# Gitea - Könnyű, saját Git szerver webes felülettel
# Domain: ${SUBDOMAIN}.${DOMAIN}
# Database: None (file-based)
# RAM: ~100M (mem_limit: 512M) | Pi-compatible: Yes
#
# Environment variables:
#   DOMAIN          - Your domain (e.g., demo-felhom.eu)

services:
  gitea:
    image: gitea/gitea:1.27.0
    container_name: gitea
    restart: unless-stopped
    environment:
      - TZ=Europe/Budapest
      - GITEA__server__ROOT_URL=https://${SUBDOMAIN}.${DOMAIN}
      - GITEA__server__SSH_DOMAIN=${SUBDOMAIN}.${DOMAIN}
      - GITEA__database__DB_TYPE=sqlite3
      # App-email (managed relay). Injected by the controller only when app-email is on (global +
      # per-app); empty ENABLED/ADDR keeps Gitea mail disabled. Gitea applies GITEA__* env on every
      # boot (environment-to-ini), so the toggle takes effect on redeploy. See .felhom.yml smtp_mapping.
      - GITEA__mailer__ENABLED=${GITEA__mailer__ENABLED:-false}
      - GITEA__mailer__PROTOCOL=${GITEA__mailer__PROTOCOL:-smtp+starttls}
      - GITEA__mailer__SMTP_ADDR=${GITEA__mailer__SMTP_ADDR:-}
      - GITEA__mailer__SMTP_PORT=${GITEA__mailer__SMTP_PORT:-2525}
      - GITEA__mailer__FROM=${GITEA__mailer__FROM:-}
      - GITEA__mailer__FORCE_TRUST_SERVER_CERT=${GITEA__mailer__FORCE_TRUST_SERVER_CERT:-false}
    volumes:
      - gitea_data:/data
    networks:
      - traefik-public
    deploy:
      resources:
        limits:
          memory: 512M
    # /api/healthz is gitea's dedicated health endpoint (200 once serving); /api/v1/version returns
    # 404 until the install wizard is completed (INSTALL_LOCK), so it falsely reported unhealthy on a
    # fresh deploy. The gitea image ships curl (verified). 90s start_period covers first-boot DB migration.
    healthcheck:
      test: ["CMD", "curl", "-f", "http://127.0.0.1:3000/api/healthz"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 90s
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.gitea.rule=Host(`${SUBDOMAIN}.${DOMAIN}`)"
      - "traefik.http.routers.gitea.entrypoints=websecure"
      - "traefik.http.routers.gitea.tls=true"
      - "traefik.http.routers.gitea.tls.certresolver=letsencrypt"
      - "traefik.http.services.gitea.loadbalancer.server.port=3000"

volumes:
  gitea_data:

networks:
  traefik-public:
    external: true