# /opt/services/docker-compose.yml
# All services for box.cloud-elves.eu

services:

  # --- Reverse Proxy ---

  caddy:
    image: caddy:2
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - caddy-data:/data
      - caddy-config:/config
      # Static site served from host directory
      - /opt/www:/srv/www:ro
    networks:
      - frontend

  # --- Identity ---

  lldap:
    image: lldap/lldap:stable
    restart: unless-stopped
    environment:
      - LLDAP_JWT_SECRET={{ lldap_jwt_secret }}
      - LLDAP_KEY_SEED={{ lldap_key_seed }}
      - LLDAP_LDAP_USER_PASS={{ lldap_admin_password }}
      - LLDAP_LDAP_BASE_DN={{ ldap_base_dn }}
      - LLDAP_HTTP_URL=https://ldap.{{ domain }}
    volumes:
      - lldap-data:/data
    networks:
      - frontend
      - identity

  dex:
    image: dexidp/dex:latest
    restart: unless-stopped
    command: ["dex", "serve", "/etc/dex/config.yaml"]
    volumes:
      - ./dex-config.yml:/etc/dex/config.yaml:ro
      - dex-data:/var/dex
    networks:
      - frontend
      - identity
    depends_on:
      - lldap

  # --- Gitea ---

  gitea:
    image: gitea/gitea:{{ gitea_version }}
    restart: unless-stopped
    ports:
      # Gitea SSH on host port 2222
      - "2222:22"
    environment:
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=gitea-db:5432
      - GITEA__database__NAME=gitea
      - GITEA__database__USER=gitea
      - GITEA__database__PASSWD={{ gitea_db_password }}
      - GITEA__server__DOMAIN=git.{{ domain }}
      - GITEA__server__SSH_DOMAIN=git.{{ domain }}
      - GITEA__server__SSH_PORT=2222
      - GITEA__server__ROOT_URL=https://git.{{ domain }}/
      # Auto-create Gitea accounts on first SSO login
      - GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=true
      - GITEA__oauth2_client__ENABLE_AUTO_REGISTRATION=true
      - GITEA__oauth2_client__ACCOUNT_LINKING=auto
      # Enable Gitea Actions
      - GITEA__actions__ENABLED=true
    volumes:
      - gitea-data:/data
      - /etc/localtime:/etc/localtime:ro
    networks:
      - frontend
      - gitea-backend
    depends_on:
      - gitea-db

  gitea-db:
    image: postgres:{{ postgres_version }}
    restart: unless-stopped
    environment:
      - POSTGRES_DB=gitea
      - POSTGRES_USER=gitea
      - POSTGRES_PASSWORD={{ gitea_db_password }}
    volumes:
      - gitea-db:/var/lib/postgresql/data
    networks:
      - gitea-backend

  # --- Gitea Runner ---

  gitea-runner:
    image: gitea/act_runner:latest
    restart: unless-stopped
    environment:
      - GITEA_INSTANCE_URL=http://gitea:3000
      - GITEA_RUNNER_REGISTRATION_TOKEN={{ gitea_runner_token }}
      - GITEA_RUNNER_NAME=box-runner
    volumes:
      # Runner needs Docker socket to spin up job containers
      - /var/run/docker.sock:/var/run/docker.sock
      - gitea-runner-data:/data
    networks:
      - frontend
    depends_on:
      - gitea

  # --- Outline ---

  outline:
    image: outlinewiki/outline:{{ outline_version }}
    restart: unless-stopped
    environment:
      - URL=https://docs.{{ domain }}
      - SECRET_KEY={{ outline_secret_key }}
      - UTILS_SECRET={{ outline_utils_secret }}
      - DATABASE_URL=postgres://outline:{{ outline_db_password }}@outline-db:5432/outline
      - PGSSLMODE=disable
      - REDIS_URL=redis://outline-redis:6379
      - FILE_STORAGE=local
      - FILE_STORAGE_LOCAL_ROOT_DIR=/var/lib/outline/data
      - FORCE_HTTPS=false
      - OIDC_CLIENT_ID=outline
      - OIDC_CLIENT_SECRET={{ dex_outline_client_secret }}
      - OIDC_AUTH_URI=https://auth.{{ domain }}/auth
      - OIDC_TOKEN_URI=https://auth.{{ domain }}/token
      - OIDC_USERINFO_URI=https://auth.{{ domain }}/userinfo
      - OIDC_DISPLAY_NAME=Cloud Elves SSO
      - OIDC_SCOPES=openid profile email offline_access
    volumes:
      - outline-data:/var/lib/outline/data
    networks:
      - frontend
      - outline-backend
    depends_on:
      - outline-db
      - outline-redis
      - dex

  outline-db:
    image: postgres:{{ postgres_version }}
    restart: unless-stopped
    environment:
      - POSTGRES_DB=outline
      - POSTGRES_USER=outline
      - POSTGRES_PASSWORD={{ outline_db_password }}
    volumes:
      - outline-db:/var/lib/postgresql/data
    networks:
      - outline-backend

  outline-redis:
    image: redis:{{ redis_version }}
    restart: unless-stopped
    networks:
      - outline-backend

networks:
  frontend:
  identity:
  gitea-backend:
  outline-backend:

volumes:
  caddy-data:
  caddy-config:
  lldap-data:
  dex-data:
  gitea-data:
  gitea-db:
  gitea-runner-data:
  outline-data:
  outline-db: