From 7bc5c3a2d7a66dabae3f99f294de87ef4b74b007 Mon Sep 17 00:00:00 2001
From: admin <alec@bryanmail.net>
Date: Sat, 20 Jun 2026 21:07:22 -0700
Subject: [PATCH] Add Woodpecker CI/CD server and agents compose file

---
 woodpecker.yaml | 87 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 woodpecker.yaml

diff --git a/woodpecker.yaml b/woodpecker.yaml
new file mode 100644
index 0000000..b1baa75
--- /dev/null
+++ b/woodpecker.yaml
@@ -0,0 +1,87 @@
+version: '3.8'
+
+services:
+  # Woodpecker Server - Central orchestration
+  woodpecker-server:
+    image: woodpeckerci/woodpecker-server:latest
+    ports:
+      - "8000:8000"  # HTTP
+      - "9000:9000"  # gRPC (agents communicate here)
+    environment:
+      # Server configuration
+      WOODPECKER_HOST: https://woodpecker.bryanmail.net
+      WOODPECKER_PROTO: https
+      WOODPECKER_OPEN: "false"  # Private instance
+      
+      # Gitea integration
+      WOODPECKER_GITEA: "true"
+      WOODPECKER_GITEA_URL: https://git.bryanmail.net
+      WOODPECKER_GITEA_CLIENT: ${WOODPECKER_GITEA_CLIENT}
+      WOODPECKER_GITEA_SECRET: ${WOODPECKER_GITEA_SECRET}
+      
+      # Agent security
+      WOODPECKER_AGENT_SECRET: ${WOODPECKER_AGENT_SECRET}
+      
+      # Allow organizations
+      WOODPECKER_ORGS: homelab,admin
+      
+      # Logging
+      WOODPECKER_LOG_LEVEL: info
+      
+      # Database (using existing PostgreSQL)
+      WOODPECKER_DATABASE_DRIVER: postgres
+      WOODPECKER_DATABASE_DATASOURCE: postgres://${DB_USER}:${DB_PASS}@postgresql:5432/woodpecker?sslmode=disable
+      
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    networks:
+      - traefik_backend
+      - postgresql_db-backend
+    deploy:
+      replicas: 1
+      placement:
+        constraints:
+          - node.hostname == docker-2  # Run on manager node only
+      labels:
+        - traefik.enable=true
+        - traefik.http.routers.woodpecker.entrypoints=websecure
+        - "traefik.http.routers.woodpecker.rule=Host(`woodpecker.bryanmail.net`)"
+        - traefik.http.routers.woodpecker.tls=true
+        - traefik.http.routers.woodpecker.tls.certresolver=letsencrypt
+        - traefik.docker.network=traefik_backend
+        - traefik.http.services.woodpecker.loadbalancer.server.port=8000
+
+  # Woodpecker Agents - Pipeline execution
+  woodpecker-agent:
+    image: woodpeckerci/woodpecker-agent:latest
+    command: agent
+    environment:
+      # Server connection
+      WOODPECKER_SERVER: woodpecker-server:9000
+      WOODPECKER_AGENT_SECRET: ${WOODPECKER_AGENT_SECRET}
+      
+      # Agent configuration
+      WOODPECKER_MAX_PROCS: 4  # Max parallel builds per agent
+      WOODPECKER_LOG_LEVEL: info
+      
+      # Labels for scheduling
+      WOODPECKER_FILTER_LABELS: "true"
+      
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+      - /etc/timezone:/etc/timezone:ro
+      - /etc/localtime:/etc/localtime:ro
+    networks:
+      - traefik_backend
+    deploy:
+      mode: global  # One agent per node
+    depends_on:
+      - woodpecker-server
+
+networks:
+  traefik_backend:
+    external: true
+  postgresql_db-backend:
+    external: true