Sign in

flagon-io/g1t

public

g1t/deploy/self-host/docker-compose.yml

147 lines5,312 bytesCodeBlame

Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.

Running g1t yourself: the design, a docker compose proof, and a guide to what works today1# Self-hosted g1t, phase 1: the core forge on your own machine.
2#
3# docker compose -f deploy/self-host/docker-compose.yml up --build
4#
5# Then open http://localhost:8787. Mail (the confirmation link at sign-up)
6# lands in Mailpit at http://localhost:8025.
7#
8# What runs: the site and every core service in one workerd (g1t), git
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member9# repositories as bare repos on a volume (gitstore), packages' files in
10# MinIO, and Mailpit for mail.
Running g1t yourself: the design, a docker compose proof, and a guide to what works today11# Agents, deployments, context search and billing are off. See
12# docs/SELF_HOSTING.md.
13name: g1t
14
15services:
16 g1t:
17 build:
18 context: ../..
19 dockerfile: deploy/self-host/Dockerfile
20 ports:
21 - "${G1T_PORT:-8787}:8787"
22 environment:
23 # Where people reach this installation. Links in mail point here.
24 PUBLIC_URL: ${PUBLIC_URL:-http://localhost:8787}
25 GITSTORE_URL: http://gitstore:8080
26 GITSTORE_SECRET_FILE: /secrets/gitstore
27 MAIL_URL: ${MAIL_URL:-http://mailpit:8025}
28 MAIL_FROM: ${MAIL_FROM:-g1t <noreply@localhost>}
Invite-only launch: sign in with GitHub, repository access and lifecycle, many emails, a new look29 # Your own GitHub App, for "Continue with GitHub" and importing from
30 # GitHub. Leave these unset to have neither. See the self-hosting guide.
31 GITHUB_APP_ID: ${GITHUB_APP_ID:-}
32 GITHUB_APP_SLUG: ${GITHUB_APP_SLUG:-}
33 GITHUB_APP_CLIENT_ID: ${GITHUB_APP_CLIENT_ID:-}
34 GITHUB_APP_CLIENT_SECRET: ${GITHUB_APP_CLIENT_SECRET:-}
35 GITHUB_APP_PRIVATE_KEY: ${GITHUB_APP_PRIVATE_KEY:-}
36 GITHUB_APP_WEBHOOK_SECRET: ${GITHUB_APP_WEBHOOK_SECRET:-}
37 # open: anyone may register. invite: a new account needs an invite
38 # code, as on g1t.sh; the owners of INVITE_STAFF_WORKSPACES (slugs,
39 # comma separated) invite without limit, everyone else INVITES_PER_USER.
40 REGISTRATION_MODE: ${REGISTRATION_MODE:-open}
41 INVITE_STAFF_WORKSPACES: ${INVITE_STAFF_WORKSPACES:-}
42 INVITES_PER_USER: ${INVITES_PER_USER:-}
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas43 # Where summaries of new access requests go; empty sends none.
44 WAITLIST_NOTIFY_EMAIL: ${WAITLIST_NOTIFY_EMAIL:-}
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member45 # Packages' files (container images and the rest), in MinIO below or
46 # any S3-compatible store. S3_PUBLIC_ENDPOINT, when clients can reach
47 # the store, sends large downloads there directly.
48 S3_ENDPOINT: ${S3_ENDPOINT:-http://minio:9000}
49 S3_BUCKET: ${S3_BUCKET:-g1t-packages}
50 S3_REGION: ${S3_REGION:-us-east-1}
51 S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-g1t}
52 S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-g1t-packages-secret}
53 S3_PUBLIC_ENDPOINT: ${S3_PUBLIC_ENDPOINT:-}
Running g1t yourself: the design, a docker compose proof, and a guide to what works today54 volumes:
55 - g1t-data:/data
56 - g1t-secrets:/secrets:ro
57 depends_on:
58 gitstore:
59 condition: service_healthy
60 mailpit:
61 condition: service_started
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member62 minio-setup:
63 condition: service_completed_successfully
Running g1t yourself: the design, a docker compose proof, and a guide to what works today64 restart: unless-stopped
65
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas66 # The status page, in a process of its own so it stays up when the site
67 # does not: http://localhost:8788. It checks the site every minute.
68 status:
69 build:
70 context: ../..
71 dockerfile: deploy/self-host/Dockerfile
72 command: ["bash", "deploy/self-host/status.sh"]
73 ports:
74 - "${STATUS_PORT:-8788}:8788"
75 environment:
76 PUBLIC_URL: ${PUBLIC_URL:-http://localhost:8787}
77 # How the status page reaches the site, from inside Compose.
78 STATUS_CHECK_URL: http://g1t:8787
79 # A public repository, `workspace/repo`, whose branches it lists as a
80 # clone would. Empty: git is not checked.
81 STATUS_PROBE_REPO: ${STATUS_PROBE_REPO:-}
82 volumes:
83 - g1t-status:/data
84 restart: unless-stopped
85
Running g1t yourself: the design, a docker compose proof, and a guide to what works today86 gitstore:
87 build:
88 context: ./gitstore
89 environment:
90 GITSTORE_URL: http://gitstore:8080
91 GITSTORE_SECRET_FILE: /secrets/gitstore
92 volumes:
93 - g1t-git:/data/git
94 - g1t-secrets:/secrets
95 # Not published: only the g1t container reaches it.
96 restart: unless-stopped
97
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member98 # Packages' files. Not published: only the g1t container reaches it,
99 # unless you publish 9000 and set S3_PUBLIC_ENDPOINT.
100 minio:
101 image: minio/minio:latest
102 command: ["server", "/data"]
103 environment:
104 MINIO_ROOT_USER: ${S3_ACCESS_KEY_ID:-g1t}
105 MINIO_ROOT_PASSWORD: ${S3_SECRET_ACCESS_KEY:-g1t-packages-secret}
106 volumes:
107 - g1t-packages:/data
108 healthcheck:
109 test: ["CMD", "mc", "ready", "local"]
110 interval: 5s
111 retries: 20
112 restart: unless-stopped
113
114 # Makes the bucket once, then exits.
115 minio-setup:
116 image: minio/mc:latest
117 depends_on:
118 minio:
119 condition: service_healthy
120 entrypoint:
121 - sh
122 - -c
123 - mc alias set local http://minio:9000 "$$MINIO_ROOT_USER" "$$MINIO_ROOT_PASSWORD" && mc mb --ignore-existing "local/$$S3_BUCKET"
124 environment:
125 MINIO_ROOT_USER: ${S3_ACCESS_KEY_ID:-g1t}
126 MINIO_ROOT_PASSWORD: ${S3_SECRET_ACCESS_KEY:-g1t-packages-secret}
127 S3_BUCKET: ${S3_BUCKET:-g1t-packages}
128
Running g1t yourself: the design, a docker compose proof, and a guide to what works today129 mailpit:
130 image: axllent/mailpit:latest
131 ports:
132 - "${MAILPIT_PORT:-8025}:8025"
133 # To deliver for real, relay through your SMTP server:
134 # environment:
135 # MP_SMTP_RELAY_HOST: smtp.example.com
136 # MP_SMTP_RELAY_PORT: "587"
137 # MP_SMTP_RELAY_USERNAME: ...
138 # MP_SMTP_RELAY_PASSWORD: ...
139 # MP_SMTP_RELAY_ALL: "true"
140 restart: unless-stopped
141
142volumes:
143 g1t-data:
Packages, with a container registry on g1t.sh; workspaces deleted whole and kept 30 days; Members for every member144 g1t-packages:
status.g1t.sh with incident management, invites that land you in the workspace, settings as pages, usage without quotas145 g1t-status:
Running g1t yourself: the design, a docker compose proof, and a guide to what works today146 g1t-git:
147 g1t-secrets: