services:
  gitea:
    image: gitea/gitea:1.25
    container_name: gitea
    restart: unless-stopped
    depends_on:
      - postgres
      - redis
    networks:
      - traefik-public
      - gitea-internal
    environment:
      - TZ=Europe/Berlin
      - USER_UID=1000
      - USER_GID=1000
      - POSTGRES_PASSWORD=gitea_password
      - GITEA__database__DB_TYPE=postgres
      - GITEA__database__HOST=postgres:5432
      - GITEA__database__NAME=${POSTGRES_DB:-gitea}
      - GITEA__database__USER=${POSTGRES_USER:-gitea}
      - GITEA__database__PASSWD=${POSTGRES_PASSWORD:-gitea_password}
      # Database connection pool settings to prevent "Timeout before authentication" errors
      # These limit the number of concurrent connections and prevent connection pool exhaustion
      # - MAX_OPEN_CONNS: Maximum number of open connections to the database
      # - MAX_IDLE_CONNS: More warm connections to avoid constantly creating new sessions
      # - CONN_MAX_LIFETIME: 10 minutes; idle connections are not recycled too quickly
      # - CONN_MAX_IDLE_TIME: Clean up connections that are idle for too long
      - GITEA__database__MAX_OPEN_CONNS=50
      - GITEA__database__MAX_IDLE_CONNS=30
      - GITEA__database__CONN_MAX_LIFETIME=600
      - GITEA__database__CONN_MAX_IDLE_TIME=300
      # Cache, Session, and Queue configuration via environment variables
      # These override app.ini settings and are applied on every container start
      # NOTE: Cache deaktiviert - Gitea 1.25 interpretiert GITEA__cache__HOST nicht korrekt
      # (verbindet sich mit 127.0.0.1:6379 statt redis:6379). Session und Queue nutzen weiterhin Redis.
      - GITEA__cache__ENABLED=false
      - GITEA__cache__ADAPTER=memory
      - GITEA__session__PROVIDER=redis
      - GITEA__session__PROVIDER_CONFIG=network=tcp,addr=redis:6379,password=${REDIS_PASSWORD:-gitea_redis_password},db=0,pool_size=100,idle_timeout=180
      - GITEA__queue__TYPE=redis
      - GITEA__queue__CONN_STR=redis://:${REDIS_PASSWORD:-gitea_redis_password}@redis:6379/0
      - GITEA__server__DOMAIN=${GITEA_DOMAIN:-git.michaelschiemer.de}
      - GITEA__server__ROOT_URL=https://${GITEA_DOMAIN:-git.michaelschiemer.de}/
      - GITEA__server__SSH_DOMAIN=${GITEA_DOMAIN:-git.michaelschiemer.de}
      - GITEA__server__SSH_PORT=2222
      - GITEA__service__DISABLE_REGISTRATION=${DISABLE_REGISTRATION:-true}
      - GITEA__actions__ENABLED=true
    volumes:
      - gitea-data:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    labels:
      - "traefik.enable=true"

      # HTTP Router configuration
      - "traefik.http.routers.gitea.rule=Host(`git.michaelschiemer.de`)"
      - "traefik.http.routers.gitea.entrypoints=websecure"
      - "traefik.http.routers.gitea.tls=true"
      - "traefik.http.routers.gitea.tls.certresolver=letsencrypt"
      - "traefik.http.routers.gitea.priority=100"
      # Service configuration (Docker provider uses port, not url)
      - "traefik.http.services.gitea.loadbalancer.server.port=3000"
      # Middleware chain (removed temporarily to test if it causes issues)
      # - "traefik.http.routers.gitea.middlewares=security-headers-global@file,gzip-compression@file"
      # Explicitly reference the service (like MinIO does)
      - "traefik.http.routers.gitea.service=gitea"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/healthz"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  postgres:
    image: postgres:16-alpine
    container_name: gitea-postgres
    restart: unless-stopped
    networks:
      - gitea-internal
    environment:
      - TZ=Europe/Berlin
      - POSTGRES_DB=gitea
      - POSTGRES_USER=gitea
      - POSTGRES_PASSWORD=gitea_password
    command: >
      postgres
      -c max_connections=300
      -c authentication_timeout=180
      -c statement_timeout=30000
      -c idle_in_transaction_session_timeout=30000
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U ${POSTGRES_USER:-gitea} -d ${POSTGRES_DB:-gitea}"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 30s

  redis:
    image: redis:7-alpine
    container_name: gitea-redis
    restart: unless-stopped
    networks:
      - gitea-internal
    environment:
      - TZ=Europe/Berlin
    command: >
      redis-server
      --requirepass ${REDIS_PASSWORD:-gitea_redis_password}
      --appendonly yes
      --maxmemory 512mb
      --maxmemory-policy allkeys-lru
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "--raw", "incr", "ping"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 10s

volumes:
  gitea-data:
    name: gitea-data
  postgres-data:
    name: gitea-postgres-data
  redis-data:
    name: gitea-redis-data

networks:
  traefik-public:
    external: true
  gitea-internal:
    name: gitea-internal
    driver: bridge