---
networks:
  internal:
    name: internal
    driver: bridge
  external:
    name: external
    driver: bridge

services:

  # -------------------------------------------------------------------
  # 1. THE REPOSITORY: Gitea Backend
  # -------------------------------------------------------------------
  db:
    image: mysql:8
    container_name: gitea-db
    restart: unless-stopped
    env_file: .env
    environment:
      - MYSQL_ROOT_PASSWORD=${MYSQL_ROOT_PASSWORD}
      - MYSQL_DATABASE=${MYSQL_DATABASE}
      - MYSQL_USER=${MYSQL_USER}
      - MYSQL_PASSWORD=${MYSQL_PASSWORD}
    volumes:
      - ./mysql:/var/lib/mysql
    networks:
      - internal
    healthcheck:
      test: ["CMD-SHELL", "mysqladmin ping -h localhost -u${MYSQL_USER} -p${MYSQL_PASSWORD}"]
      interval: 10s
      timeout: 5s
      retries: 5

  # -------------------------------------------------------------------
  # 2. THE REPOSITORY: Gitea Frontend
  # -------------------------------------------------------------------
  gitea:
    image: gitea/gitea:latest
    container_name: gitea
    restart: unless-stopped
    env_file: .env
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__server__SSH_PORT=222
      - GITEA__server__SSH_LISTEN_PORT=22
      - GITEA__server__SSH_DOMAIN=mygitea.mikemcfetridge.com
      - GITEA_APP_NAME=${GITEA_APP_NAME}
      - GITEA__database__DB_TYPE=${GITEA__database__DB_TYPE}
      - GITEA__database__HOST=${GITEA__database__HOST}
      - GITEA__database__NAME=${GITEA__database__NAME}
      - GITEA__database__USER=${GITEA__database__USER}
      - GITEA__database__PASSWD=${GITEA__database__PASSWD}
    depends_on:
      db:
        condition: service_healthy
    ports:
      - "3000:3000"
      - "222:22"
    volumes:
      - ./gitea:/data
      - /etc/localtime:/etc/localtime:ro
    networks:
      - internal
      - external
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000"]
      interval: 10s
      retries: 3
      timeout: 10s
      start_period: 30s

  # -------------------------------------------------------------------
  # 3. THE GITEA runner using docker compose
  # -------------------------------------------------------------------
  runner:
    image: gitea/act_runner:latest
    container_name: gitea-runner
    restart: unless-stopped
    depends_on:
      gitea:
        condition: service_healthy
    env_file: .env
    environment:
      - GITEA_INSTANCE_URL=${GITEA_INSTANCE_URL}
      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
      - GITEA_RUNNER_NAME=${GITEA_RUNNER_NAME}
      - GITEA_RUNNER_LABELS=${GITEA_RUNNER_LABELS}
      - GITEA_RUNNER_LOG_LEVEL=trace
      - GITEA_RUNNER_JOB_CONTAINER_NETWORK=external
    volumes:
      - ./runner-data:/data
      - ./runner-config.yaml:/config.yaml
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - internal
      - external

  # -------------------------------------------------------------------
  # 4. THE SECURITY LAYER: Docker Socket Proxy
  # -------------------------------------------------------------------
  docker-proxy:
    image: tecnativa/docker-socket-proxy:latest
    container_name: docker_proxy
    privileged: true
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
    environment:
      - CONTAINERS=1
      - NETWORKS=1
      - SERVICES=1
      - VOLUMES=1
      - POST=1 # Allows Semaphore to create/start components
    networks:
      - external
    restart: unless-stopped