alpine-cgit

---
services:
  cgit:
    container_name: cgit
    deploy:
      resources:
        limits:
          cpus: '2.00'
          memory: 2048M  # may need more memory for sync job
      restart_policy:
        condition: on-failure
        delay: 10s
        max_attempts: 5
        window: 120s
    environment:
      # CGIT_REPODIR: /home/git/repositories
      # CGIT_SYNC_IGNORELIST: /home/git/repositories/ignored.txt
      # CGIT_SYNC_ERRORLIST: /home/git/repositories/errors.txt
      # CGIT_SYNC_JOBS: 1
      PUID: ${PUID:-1000}
      PGID: ${PGID:-100}
      # TZ: ${TZ}
    # healthcheck:
    #   interval: 2m
    #   retries: 5
    #   start_period: 5m
    #   test:
    #     - CMD-SHELL
    #     - >
    #       curl -f http://localhost:80/git/ || exit 1
    #   timeout: 20s
    hostname: cgit
    image: woahbase/alpine-cgit:${CGIT_TAG:-latest}
    network_mode: bridge
    ports:
      - protocol: tcp
        host_ip: 0.0.0.0
        published: ${CGIT_PORT_SSH:-22}
        target: 22
      - protocol: tcp
        host_ip: 0.0.0.0
        published: ${CGIT_PORT_HTTP:-80}
        target: 80
    volumes:
      - type: bind
        source: ${CGIT_DIR:?err}/git
        target: /home/git
        bind:
          create_host_path: true
      - type: bind
        source: ${CGIT_DIR:?err}/repositories
        target: /home/git/repositories
        bind:
          create_host_path: true
      - type: bind
        source: ${CGIT_DIR:?err}/ssh
        target: /etc/ssh
        bind:
          create_host_path: true
      # - type: bind
      #   source: ${CGIT_DIR:?err}/configs/cgitrc
      #   target: /etc/cgitrc
      #   bind:
      #     create_host_path: false
      # - type: bind
      #   source: ${CGIT_DIR:?err}/configs/scripts
      #   target: /config/scripts
      #   bind:
      #     create_host_path: false
      # - type: bind
      #   source: ${CGIT_DIR:?err}/configs/web
      #   target: /var/www
      #   bind:
      #     create_host_path: false
      - type: bind
        source: /etc/localtime
        target: /etc/localtime
        read_only: true
        bind:
          create_host_path: false

variables {
  dc   = "dc1" # to load the dc-local config file
  pgid = 100   # gid for docker
  puid = 1000  # uid for docker
  version = "1.2.3"
}
# locals { var = yamldecode(file("${var.dc}.vars.yml")) } # load dc-local config file

job "cgit" {
  datacenters = [var.dc]
  # namespace   = local.var.namespace
  priority    = 80
  # region      = local.var.region
  type        = "service"

  # vault { policies = ["nomad-kv-readonly"] }

  group "docker" {
    count = 1

    restart {
      attempts = 2
      interval = "2m"
      delay    = "15s"
      mode     = "fail"
    }
    update {
      max_parallel      = 1
      min_healthy_time  = "10s"
      healthy_deadline  = "10m"
      progress_deadline = "15m"
      auto_revert       = false
    }

    service {
      name        = NOMAD_JOB_NAME
      port        = "http"
      tags        = ["ins${NOMAD_ALLOC_INDEX}", attr.unique.hostname, "aid=${NOMAD_ALLOC_ID}", "urlprefix-/git"]
      canary_tags = ["canary${NOMAD_ALLOC_INDEX}", "urlprefix-/c/git"]
      check {
        name      = "${NOMAD_JOB_NAME}@${attr.unique.hostname}:${NOMAD_HOST_PORT_http}=>${NOMAD_PORT_http}"
        type      = "http"
        path      = "/git/?p=about"
        interval  = "60s"
        timeout   = "10s"
      }
      check_restart {
        limit     = 3
        grace     = "10m"
      }
    }

    service {
      name        = "${NOMAD_JOB_NAME}-ssh"
      port        = "ssh"
      tags        = ["ins${NOMAD_ALLOC_INDEX}", attr.unique.hostname, "aid=${NOMAD_ALLOC_ID}", "host=git"]
      canary_tags = ["canary${NOMAD_ALLOC_INDEX}"]
      check {
        name      = "${NOMAD_JOB_NAME}@${attr.unique.hostname}:${NOMAD_HOST_PORT_http}=>${NOMAD_PORT_ssh}"
        type      = "tcp"
        interval  = "60s"
        timeout   = "10s"
      }
      check_restart {
        limit     = 3
        grace     = "10m"
      }
    }

    ephemeral_disk { size = 128 } # MB
    network {
      # dns { servers = local.var.dns_servers }
      port "http" {
        static = 64801
        to     = 80
      }
      port "ssh"  {
        static = 64822
        to     = 22
      }
    }
    volume "nomad-cgit-repos" {
      type      = "host"
      read_only = false
      source    = "nomad-cgit-repos"
    }
    volume "nomad-cgit-hostkeys" {
      type      = "host"
      read_only = false
      source    = "nomad-cgit-hostkeys"
    }
    volume "nomad-cgit-userkeys" {
      type      = "host"
      read_only = false
      source    = "nomad-cgit-userkeys"
    }
    # volume "nomad-cgit-scripts" {
    #   type      = "host"
    #   read_only = false
    #   source    = "nomad-cgit-scripts"
    # }
    volume "nomad-cgit-web" {
      type      = "host"
      read_only = false
      source    = "nomad-cgit-web"
    }

    task "cgit" {
      driver = "docker"

      config {
        healthchecks { disable = true }
        hostname     = NOMAD_JOB_NAME
        image        = "${local.var.docker_registry.url}/woahbase/alpine-cgit:${var.version}"
        network_mode = "bridge"
        ports        = ["http", "ssh"]

        # volumes      = [
        #   "/path/to/your/cgit/git/.ssh:/home/git/.ssh",
        #   "/path/to/your/cgit/scripts:/scripts",
        #   "/path/to/your/cgit/hooks:/defaults/hooks",
        #   "/path/to/your/cgit/ssh:/etc/ssh",
        #   "/path/to/your/cgit/web:/var/www"
        # ]

        logging {
          type = "journald"
          config {
            mode = "non-blocking"
            tag = NOMAD_JOB_NAME
          }
        }

        mount {
          source   = "local/cgitrc"
          target   = "/etc/cgitrc"
          type     = "bind"
          readonly = true
        }
        mount {
          type     = "bind"
          target   = "/etc/localtime"
          source   = "/etc/localtime"
          readonly = true
        }
      }

      volume_mount {
        # ensure policies allow vault-generated-token to read-write to the volume
        volume      = "nomad-cgit-repos"
        destination = "/home/git/repositories"
        read_only   = false
      }

      volume_mount {
        volume      = "nomad-cgit-hostkeys"
        destination = "/etc/ssh"
        read_only   = false
      }

      # volume_mount {
      #   volume      = "nomad-cgit-scripts"
      #   destination = "/scripts"
      #   read_only   = true
      # }

      volume_mount {
        volume      = "nomad-cgit-userkeys"
        destination = "/home/git/.ssh"
        read_only   = false
      }

      volume_mount {
        volume      = "nomad-cgit-web"
        destination = "/var/www"
        read_only   = true
      }

      env {
        PGID = var.pgid
        PUID = var.puid
        # TZ   = local.var.tz
      }

      resources {
        cpu    = 1536 # MHz
        memory = 2048 # MB
      }

      template {
        change_mode = "restart"
        destination = "local/cgitrc"
        data        = <<-EOC
          {{ key "nomad/${var.dc}/cgit/cgitrc" }}
        EOC
        error_on_missing_key = true
      }
    }
  }
}

upstream proxy_cgit {
    server your.host.local:<cgit-port> fail_timeout=5;
}

## the following goes inside a server block

location /cgit { return 301 /cgit/; }
location /cgit/ {
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;

    proxy_connect_timeout 300;
    proxy_read_timeout 300;
    proxy_redirect redirect replacement;
    proxy_pass http://proxy_cgit;
}

location /git { return 301 /git/; }
location /git/ {
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;

    proxy_connect_timeout 300;
    proxy_read_timeout 300;
    proxy_redirect redirect replacement;
    proxy_pass http://proxy_cgit;
}

make build test ARCH=aarch64 

make build test ARCH=armhf 

make build test ARCH=armv7l 

make build test ARCH=x86_64 

make push ARCH=aarch64 

make push ARCH=armhf 

make push ARCH=armv7l 

make push ARCH=x86_64