all requests before passing it to the backend servers
|
|
# - traefik.http.routers.git-external.middlewares=google-oauth2@file
|
|
|
|
# Access git via ssh, BIT firewall permits only http/https so this works only for LAN users
|
|
- traefik.tcp.routers.gitea-ssh.rule=HostSNI(`*`)
|
|
- traefik.tcp.routers.gitea-ssh.entrypoints=ssh
|
|
- traefik.tcp.routers.gitea-ssh.service=gitea-ssh
|
|
- traefik.tcp.services.gitea-ssh.loadbalancer.server.port=2222
|
|
|
|
|
|
drone:
|
|
image: drone/drone:2
|
|
container_name: "drone"
|
|
volumes:
|
|
- ../../drone.bitsathy.ac.in/data:/var/lib/drone
|
|
- ../../drone.bitsathy.ac.in/data/sqlite3:/data
|
|
restart: always
|
|
|
|
env_file:
|
|
- ../../drone.bitsathy.ac.in/config/config_server
|
|
|
|
labels:
|
|
- com.centurylinklabs.watchtower.enable=true
|
|
- traefik.enable=true
|
|
|
|
- traefik.http.routers.drone-in.rule=Host(`drone.cicd.goagain.me`)
|
|
- traefik.http.routers.drone-in.tls=true
|
|
- traefik.http.routers.drone-in.tls.certresolver=lets-encrypt
|
|
- traefik.http.routers.drone-in.service=drone-in
|
|
- traefik.http.services.drone-in.loadbalancer.server.port=80
|
|
depends_on:
|
|
- git
|
|
|
|
runner:
|
|
image: drone/drone-runner-docker:1
|
|
volumes:
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
env_file:
|
|
|
|
- ../../drone.bitsathy.ac.in/config/config_runner
|
|
|
|
restart: always
|
|
labels:
|
|
- traefik.enable=true
|
|
- traefik.http.routers.drone.rule=Host(`runner.goagain.me`)
|
|
- traefik.http.routers.runner.tls=true
|
|
- traefik.http.routers.runner.tls.certresolver=lets-encrypt
|
|
- traefik.http.services.runner.loadbalancer.server.port=3000
|
|
depends_on:
|
|
- drone
|
|
|
|
|