# Gitea Actions runners — 3 parallel runners, each with its own dind sidecar.
#
# Each runner gets an isolated Docker daemon rather than the host socket, so a
# CI job cannot reach the other ~180 containers on this box. Cost: each dind
# keeps its own image cache under ./volumes/runner-N/dind.
#
# The pre-existing host runner (/home/gib/.local/bin/act_runner, name
# "server-gib") is intentionally left running.
#
# Registration token generated with:
#   docker exec -u git gitea gitea actions generate-runner-token
# It is reusable — all three runners register with the same one.

networks:
  nginx-bridge:
    external: true

x-runner-env: &runner-env
  TZ: America/New_York
  GITEA_INSTANCE_URL: https://git.gbrown.org
  GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN}
  GITEA_RUNNER_LABELS: "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest,ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04,ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
  DOCKER_TLS_VERIFY: "1"
  DOCKER_CERT_PATH: /certs/client
  CONFIG_FILE: /data/config.yml

x-dind-env: &dind-env
  TZ: America/New_York
  DOCKER_TLS_CERTDIR: /certs

services:
  gitea-runner-1:
    image: gitea/act_runner:latest
    container_name: gitea-runner-1
    hostname: gitea-runner-1
    domainname: git.gbrown.org
    networks: ['nginx-bridge']
    environment:
      <<: *runner-env
      GITEA_RUNNER_NAME: gitea-runner-1
      DOCKER_HOST: tcp://gitea-runner-1-dind:2376
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    volumes:
      - ./volumes/runner-1/data:/data
      - ./volumes/runner-1/certs:/certs
      - /etc/localtime:/etc/localtime:ro
    depends_on:
      - gitea-runner-1-dind
    tty: true
    stdin_open: true
    restart: unless-stopped

  gitea-runner-1-dind:
    image: docker:dind
    container_name: gitea-runner-1-dind
    hostname: gitea-runner-1-dind
    domainname: git.gbrown.org
    networks: ['nginx-bridge']
    privileged: true
    environment:
      <<: *dind-env
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    volumes:
      - ./volumes/runner-1/certs:/certs
      - ./volumes/runner-1/dind:/var/lib/docker
      - /etc/localtime:/etc/localtime:ro
    tty: true
    stdin_open: true
    restart: unless-stopped

  gitea-runner-2:
    image: gitea/act_runner:latest
    container_name: gitea-runner-2
    hostname: gitea-runner-2
    domainname: git.gbrown.org
    networks: ['nginx-bridge']
    environment:
      <<: *runner-env
      GITEA_RUNNER_NAME: gitea-runner-2
      DOCKER_HOST: tcp://gitea-runner-2-dind:2376
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    volumes:
      - ./volumes/runner-2/data:/data
      - ./volumes/runner-2/certs:/certs
      - /etc/localtime:/etc/localtime:ro
    depends_on:
      - gitea-runner-2-dind
    tty: true
    stdin_open: true
    restart: unless-stopped

  gitea-runner-2-dind:
    image: docker:dind
    container_name: gitea-runner-2-dind
    hostname: gitea-runner-2-dind
    domainname: git.gbrown.org
    networks: ['nginx-bridge']
    privileged: true
    environment:
      <<: *dind-env
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    volumes:
      - ./volumes/runner-2/certs:/certs
      - ./volumes/runner-2/dind:/var/lib/docker
      - /etc/localtime:/etc/localtime:ro
    tty: true
    stdin_open: true
    restart: unless-stopped

  gitea-runner-3:
    image: gitea/act_runner:latest
    container_name: gitea-runner-3
    hostname: gitea-runner-3
    domainname: git.gbrown.org
    networks: ['nginx-bridge']
    environment:
      <<: *runner-env
      GITEA_RUNNER_NAME: gitea-runner-3
      DOCKER_HOST: tcp://gitea-runner-3-dind:2376
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    volumes:
      - ./volumes/runner-3/data:/data
      - ./volumes/runner-3/certs:/certs
      - /etc/localtime:/etc/localtime:ro
    depends_on:
      - gitea-runner-3-dind
    tty: true
    stdin_open: true
    restart: unless-stopped

  gitea-runner-3-dind:
    image: docker:dind
    container_name: gitea-runner-3-dind
    hostname: gitea-runner-3-dind
    domainname: git.gbrown.org
    networks: ['nginx-bridge']
    privileged: true
    environment:
      <<: *dind-env
    labels:
      com.centurylinklabs.watchtower.enable: "true"
    volumes:
      - ./volumes/runner-3/certs:/certs
      - ./volumes/runner-3/dind:/var/lib/docker
      - /etc/localtime:/etc/localtime:ro
    tty: true
    stdin_open: true
    restart: unless-stopped