mirror of
https://github.com/terraphim/gitea-infrastructure.git
synced 2026-07-16 01:00:33 +02:00
4a4a0351aa
Complete infrastructure deployment including: - Docker Compose templates with 1Password integration (op://) - Caddy reverse proxy configuration for git.terraphim.cloud - Automated deployment script (deploy-to-bigbox.sh) - Comprehensive documentation and deployment article - Network isolation: Public (Gitea) + Tailscale (Prometheus/S3) - Security: No hardcoded secrets, all via 1Password Services deployed: - Gitea 1.22.6 (Git hosting) - PostgreSQL 15 (Database) - SeaweedFS (S3-compatible storage) - Prometheus (Monitoring) Excludes: - docker-compose.yml (contains resolved secrets) - s3_config.json (contains resolved secrets) - Data directories (gitea/, postgres/, seaweedfs/) Refs: Private deployment on bigbox with TerraphimPlatform vault
135 lines
4.0 KiB
Plaintext
135 lines
4.0 KiB
Plaintext
version: "3"
|
|
# Template file - use 'op inject' to generate docker-compose.yml
|
|
# This file contains 1Password references (op://) and should NOT be deployed directly
|
|
# Run: op inject --in-file docker-compose.yml.template --out-file docker-compose.yml
|
|
#
|
|
# Network Configuration:
|
|
# - Gitea: Public via Caddy (git.terraphim.cloud) -> localhost:3000
|
|
# - Prometheus: Tailscale only (100.106.66.7:9000)
|
|
# - S3: Tailscale only (100.106.66.7:8333)
|
|
# - Other SeaweedFS: Internal Docker network only (no external exposure)
|
|
|
|
networks:
|
|
gitea:
|
|
external: false
|
|
|
|
services:
|
|
server:
|
|
image: gitea/gitea:1.22.6
|
|
container_name: gitea
|
|
environment:
|
|
- USER_UID=1000
|
|
- USER_GID=1000
|
|
- GITEA__database__DB_TYPE=postgres
|
|
- GITEA__database__HOST=db:5432
|
|
- GITEA__database__NAME=gitea
|
|
- GITEA__database__USER=gitea
|
|
- GITEA__database__PASSWD=op://TerraphimPlatform/gitea-postgres/password
|
|
- GITEA__actions__ENABLE=true
|
|
- GITEA__repository__LFS_START_SERVER=true
|
|
- GITEA__repository__LFS_CONTENT_PATH=/data/lfs
|
|
- GITEA__storage__type=minio
|
|
- GITEA__storage__MINIO_ACCESS_KEY_ID=op://TerraphimPlatform/gitea-s3/access-key
|
|
- GITEA__storage__MINIO_SECRET_ACCESS_KEY=op://TerraphimPlatform/gitea-s3/secret-key
|
|
- GITEA__storage__MINIO_BUCKET=gitea
|
|
- GITEA__storage__MINIO_LOCATION=us-east-1
|
|
# Use Tailscale IP for internal S3 access
|
|
- GITEA__storage__MINIO_ENDPOINT=http://100.106.66.7:8333
|
|
- GITEA__storage__MINIO_INSECURE_SKIP_VERIFY=false
|
|
- GITEA__storage__MINIO_USE_SSL=false
|
|
- GITEA__storage__SERVE_DIRECT=true
|
|
user: "1000:1000"
|
|
restart: always
|
|
networks:
|
|
- gitea
|
|
volumes:
|
|
- ./gitea:/data
|
|
- /etc/timezone:/etc/timezone:ro
|
|
- /etc/localtime:/etc/localtime:ro
|
|
ports:
|
|
# Gitea HTTP - localhost only (accessed via Caddy reverse proxy)
|
|
- "127.0.0.1:3000:3000"
|
|
# Gitea SSH - exposed on all interfaces
|
|
- "222:22"
|
|
depends_on:
|
|
- db
|
|
- s3
|
|
|
|
db:
|
|
image: postgres:15
|
|
restart: always
|
|
environment:
|
|
- POSTGRES_USER=gitea
|
|
- POSTGRES_PASSWORD=op://TerraphimPlatform/gitea-postgres/password
|
|
- POSTGRES_DB=gitea
|
|
networks:
|
|
- gitea
|
|
volumes:
|
|
- ./postgres:/var/lib/postgresql/data
|
|
# No external ports - internal Docker network only
|
|
|
|
master:
|
|
image: chrislusf/seaweedfs
|
|
# No external ports - internal Docker network only
|
|
command: "master -ip=master -ip.bind=0.0.0.0 -metricsPort=9324"
|
|
networks:
|
|
- gitea
|
|
|
|
volume:
|
|
image: chrislusf/seaweedfs
|
|
# No external ports - internal Docker network only
|
|
command: 'volume -mserver="master:9333" -ip.bind=0.0.0.0 -port=8080 -metricsPort=9325'
|
|
depends_on:
|
|
- master
|
|
volumes:
|
|
- ./seaweedfs:/data
|
|
networks:
|
|
- gitea
|
|
|
|
filer:
|
|
image: chrislusf/seaweedfs
|
|
# No external ports - internal Docker network only
|
|
command: 'filer -master="master:9333" -ip.bind=0.0.0.0 -metricsPort=9326'
|
|
tty: true
|
|
stdin_open: true
|
|
depends_on:
|
|
- master
|
|
- volume
|
|
volumes:
|
|
- ./seaweedfs_filter:/data
|
|
networks:
|
|
- gitea
|
|
|
|
s3:
|
|
image: chrislusf/seaweedfs
|
|
container_name: s3storage
|
|
hostname: s3storage
|
|
ports:
|
|
# Bind to Tailscale interface only (100.106.66.7)
|
|
# Accessible only within Tailscale network, not public internet
|
|
- "100.106.66.7:8333:8333"
|
|
- "100.106.66.7:9327:9327"
|
|
command: 's3 -config=/etc/seaweedfs/s3.json -filer="filer:8888" -ip.bind=0.0.0.0 -metricsPort=9327'
|
|
depends_on:
|
|
- master
|
|
- volume
|
|
- filer
|
|
volumes:
|
|
- ./s3_config.json:/etc/seaweedfs/s3.json
|
|
networks:
|
|
- gitea
|
|
|
|
prometheus:
|
|
image: prom/prometheus:v2.21.0
|
|
ports:
|
|
# Bind to Tailscale interface only (100.106.66.7)
|
|
# Accessible only within Tailscale network, not public internet
|
|
- "100.106.66.7:9000:9090"
|
|
volumes:
|
|
- ./prometheus:/etc/prometheus
|
|
command: --web.enable-lifecycle --config.file=/etc/prometheus/prometheus.yml
|
|
depends_on:
|
|
- s3
|
|
networks:
|
|
- gitea
|