docker-compose-8c16g.yml

version: '3.8'

networks:
  default_network:
    driver: bridge

include:
  - ./${MQTT_PLUG:-emqx}.yml

services:
  frontend:
    image: eco-registry.supos.com/sup9bnlh/supos-frontend-platform:${frontend_imageTag}
    container_name: frontend
    ports:
      - "3010:3000"
      - "4000:4000"
      - "3001:3001"
      - "3002:3002"
    environment:
      - OPENAI_API_KEY=${OPENAI_API_KEY}
      - OPENAI_API_MODEL=${OPENAI_API_MODEL}
      - REACT_APP_OS_LANG=${LANGUAGE}
    volumes:
      - plugin_front:/app/plugins-build
      - /etc/docker/certs:/certs
    networks:
      - default_network
    restart: always
    extra_hosts:
      - "host.docker.internal:host-gateway"
  backend:
    image:  eco-registry.supos.com/sup9bnlh/backend:${backend_imageTag}
    container_name: backend
    environment:
      - TZ=UTC
      - GRPC_POOL_CORE_SIZE=4
      - GRPC_POOL_MAX_SIZE=8
      - ENV_DB_HOST=postgresql
      - ENV_DB_PORT=5432
      - NODE_RED_HOST=nodered
      - NODE_RED_PORT=1880
      - SYS_OS_MULTIPLE_TOPIC=false
      - SYS_OS_VERSION=${OS_VERSION}
      - SYS_OS_LANG=${LANGUAGE}
      - SYS_OS_AUTH_ENABLE=${OS_AUTH_ENABLE}
      - SYS_OS_LLM_TYPE=${OS_LLM_TYPE}
      - SYS_OS_MQTT_TCP_PORT=${OS_MQTT_TCP_PORT}
      - SYS_OS_MQTT_WEBSOCKET_TSL_PORT=${OS_MQTT_WEBSOCKET_TSL_PORT}
      - SYS_OS_LOGIN_PATH=${OS_LOGIN_PATH}
      - SYS_OS_APP_TITLE=${OS_NAME}
      - SYS_OS_PLATFORM_TYPE=${OS_PLATFORM_TYPE}
      - SYS_OS_ENTRANCE_URL=${ENTRANCE_PROTOCOL}://${ENTRANCE_DOMAIN}:${ENTRANCE_PORT}
      - SYS_OS_USE_ALIAS_PATH_AS_TOPIC=${USE_ALIAS_PATH_AS_TOPIC}
      - SYS_OS_QUALITY_NAME=quality
      - SYS_OS_TIMESTAMP_NAME=timeStamp
      - SYS_OS_LAZY_TREE=${LAZY_TREE}
      - MQTT_PLUGIN=${MQTT_PLUG:-emqx}
      - UNS_ADD_BATCH_SIZE=500
      - ENABLE_CHAT2DB=true
      - HASP_SERVER=${HASP_SERVER}
      - OAUTH_REDIRECT_URI=${ENTRANCE_PROTOCOL}://${ENTRANCE_DOMAIN}:${ENTRANCE_PORT}/inter-api/supos/auth/token
      - OAUTH_SUPOS_HOME=${ENTRANCE_PROTOCOL}://${ENTRANCE_DOMAIN}:${ENTRANCE_PORT}/home
      - OAUTH_REALM=${OAUTH_REALM}
      - OAUTH_CLIENT_NAME=${OAUTH_CLIENT_NAME}
      - OAUTH_CLIENT_ID=${OAUTH_CLIENT_ID}
      - OAUTH_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
      - OAUTH_GRANT_TYPE=${OAUTH_GRANT_TYPE}
      - OAUTH_ISSUER_URI=${OAUTH_ISSUER_URI}
      - OAUTH_REFRESH_TOKEN_TIME=${OAUTH_REFRESH_TOKEN_TIME}
      - ELASTICSEARCH_VERSION=${ELASTICSEARCH_VERSION}
      - ELASTICSEARCH_TIMEHORIZON=${ELASTICSEARCH_TIMEHORIZON}
      - SYS_OS_LDAP_ENABLE=${LDAP_ENABLE}
      - SYS_OS_LDAP_URL=${LDAP_URL}
      - SYNC_USER_ENABLE=${SYNC_USER_ENABLE}
      - SUPOS_EE_ADDRESS=${SUPOS_EE_ADDRESS}
    ports:
      - "19099:19099"
    deploy:
      resources:
        limits:
          memory: 4G
        reservations:
          memory: 3G
    volumes:
      - ${VOLUMES_PATH}/backend/entrypoint.sh:/entrypoint.sh
      - ${VOLUMES_PATH}/backend/apps:/data/apps
      - ${VOLUMES_PATH}/backend/third-apps:/data/third-apps
      - ${VOLUMES_PATH}/plugins/package:/data/plugins
      - plugin_front:/data/plugins-frontend
      - ${VOLUMES_PATH}/backend/uns:/data/uns
      - ${VOLUMES_PATH}/backend/system:/data/system
      - ${VOLUMES_PATH}/backend/log:/logs
      - ${VOLUMES_PATH}/backend/global-export:/data/global-export
      - ${VOLUMES_PATH}/i18n:/data/i18n
      - ${VOLUMES_PATH}/backend/excel:/data/excel
      - /etc/docker/certs:/certs
    cap_add:
      - SYS_PTRACE
    depends_on:
      - postgresql
      - emqx
      - nodered
      - keycloak
      - chat2db
    restart: always
    networks:
      - default_network
    extra_hosts:
      - "host.docker.internal:host-gateway"
  nodered:
    image: nodered/node-red:4.0.8-22
    container_name: nodered
    user: root
    ports:
      - "1880:1880"  # Node-RED web UI端口
    environment:
      - service_logo=nodered-original.svg
      - service_description=aboutus.nodeRedDescription
      - FLOWS=/data/flows.json
      - TZ=UTC
      - TIMESTAMP_NAME=timeStamp
      - QUALITY_NAME=quality
      - OS_LANG=${LANGUAGE}
      - USE_ALIAS_AS_TOPIC=${USE_ALIAS_PATH_AS_TOPIC}
      - NODE_OPTIONS=--openssl-legacy-provider
      - NODE_HTTP_API_PREFIX=/nodered-api
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${VOLUMES_PATH}/node-red:/data  # 使用当前目录的 data 目录
    restart: always
    networks:
      - default_network
  eventflow:
    image: nodered/node-red:4.0.8-22
    container_name: eventflow
    profiles:
      - eventflow
    user: root
    ports:
      - "1889:1889"  # Node-RED web UI端口
    environment:
      - service_logo=nodered-original.svg
      - service_description=aboutus.nodeRedDescription
      - FLOWS=/data/flows.json
      - USE_ALIAS_AS_TOPIC=${USE_ALIAS_PATH_AS_TOPIC}
      - QUALITY_NAME=status
      - TIMESTAMP_NAME=timeStamp
      - TZ=UTC
      - OS_LANG=${LANGUAGE}
      - NODE_OPTIONS=--openssl-legacy-provider
      - NODE_HTTP_API_PREFIX=/eventflow-api
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${VOLUMES_PATH}/eventflow:/data  # 使用当前目录的 data 目录
    restart: always
    networks:
      - default_network
  grafana:
    image: grafana/grafana:11.4.0
    profiles:
      - grafana
    container_name: grafana
    user: root
    ports:
      - "3000:3000"  # Grafana web UI端口
    volumes:
      - ${VOLUMES_PATH}/grafana/data:/var/lib/grafana
      # - ${VOLUMES_PATH}/grafana/data/plugins:/var/lib/grafana/plugins  # 使用当前目录的 data 目录
    environment:
      service_logo: grafana-original.svg
      service_description: aboutus.grafanaDescription
      service_redirect_url: /grafana/home/dashboards/
      # 设置管理员用户的初始密码
      GF_SECURITY_ADMIN_PASSWORD: "supos"
      # 开启 Grafana 的 Explore 功能
      GF_EXPLORE_ENABLED: "true"
      # 安装 Grafana 插件
      # GF_INSTALL_PLUGINS: "grafana-clock-panel,grafana-mqtt-datasource,tdengine-datasource,yesoreyeram-infinity-datasource"
      # 注释掉的设置，用于改变 Grafana 用户界面的语言
      GF_VIEWER_LANGUAGE: "${GRAFANA_LANG:-en-US}"
      GF_AUTH_ANONYMOUS_ENABLED: "true"
      GF_AUTH_ANONYMOUS_ORG_ROLE: "Admin"
      GF_SECURITY_ALLOW_EMBEDDING: "true"
      GF_SERVER_ROOT_URL: "http://${ENTRANCE_DOMAIN}/grafana/home/"
      GF_USERS_DEFAULT_THEME: "light"
      GF_DATABASE_TYPE: postgres
      GF_DATABASE_HOST: postgresql:5432
      GF_DATABASE_NAME: grafana
      GF_DATABASE_USER: postgres
      GF_DATABASE_PASSWORD: postgres
    depends_on:
      postgresql:
        condition: service_healthy  # 依赖 PostgreSQL 的健康状态
    restart: always
    networks:
      - default_network
  postgresql:
    image: timescale/timescaledb:2.20.0-pg17
    container_name: postgresql
    environment:
      TZ: UTC  # 设置容器时区
      service_logo: postgresql-original.svg
      service_description: aboutus.postgresqlDescription
      POSTGRES_PASSWORD: postgres
    shm_size: '2g'
    ports:
      - "5432:5432"
    volumes:
      - ${VOLUMES_PATH}/postgresql/conf/postgresql.conf:/etc/postgresql/custom.conf
      - ${VOLUMES_PATH}/postgresql/pgdata:/var/lib/postgresql/data # 持久化数据
      - ${VOLUMES_PATH}/postgresql/init-scripts:/docker-entrypoint-initdb.d  # 加载初始化脚本
    command:
      - postgres
      - -c
      - config_file=/etc/postgresql/custom.conf
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 60
      start_period: 60s
      start_interval: 60s
    restart: always
    networks:
      - default_network
    deploy:
     resources:
       limits:
         memory: 4G
       reservations:
         memory: 3G
  tsdb:
    image: timescale/timescaledb:2.20.0-pg17
    container_name: tsdb
    environment:
      TZ: UTC  # 设置容器时区
      service_logo: postgresql-original.svg
      service_description: aboutus.postgresqlDescription
      POSTGRES_PASSWORD: postgres
    shm_size: '2g'
    ports:
      - "2345:5432"
    volumes:
      - ${VOLUMES_PATH}/tsdb/conf/postgresql.conf:/etc/postgresql/custom.conf
      - ${VOLUMES_PATH}/tsdb/data:/var/lib/postgresql/data # 持久化数据
      - ${VOLUMES_PATH}/tsdb/init-scripts:/docker-entrypoint-initdb.d  # 加载初始化脚本
    command:
      - postgres
      - -c
      - config_file=/etc/postgresql/custom.conf
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 60
      start_period: 60s
      start_interval: 60s
    restart: always
    deploy:
     resources:
       limits:
         memory: 4G
       reservations:
         memory: 3G
    networks:
      - default_network
  keycloak:
    image: keycloak/keycloak:26.0  # 使用 Keycloak 的最新镜像
    container_name: keycloak
    ports:
      - "8081:8080"
    user: root
    deploy:
      resources:
        limits:
          memory: 1G
        reservations:
          memory: 512M
    environment:
      service_logo: keycloak-original.svg
      service_description: aboutus.keycloakDescription
      service_redirect_url: /keycloak/home/
      service_account: admin
      service_password: supos
      KC_SSL_REQUIRED: none  # 不要求 SSL
      KC_PROXY: passthrough                       # 设置代理模式
      KC_HOSTNAME: "${ENTRANCE_DOMAIN}"              # 指定主机名
      KC_FRONTEND_URL: "https://${ENTRANCE_DOMAIN}:${ENTRANCE_PORT}"  # 设置前端 URL
      KC_BOOTSTRAP_ADMIN_USERNAME: admin
      KC_BOOTSTRAP_ADMIN_PASSWORD: supos
      KC_COOKIE_SECURE: false                          # 禁用安全 cookie
      KC_DB: postgres
      KC_DB_URL: "jdbc:postgresql://postgresql:5432/keycloak"
      KC_DB_USERNAME: postgres
      KC_DB_PASSWORD: postgres
      KC_DB_POOL_INITIAL_SIZE: 2
      KC_DB_POOL_MIN_SIZE: 2
      KC_DB_POOL_MAX_SIZE: 4
      KC_DB_POOL_MAX_LIFETIME: 1800
      KC_HEALTH_ENABLED: true
      KC_FEATURES: token-exchange
      JAVA_OPTS_APPEND: -Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ${VOLUMES_PATH}/keycloak/data:/opt/keycloak/data  # 将 Keycloak 的数据目录挂载到本地
      - ${VOLUMES_PATH}/keycloak/theme/keycloak.v2:/opt/keycloak/themes/wenhao
      - ${VOLUMES_PATH}/keycloak/ca/ca.crt:/opt/keycloak/ca.crt
      - ${VOLUMES_PATH}/keycloak/ca/init-ldaps-cert.sh:/opt/keycloak/init-ldaps-cert.sh
    depends_on:
      postgresql:
        condition: service_healthy  # 依赖 PostgreSQL 的健康状态
    entrypoint:
      - /bin/bash
      - -c
      - |
        chmod +x /opt/keycloak/init-ldaps-cert.sh && \
        bash /opt/keycloak/init-ldaps-cert.sh && \
        exec /opt/keycloak/bin/kc.sh start-dev --hostname ${ENTRANCE_PROTOCOL}://${ENTRANCE_DOMAIN}:${ENTRANCE_PORT}/keycloak/home/auth --proxy-headers forwarded
#    command: start-dev --hostname ${ENTRANCE_PROTOCOL}://${ENTRANCE_DOMAIN}:${ENTRANCE_PORT}/keycloak/home/auth  --proxy-headers forwarded
    healthcheck:
      test: >
        /bin/bash -c "
        exec 3<>/dev/tcp/localhost/8080"
      interval: 10s
      timeout: 5s
      retries: 120
    restart: always
    networks:
      - default_network
  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch-oss:7.10.2
    container_name: elasticsearch
    profiles:
      - elk
    environment:
      - service_logo=elasticsearch.svg
      - discovery.type=single-node
      - ES_JAVA_OPTS=-Xms512m -Xmx768m  # 最小 512MB，最大 768m
      #    volumes:
      #      - es_data:/usr/share/elasticsearch/data
    healthcheck:
      #      test: ["CMD-SHELL", "curl -fsSL http://elasticsearch:9200/_cluster/health | grep -q '\"status\":\"green\"'"]
      test: [ "CMD", "curl", "-f", "http://elasticsearch:9200/_cluster/health?wait_for_status=yellow&timeout=1s" ]
      interval: 30s
      timeout: 10s
      retries: 10
      start_period: 30s
    restart: always
    networks:
      - default_network
  kibana:
    image: docker.elastic.co/kibana/kibana-oss:7.10.2
    container_name: kibana
    profiles:
      - elk
    environment:
      - csp.enabled=false  # 禁用 CSP 插件
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
      - csp.strict=false  # 禁用 Content Security Policy (CSP)
      - ELASTICSEARCH_REQUESTTIMEOUT=120000  # 将超时设置为60秒
      - server.basePath=/elastic/home  # 设置 basePath 为 /elastic/home
      - server.rewriteBasePath=true  # 启用 basePath 重写
      - server.host=0.0.0.0
      - csp.warnLegacyBrowsers=false  # 禁用对旧版浏览器的 CSP 警告
    volumes:
      - ${VOLUMES_PATH}/kibana/kibana.yml:/usr/share/kibana/config/kibana.yml  # 挂载本地 kibana.yml 文件
    ports:
      - "5601:5601"
    depends_on:
      elasticsearch:
        condition: service_healthy
    restart: always
    networks:
      - default_network
  filebeat:
    image: docker.elastic.co/beats/filebeat-oss:7.10.2
    container_name: filebeat
    profiles:
      - elk
    user: root
    environment:
      - ELASTICSEARCH_HOSTS=http://elasticsearch:9200
    volumes:
      - /var/lib/docker/containers:/var/lib/docker/containers:ro
      - ${VOLUMES_PATH}/filebeat/log:/log:ro
      - ${VOLUMES_PATH}/filebeat/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro
      - /var/run/docker.sock:/var/run/docker.sock
      - ${VOLUMES_PATH}/backend/log:/logs/backend
      - ${VOLUMES_PATH}/node-red/log:/logs/node-red
    entrypoint: [ "/bin/sh", "-c", "chmod 0666 /var/run/docker.sock && filebeat" ]  # 修改 socket 权限并运行脚本
    depends_on:
      elasticsearch:
        condition: service_healthy
    restart: always
    networks:
      - default_network
  kong:
    image: kong:3.9.0
    container_name: kong
    environment:
      KONG_WORKER_STATE_UPDATE_FREQUENCY: 30
      KONG_DB_CACHE_TTL: 600
      KONG_NGINX_WORKER_PROCESSES: 4
      KONG_LUA_GC_PAUSE: 100            # 提高暂停率，降低 GC 触发频率
      KONG_LUA_GC_STEPMUL: 200          # 增加单次回收强度
      service_logo: konga-original.svg
      service_description: aboutus.kongaDescription
      service_redirect_url: /konga/home/
      KONG_DATABASE: postgres
      KONG_PG_HOST: postgresql
      KONG_PG_PASSWORD: postgres
      KONG_PG_USER: postgres
      KONG_ADMIN_LISTEN: 0.0.0.0:8001
      KONG_SSL_CERT: /etc/kong/ssl/fullchain.cer
      KONG_SSL_CERT_KEY: /etc/kong/ssl/private.key
      KONG_PROXY_LISTEN: 0.0.0.0:8000, 0.0.0.0:8443 ssl
      KONG_PLUGINS: bundled,supos-auth-checker,supos-url-transformer
      KONG_LOG_LEVEL: error
    volumes:
      - ${VOLUMES_PATH}/kong/certificationfile:/etc/kong/ssl:ro
      - ${VOLUMES_PATH}/kong/kong_config.yml:/etc/kong/kong_config.yml
      - ${VOLUMES_PATH}/kong/start.sh:/usr/local/bin/start.sh
      - ${VOLUMES_PATH}/kong/kong-plugin-auth-checker:/usr/local/share/lua/5.1/kong/plugins/supos-auth-checker
      - ${VOLUMES_PATH}/kong/kong-plugin-url-transformer:/usr/local/share/lua/5.1/kong/plugins/supos-url-transformer
    ports:
      - "8088:8000"
      - "8443:8443"
      - "8001:8001"
      - "8444:8444"
    depends_on:
      - emqx
      - backend
      - frontend
      - keycloak
      - postgresql
    command: ["sh", "/usr/local/bin/start.sh"]
    restart: always  # 确保 Kong 自动重启
    networks:
      - default_network
  portainer:
    image: portainer/portainer-ce:2.23.0
    container_name: portainer
    environment:
      service_logo: portainer.svg
    command: --admin-password="$$2y$$05$$ZTAqF7Tn.hil8X.ifVmQTuKiJQoZDiKDW3t1lRR2/VPR06QoHv4AC"
    ports:
      - "8000:8000"
      - "9443:9443"
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - ${VOLUMES_PATH}/portainer:/data
    networks:
      - default_network
  konga:
    image: pantsel/konga:0.14.9
    container_name: konga
    environment:
      # DB_ADAPTER: mysql           # 使用 MySQL 作为数据库
      # DB_HOST: konga_mysql_database # MySQL 容器的主机名
      # DB_USER: konga               # MySQL 用户
      # DB_PASSWORD: konga           # MySQL 用户密码
      # DB_DATABASE: konga          # MySQL 数据库名
      # NODE_ENV: production           # 设置 NODE_ENV 为生产环境
      NO_AUTH: "true"             # 禁用认证
      KONGA_SEED_KONG_NODE_DATA_SOURCE_FILE: /node.data
    ports:
      - "1337:1337"  # 映射 Konga 的端口到主机
    volumes:
      - ${VOLUMES_PATH}/konga/db/:/app/kongadata/
      - ${VOLUMES_PATH}/konga/node.data:/node.data  # 持久化数据库数据
    restart: always
    networks:
      - default_network
  minio:
    image: minio/minio:RELEASE.2024-12-18T13-15-44Z
    profiles:
      - minio
    container_name: minio
    environment:
      - service_logo=minio-original.svg
      - service_description=aboutus.minioDescription
      - service_redirect_url=/minio/home/
      - MINIO_ACCESS_KEY=admin
      - MINIO_SECRET_KEY=adminpassword
      - MINIO_BROWSER_REDIRECT_URL=${ENTRANCE_PROTOCOL}://${ENTRANCE_DOMAIN}:${ENTRANCE_PORT}/minio/home
      - MINIO_IDENTITY_OPENID_CONFIG_URL=${OAUTH_ISSUER_URI}/realms/supos/.well-known/openid-configuration
      - MINIO_IDENTITY_OPENID_CLIENT_ID=${OAUTH_CLIENT_ID}
      - MINIO_IDENTITY_OPENID_CLIENT_SECRET=${OAUTH_CLIENT_SECRET}
      - MINIO_IDENTITY_OPENID_SCOPES=openid
      - MINIO_IDENTITY_OPENID_ROLE_POLICY=public-delete-policy
      - MINIO_IDENTITY_OPENID_REDIRECT_URI=${ENTRANCE_PROTOCOL}://${ENTRANCE_DOMAIN}:${ENTRANCE_PORT}/minio/home/oauth_callback
    ports:
      - "9000:9000"  # Web UI 端口
      - "9001:9001"  # Admin API 端口 (如果需要访问管理接口)
    volumes:
      - ${VOLUMES_PATH}/minio/data:/data  # 数据存储位置
    command: server /data --console-address ":9001"
    depends_on:
      keycloak:
        condition: service_healthy
    restart: always
    networks:
      - default_network
  fuxa:
    container_name: fuxa
    profiles:
      - fuxa
    image: eco-registry.supos.com/sup9bnlh/fuxa:${fuxa_imageTag}
    environment:
      - LANG=${FUXA_LANG:-en}
      - service_logo=fuxa.svg
    volumes:
      - ${VOLUMES_PATH}/fuxa/appdata:/usr/src/app/FUXA/server/_appdata
      - ${VOLUMES_PATH}/fuxa/db:/usr/src/app/FUXA/server/_db
      - ${VOLUMES_PATH}/fuxa/logs:/usr/src/app/FUXA/server/_logs
      - ${VOLUMES_PATH}/fuxa/images:/usr/src/app/FUXA/server/_images
    ports:
      - '1881:1881'
    restart: always
    networks:
      - default_network
  chat2db:
    container_name: chat2db
    image: chat2db/chat2db:latest
    volumes:
      - ${VOLUMES_PATH}/chat2db/data:/root/.chat2db/
    ports:
      - '10824:10824'
    command: java -Dloader.path=lib -Dspring.profiles.active=release -Dchatgpt.apiKey=${OPENAI_API_KEY} -jar chat2db-server-web-start.jar
    environment:
      - service_logo=chat2db.svg
      - OPENAI_API_KEY=${OPENAI_API_KEY}
    restart: always
    networks:
      - default_network
  gitea:
    image: gitea/gitea:latest
    container_name: gitea
    ports:
      - "3030:3000"
      - "2222:22"
    environment:
      - service_logo=gitea.svg
      - GITEA__server__ROOT_URL=${ENTRANCE_PROTOCOL}://${ENTRANCE_DOMAIN}:${ENTRANCE_PORT}/gitea/home/
      - GITEA__oauth2__ENABLED=true
      - GITEA__oauth2__ENABLE_OAUTH2_REGISTER=true
      - GITEA__service__ALLOW_USER_REGISTRATION=true
      - GITEA__oauth2__ALLOW_USER_REGISTRATION=true
      - GITEA__oauth2__ENABLE_OAUTH2_LOGIN=true
      - GITEA__service__ENABLE_CAPTCHA=false
      - GITEA__service__REQUIRE_EMAIL_CONFIRMATION=false
      - GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=true
      - GITEA__server__SSH_DOMAIN=${ENTRANCE_PROTOCOL}
      - GITEA__server__SSH_PORT=2222
      - GITEA__security__INSTALL_LOCK=true
      - GITEA__oauth2_client__ACCOUNT_LINKING=auto
      - GITEA__oauth2_client__ENABLE_AUTO_REGISTRATION=true
    volumes:
      - ${VOLUMES_PATH}/gitea:/data
    restart: always
    networks:
      - default_network
  runner:
    image: gitea/act_runner:nightly
    container_name: gitea_runner
    environment:
      CONFIG_FILE: /config.yaml
      GITEA_INSTANCE_URL: "http://gitea:3000"  # Your Gitea server URL
      GITEA_RUNNER_REGISTRATION_TOKEN: "RD6FfsRrcbfU2BsOrR0h27EqGHze2SQAc9TMmmgY"
      GITEA_RUNNER_NAME: "my-runner"
      GITEA_RUNNER_LABELS: "my-runner"
    volumes:
      - ${VOLUMES_PATH}/gitearunner/data:/data
      - ${VOLUMES_PATH}/gitearunner/config.yaml:/config.yaml
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - 11223:11223
    depends_on:
      - gitea
    restart: always
    networks:
      - default_network
volumes:
  plugin_front: