infra/docker-compose.yaml

name: infra

services:
  postgres:
    container_name: postgres
    group_add: ["65534"]
    image: pgvector/pgvector:0.8.2-pg18
    restart: unless-stopped
    stop_grace_period: 60s
    shm_size: 256mb
    environment:
      TZ: Asia/Shanghai
      POSTGRES_USER: postgres
      POSTGRES_DB: postgres
      POSTGRES_PASSWORD_FILE: /run/secrets/postgres_superuser_password
      POSTGRES_INITDB_ARGS: --auth-host=scram-sha-256
      PGDATA: /var/lib/postgresql/18/docker
    secrets:
      - postgres_superuser_password
      - gitea_db_password
    volumes:
      - ./postgres/data:/var/lib/postgresql
      - ./postgres/init:/docker-entrypoint-initdb.d:ro
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
      interval: 5s
      timeout: 5s
      retries: 20
      start_period: 20s
    networks:
      - git_forge

  gitea:
    container_name: gitea
    group_add: ["65534"]
    image: ${GITEA_IMAGE:-gitea/gitea:1.23}
    restart: unless-stopped
    stop_grace_period: 30s
    environment:
      TZ: Asia/Shanghai
      USER_UID: 1000
      USER_GID: 1000
      GITEA__database__DB_TYPE: postgres
      GITEA__database__HOST: postgres:5432
      GITEA__database__NAME: gitea
      GITEA__database__USER: gitea
      GITEA__database__PASSWD__FILE: /run/secrets/gitea_db_password
      GITEA__database__SSL_MODE: disable
      GITEA__server__DOMAIN: localhost
      GITEA__server__ROOT_URL: http://localhost:13000/
      GITEA__server__SSH_DOMAIN: localhost
      GITEA__server__SSH_PORT: 2223
      GITEA__service__REQUIRE_SIGNIN_VIEW: "true"
      GITEA__service__DISABLE_REGISTRATION: "true"
      GITEA__security__INSTALL_LOCK: "true"
    depends_on:
      postgres:
        condition: service_healthy
    secrets:
      - gitea_db_password
    volumes:
      - ./gitea:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    ports:
      - "127.0.0.1:13000:3000"
      - "127.0.0.1:2223:22"
    healthcheck:
      test: ["CMD-SHELL", "grep -Eq '^INSTALL_LOCK[[:space:]]*=[[:space:]]*true' /data/gitea/conf/app.ini && grep -Eq '^DB_TYPE[[:space:]]*=[[:space:]]*postgres' /data/gitea/conf/app.ini && wget -q --spider http://127.0.0.1:3000/api/healthz"]
      interval: 5s
      timeout: 3s
      retries: 24
      start_period: 20s
    networks:
      - git_forge

  litellm:
    container_name: litellm
    image: ghcr.io/berriai/litellm:main-latest
    restart: unless-stopped
    user: root
    environment:
      TZ: Asia/Shanghai
      XAI_OAUTH_TOKEN_DIR: /app/config/xai_oauth
      CHATGPT_TOKEN_DIR: /app/config/chatgpt
      HTTP_PROXY: http://192.168.0.4:7890
      HTTPS_PROXY: http://192.168.0.4:7890
      ALL_PROXY: http://192.168.0.4:7890
      http_proxy: http://192.168.0.4:7890
      https_proxy: http://192.168.0.4:7890
      all_proxy: http://192.168.0.4:7890
      NO_PROXY: localhost,127.0.0.1,::1,host.docker.internal,n8n,postgres,qdrant,litellm,10.,172.16.,172.17.,172.18.,172.19.,172.20.,172.21.,172.22.,172.23.,172.24.,172.25.,172.26.,172.27.,172.28.,172.29.,172.30.,172.31.,192.168.
      no_proxy: localhost,127.0.0.1,::1,host.docker.internal,n8n,postgres,qdrant,litellm,10.,172.16.,172.17.,172.18.,172.19.,172.20.,172.21.,172.22.,172.23.,172.24.,172.25.,172.26.,172.27.,172.28.,172.29.,172.30.,172.31.,192.168.
    ports:
      - "4000:4000"
    volumes:
      - ./litellm/config.yaml:/app/config/config.yaml:ro
      - ./litellm/xai_oauth:/app/config/xai_oauth
      - ./litellm/chatgpt:/app/config/chatgpt
    command:
      - --config
      - /app/config/config.yaml
      - --host
      - 0.0.0.0
      - --port
      - "4000"
    healthcheck:
      test:
        - CMD
        - /app/.venv/bin/python
        - -c
        - import urllib.request; urllib.request.urlopen("http://127.0.0.1:4000/health/liveliness", timeout=3).read()
      interval: 30s
      timeout: 5s
      retries: 5
      start_period: 20s
    networks:
      - n8n_default

  git-bridge:
    container_name: git-bridge
    profiles: ["git-bridge"]
    image: ${GITEA_IMAGE:-gitea/gitea:1.23}
    restart: "no"
    user: "0:0"
    environment:
      HOME: /state/home
      HTTP_PROXY: http://192.168.0.4:7890
      HTTPS_PROXY: http://192.168.0.4:7890
      ALL_PROXY: http://192.168.0.4:7890
      NO_PROXY: localhost,127.0.0.1,::1,gitea,postgres,litellm
    entrypoint: ["/bin/sh", "/app/bin/sync-main-forward.sh"]
    volumes:
      - ./git-bridge/bin:/app/bin:ro
      - ./git-bridge/config:/app/config:ro
      - ./git-bridge/state:/state
      - ./git-bridge/secrets/gitea_token:/run/secrets/gitea_token:ro
      - ./git-bridge/secrets/github_token:/run/secrets/github_token:ro
    read_only: true
    tmpfs:
      - /tmp
    cap_drop: ["ALL"]
    security_opt:
      - no-new-privileges:true
    networks:
      - git_forge

networks:
  git_forge:
    name: git_forge
  n8n_default:
    external: true
    name: n8n_default

secrets:
  postgres_superuser_password:
    file: ./postgres/secrets/postgres_superuser_password
  gitea_db_password:
    file: ./postgres/secrets/gitea_db_password