101 lines
3.3 KiB
YAML
101 lines
3.3 KiB
YAML
version: "3.8"
|
|
|
|
services:
|
|
gitea_server:
|
|
image: gitea/gitea:1.25.3
|
|
environment:
|
|
- USER_UID=1000
|
|
- USER_GID=1000
|
|
- GITEA__database__DB_TYPE=postgres
|
|
- GITEA__database__HOST=db:5432
|
|
- GITEA__database__NAME=gitea
|
|
- GITEA__database__USER=gitea
|
|
- GITEA__database__PASSWD=gitea
|
|
networks:
|
|
- gitea
|
|
- traefik-public
|
|
volumes:
|
|
- nfs-gitea:/data
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
depends_on:
|
|
- db
|
|
deploy:
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.gitea-web.entrypoints=web-secured"
|
|
- "traefik.http.services.gitea.loadbalancer.server.port=3000"
|
|
- "traefik.http.routers.gitea-web.rule=Host(`git.mariuszpacek.pl`)"
|
|
- "traefik.http.routers.gitea-web.tls.certresolver=http"
|
|
# SSH (TCP) router - restrict source IPs to trusted ranges only
|
|
- "traefik.tcp.routers.gitea.entrypoints=gitlab-ssh"
|
|
- "traefik.tcp.routers.gitea.rule=HostSNI(`*`)"
|
|
- "traefik.tcp.routers.gitea.middlewares=ssh-ipwhitelist@docker"
|
|
- "traefik.tcp.services.gitlab-ssh-port.loadbalancer.server.port=22"
|
|
# Define the tcp middleware to whitelist trusted source CIDRs (adjust as needed)
|
|
- "traefik.tcp.middlewares.ssh-ipwhitelist.tcp.ipwhitelist.sourcerange=83.26.248.249/32,10.0.1.0/24,172.18.0.0/16,192.168.0.0/24"
|
|
# Keep existing HTTP whitelist for web UI
|
|
- "traefik.http.middlewares.test-ipwhitelist-git.ipwhitelist.sourcerange=83.26.248.249/32,172.18.0.0/16,192.168.0.0/24"
|
|
- "traefik.http.routers.gitea-web.middlewares=test-ipwhitelist-git"
|
|
|
|
db:
|
|
image: postgres:14
|
|
environment:
|
|
- POSTGRES_USER=gitea
|
|
- POSTGRES_PASSWORD=gitea
|
|
- POSTGRES_DB=gitea
|
|
networks:
|
|
- gitea
|
|
volumes:
|
|
- nfs-gitea-db:/var/lib/postgresql/data
|
|
|
|
act_runner:
|
|
image: docker.io/gitea/act_runner:nightly
|
|
environment:
|
|
- GITEA_INSTANCE_URL=https://git.mariuszpacek.pl
|
|
- GITEA_RUNNER_NAME=swarm-runner
|
|
- GITEA_RUNNER_LABELS=swarm-runner,self-hosted
|
|
- GITEA_RUNNER_REGISTRATION_TOKEN_FILE=/run/secrets/registration_token
|
|
secrets:
|
|
- registration_token
|
|
volumes:
|
|
- act_runner-data:/data
|
|
- /var/run/docker.sock:/var/run/docker.sock
|
|
deploy:
|
|
mode: global
|
|
placement:
|
|
constraints:
|
|
- node.role == worker
|
|
restart_policy:
|
|
condition: any
|
|
|
|
secrets:
|
|
registration_token:
|
|
external: true
|
|
|
|
volumes:
|
|
act_runner-data:
|
|
nfs-gitea:
|
|
driver: local
|
|
driver_opts:
|
|
type: nfs
|
|
o: nfsvers=4.1,addr=192.168.0.205,rw
|
|
device: ":/fast-vm/docker/gitea"
|
|
nfs-gitea-db:
|
|
driver: local
|
|
driver_opts:
|
|
type: nfs
|
|
o: nfsvers=4.1,addr=192.168.0.205,rw
|
|
device: ":/fast-vm/docker/gitea-db"
|
|
|
|
networks:
|
|
gitea:
|
|
traefik-public:
|
|
external: true
|
|
|
|
# Notes:
|
|
# - Create the Docker secret `registration_token` with the runner token before deploying the stack:
|
|
# echo "<token>" | docker secret create registration_token -
|
|
# - Allowed SSH source ranges are intentionally restrictive. Add any trusted IP/CIDR as needed (e.g., your home IP).
|
|
# - If you prefer to fully disable SSH access through Traefik, remove the traefik.tcp.* labels on gitea_server.
|
|
# - After deployment, verify Traefik has the tcp middleware `ssh-ipwhitelist` configured (Traefik dashboard). |