docker-compose.yml

services:
  # Tailscale sidecar — joins the tailnet as `forgejo`, terminating HTTPS for
  # https://forgejo.<tailnet>.ts.net and exposing git SSH on :22. See HTTPS.md.
  forgejo-ts:
    image: tailscale/tailscale:latest
    container_name: forgejo-ts
    hostname: forgejo
    environment:
      - TS_AUTHKEY=${TS_AUTHKEY}
      - TS_STATE_DIR=/var/lib/tailscale
      - TS_SERVE_CONFIG=/config/serve.json
      # Requires TS_AUTHKEY to be allowed to apply tag:container (OAuth client, or
      # a tag-scoped auth key). Drop this line if using an untagged personal key.
      - TS_EXTRA_ARGS=--advertise-tags=tag:container
    volumes:
      - ./ts-state:/var/lib/tailscale
      - ./ts-serve.json:/config/serve.json:ro
    devices:
      - /dev/net/tun:/dev/net/tun
    cap_add:
      - NET_ADMIN
    restart: unless-stopped

  forgejo:
    # Pin to a major version tag to avoid surprise upgrades — check latest at:
    # https://codeberg.org/forgejo/forgejo/releases
    image: codeberg.org/forgejo/forgejo:15
    container_name: forgejo
    # Share the sidecar's network namespace: tailscale serve proxies :443 to
    # 127.0.0.1:3000, and git SSH is reachable at forgejo.<tailnet>.ts.net:22.
    network_mode: service:forgejo-ts
    depends_on:
      - forgejo-ts
    restart: unless-stopped
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - TZ=${TZ:-America/Los_Angeles}
      - FORGEJO__database__DB_TYPE=sqlite3
      - FORGEJO__server__ROOT_URL=https://${FORGEJO_DOMAIN}/
      - FORGEJO__server__SSH_DOMAIN=${FORGEJO_DOMAIN}
      - FORGEJO__server__SSH_PORT=22
    volumes:
      - ${FORGEJO_DATA_PATH:-./data}:/data
    healthcheck:
      test: ["CMD", "wget", "--spider", "-q", "http://localhost:3000"]
      interval: 30s
      timeout: 5s
      retries: 3

  # Loopback static server for the homepage "forgejo-runner" card. The host
  # systemd timer (forgejo-runner-status.timer → runner-status.sh) writes
  # runner-status.json here; homepage is host-networked, so localhost reaches it.
  # Not user-facing — bound to loopback, no Tailscale sidecar.
  forgejo-runner-status:
    image: nginx:alpine
    container_name: forgejo-runner-status
    restart: unless-stopped
    ports:
      - "127.0.0.1:8098:80"
    volumes:
      - ./runner-status:/usr/share/nginx/html:ro