# =====================================================================
# Gitea - where the VM sub-agent publishes what it built.
#
# ONLY vm_agent NEEDS THIS. Every other tool works without it, and so
# does vm_agent itself: without Gitea a session still runs, still keeps
# its files in the project folder on the array, and simply returns no
# link. If you are not using the VM sub-agent, skip this file entirely.
#
# WHAT THE SUB-AGENT NEEDS FROM IT
#   * an organisation to create repositories in  (OWUITOOLS_GITEA_ORG)
#   * a bot account with write access to it      (OWUITOOLS_GITEA_BOT)
#   * an access token for that account           (OWUITOOLS_GITEA_TOKEN)
#
# All three go in /etc/owuivm/vmd.env, from configs/vmd.env. The token
# NEVER enters the guest or the agent container: vmd clones, commits and
# pushes on the host and supplies the credential at push time through
# GIT_ASKPASS. See docs/setup/gitea.md.
#
# WHY TWO URLs
#   vmd pushes to the LAN address and gives the user the public one. The
#   daemon's systemd unit has an address allowlist with exactly this
#   destination on it, and a public name behind a CDN would not match.
# =====================================================================
# Pinned so the project and its volume have the same names wherever this
# file is run from - see the note in open-webui.compose.yml.
name: gitea

services:
  gitea:
    image: gitea/gitea:1
    container_name: gitea
    restart: unless-stopped

    environment:
      USER_UID: 1000
      USER_GID: 1000

      GITEA__server__PROTOCOL: http
      GITEA__server__HTTP_ADDR: 0.0.0.0
      GITEA__server__HTTP_PORT: 3000
      GITEA__server__DOMAIN: git.example.com
      GITEA__server__ROOT_URL: https://git.example.com/
      GITEA__server__LOCAL_ROOT_URL: http://localhost:3000/

      # The agent creates repositories through the API as its bot user.
      # Registration stays closed; the bot is made by hand, once.
      GITEA__service__DISABLE_REGISTRATION: "true"

      GITEA__server__DISABLE_SSH: "false"
      GITEA__server__START_SSH_SERVER: "false"
      GITEA__server__SSH_USER: git
      GITEA__server__SSH_DOMAIN: git.example.com
      GITEA__server__SSH_PORT: 7222

      # Only if you front this with a reverse proxy. Naming the proxy
      # rather than "*" is what stops a client forging its own source IP.
      GITEA__security__REVERSE_PROXY_LIMIT: 1
      GITEA__security__REVERSE_PROXY_TRUSTED_PROXIES: "192.168.1.0/24"

      GITEA__repository__ROOT: /data/git/repositories

    ports:
      # Bind to the LAN address rather than 0.0.0.0 if this machine has
      # one; plain "7200:3000" is fine otherwise. Whatever you choose
      # here is what OWUITOOLS_GITEA_URL must say, and what
      # owuivmd.service's IPAddressAllow must permit.
      - "7200:3000"
      - "7222:22"

    volumes:
      - /srv/gitea/repositories:/data/git/repositories
      - gitea-data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro

volumes:
  gitea-data: