version: "3"

services:
    gitea:
        image: docker.gitea.com/gitea:28.3
        environment:
            - USER_UID=1000
            - USER_GID=1000
        restart: always
        volumes:
            - giteadata:/data
            - /etc/timezone:/etc/timezone:ro
            - /etc/localtime:/etc/localtime:ro
        networks:
            - reverse_network

    woodpecker_server:
        image: woodpeckerci/woodpecker-server:v3.20-alpine
        volumes:
            - woodpeckerdata:/var/lib/woodpecker/
        entrypoint: /bin/sh -c "export WOODPECKER_GITEA_CLIENT=$$(cat /run/secrets/woodpecker_gitea_client) && export WOODPECKER_GITEA_SECRET=$$(cat /run/secrets/woodpecker_gitea_secret) && export WOODPECKER_AGENT_SECRET=$$(cat /run/secrets/woodpecker_agent_secret) && /bin/woodpecker-server"
        environment:
            WOODPECKER_ADMIN: qpismont
            WOODPECKER_HOST: https://woodpecker.qpismont.fr
            WOODPECKER_GITEA: "true"
            WOODPECKER_GITEA_URL: https://gitea.qpismont.fr
        networks:
            - reverse_network
        secrets:
            - woodpecker_agent_secret
            - woodpecker_gitea_client
            - woodpecker_gitea_secret

    woodpecker_agent:
        image: woodpeckerci/woodpecker-agent:v3.20-alpine
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        entrypoint: /bin/sh -c "export WOODPECKER_AGENT_SECRET=$$(cat /run/secrets/woodpecker_agent_secret) && /bin/woodpecker-agent"
        environment:
            WOODPECKER_SERVER: woodpecker_server:9000
            WOODPECKER_MAX_WORKFLOWS: 1
            WOODPECKER_LIMIT_CPU_SET: 1
        networks:
            - reverse_network
        secrets:
            - woodpecker_agent_secret

    herald:
        image: tintounn/herald:1.2
        volumes:
            - /var/run/docker.sock:/var/run/docker.sock
        entrypoint:
            - /bin/sh
            - -c
            - >-
                export GITEA_TOKEN=$$(cat /run/secrets/herald_gitea_token) &&
                export OPEN_ROUTER_API_KEY=$$(cat /run/secrets/herald_openrouter_token) &&
                export WEBHOOK_SIG_HEADER_SECRET=$$(cat /run/secrets/herald_gitea_header_secret) &&
                export SENTRY_DSN=$$(cat /run/secrets/herald_sentry_dsn) &&
                /app/herald-server
        networks:
            - reverse_network
            - prometheus_network
        secrets:
            - herald_gitea_token
            - herald_openrouter_token
            - herald_gitea_header_secret
            - herald_sentry_dsn
        environment:
            HTTP_PORT: 3000
            BOT_MAX_CONCURRENT: 5
            GITEA_URL: http://gitea:3000
            GITEA_TIMEOUT: 60
            OPEN_ROUTER_MODEL: openai/gpt-5.6-luna-pro
            OPEN_ROUTER_TIMEOUT: 600
            METRICS_BIND_ADDR: 0.0.0.0:9100
            SANDBOX_MAX_ITERATIONS: 32

secrets:
    woodpecker_agent_secret:
        name: woodpecker_agent_secret_${DATETIME}
        file: ./secrets/woodpecker_agent_secret
    woodpecker_gitea_secret:
        name: woodpecker_gitea_secret_${DATETIME}
        file: ./secrets/woodpecker_gitea_secret
    woodpecker_gitea_client:
        name: woodpecker_gitea_client_${DATETIME}
        file: ./secrets/woodpecker_gitea_client
    herald_gitea_token:
        name: herald_gitea_token_${DATETIME}
        file: ./secrets/herald/herald_gitea_token
    herald_openrouter_token:
        name: herald_openrouter_token_${DATETIME}
        file: ./secrets/herald/herald_openrouter_token
    herald_gitea_header_secret:
        name: herald_gitea_header_secret_${DATETIME}
        file: ./secrets/herald/herald_gitea_header_secret
    herald_sentry_dsn:
        name: herald_sentry_dsn_${DATETIME}
        file: ./secrets/herald/herald_sentry_dsn

volumes:
    giteadata:
    woodpeckerdata:

networks:
    reverse_network:
        external: true
    prometheus_network:
        external: true