# ----------------------------------------------------------------------------
# jb-infra — VPS edge stack: reverse proxy + self-hosted git/CI.
#
# Brought up MANUALLY on the VPS, once (it rarely changes). Everything else
# (jb-website and future projects) is deployed by CI and just joins the `edge`
# network + declares routing labels.
#
#   docker network create edge      # one time, BEFORE this stack
#   docker compose up -d
#
# - caddy   : owns 80/443, terminates TLS (automatic ACME) for every host, and
#             builds its routing from Docker labels on containers attached to
#             the `edge` network.
# - forgejo : git server + Actions + container registry at git.joshbairstow.com.
# ----------------------------------------------------------------------------

services:
  caddy:
    # Pin to the current release; verify the tag at
    # https://hub.docker.com/r/lucaslorentz/caddy-docker-proxy/tags
    image: lucaslorentz/caddy-docker-proxy:2.10-alpine
    container_name: edge-caddy
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp" # HTTP/3
    environment:
      # Only build routes from containers on this network.
      CADDY_INGRESS_NETWORKS: edge
    networks:
      - edge
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - caddy_data:/data # certs live here — MUST persist (rate limits otherwise)
      - caddy_config:/config
    labels:
      # ACME contact for every cert this proxy issues.
      caddy.email: josh@joshbairstow.com

  forgejo:
    # Pin to the current stable line; verify at
    # https://codeberg.org/forgejo/-/packages/container/forgejo
    image: codeberg.org/forgejo/forgejo:11
    container_name: forgejo
    restart: unless-stopped
    environment:
      USER_UID: "1000"
      USER_GID: "1000"
      # Server identity — must be correct or registry login / clone URLs break.
      FORGEJO__server__ROOT_URL: https://git.joshbairstow.com/
      FORGEJO__server__DOMAIN: git.joshbairstow.com
      FORGEJO__server__HTTP_PORT: "3000"
      FORGEJO__server__SSH_DOMAIN: git.joshbairstow.com
      FORGEJO__server__SSH_PORT: "222"
      # Enable Actions (CI). Runners register against this instance.
      FORGEJO__actions__ENABLED: "true"
      # SQLite keeps the footprint small on a modest VPS.
      FORGEJO__database__DB_TYPE: sqlite3
    networks:
      - edge
    volumes:
      - forgejo_data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      # git-over-SSH. 222 avoids the host's own sshd on 22.
      - "222:22"
    labels:
      caddy: git.joshbairstow.com
      caddy.reverse_proxy: "{{upstreams 3000}}"

networks:
  edge:
    external: true

volumes:
  caddy_data:
  caddy_config:
  forgejo_data: