version: '3.8'

services:
  # Woodpecker Server - Central orchestration
  woodpecker-server:
    image: woodpeckerci/woodpecker-server:latest
    ports:
      - "8000:8000"  # HTTP
      - "9000:9000"  # gRPC (agents communicate here)
    environment:
      # Server configuration
      WOODPECKER_HOST: https://woodpecker.bryanmail.net
      WOODPECKER_PROTO: https
      WOODPECKER_OPEN: "false"  # Private instance
      
      # Gitea integration
      WOODPECKER_GITEA: "true"
      WOODPECKER_GITEA_URL: https://git.bryanmail.net
      WOODPECKER_GITEA_CLIENT: ${WOODPECKER_GITEA_CLIENT}
      WOODPECKER_GITEA_SECRET: ${WOODPECKER_GITEA_SECRET}
      
      # Agent security
      WOODPECKER_AGENT_SECRET: ${WOODPECKER_AGENT_SECRET}
      
      # Allow organizations
      WOODPECKER_ORGS: homelab,admin
      
      # Logging
      WOODPECKER_LOG_LEVEL: info
      
      # Database (using existing PostgreSQL)
      WOODPECKER_DATABASE_DRIVER: postgres
      WOODPECKER_DATABASE_DATASOURCE: postgres://${DB_USER}:${DB_PASS}@postgresql:5432/woodpecker?sslmode=disable
      
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    networks:
      - traefik_backend
      - postgresql_db-backend
    deploy:
      replicas: 1
      placement:
        constraints:
          - node.hostname == docker-2  # Run on manager node only
      labels:
        - traefik.enable=true
        - traefik.http.routers.woodpecker.entrypoints=websecure
        - "traefik.http.routers.woodpecker.rule=Host(`woodpecker.bryanmail.net`)"
        - traefik.http.routers.woodpecker.tls=true
        - traefik.http.routers.woodpecker.tls.certresolver=letsencrypt
        - traefik.docker.network=traefik_backend
        - traefik.http.services.woodpecker.loadbalancer.server.port=8000

  # Woodpecker Agents - Pipeline execution
  woodpecker-agent:
    image: woodpeckerci/woodpecker-agent:latest
    command: agent
    environment:
      # Server connection
      WOODPECKER_SERVER: woodpecker-server:9000
      WOODPECKER_AGENT_SECRET: ${WOODPECKER_AGENT_SECRET}
      
      # Agent configuration
      WOODPECKER_MAX_PROCS: 4  # Max parallel builds per agent
      WOODPECKER_LOG_LEVEL: info
      
      # Labels for scheduling
      WOODPECKER_FILTER_LABELS: "true"
      
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    networks:
      - traefik_backend
    deploy:
      mode: global  # One agent per node
    depends_on:
      - woodpecker-server

networks:
  traefik_backend:
    external: true
  postgresql_db-backend:
    external: true