stack.yml

version: '3.1'
volumes:
  data:
  capnp-secrets:
  gitlab-data:
  gitlab-capnp-secrets:

secrets:
  ocaml-ci-github-key:
    external: true
  ocaml-ci-oauth:
    external: true
  ocaml-ci-submission.cap:
    external: true
  ocaml-ci-webhook-secret:
    external: true
  ocaml-ci-gitlab-oauth:
    external: true
  ocaml-ci-gitlab-token:
    external: true
  ocaml-ci-gitlab-webhook-secret:
    external: true
  ocaml-ci-solver.cap:
    external: true

services:
  ci:
    image: ocurrent/ocaml-ci-service:live
    # image: ocaml-ci-service
    # For local deploys using docker -c ocaml.ci.dev build -t ocaml-ci-service -f Dockerfile .
    command: >
      --github-app-id 39151
      --github-private-key-file /run/secrets/ocaml-ci-github-key
      --github-oauth /run/secrets/ocaml-ci-oauth
      --github-webhook-secret-file /run/secrets/ocaml-ci-webhook-secret
      --confirm above-average
      --confirm-auto-release 120
      --capnp-public-address=tcp:ocaml.ci.dev:8102 --capnp-listen-address=tcp:0.0.0.0:9000
      --submission-service /run/secrets/ocaml-ci-submission.cap
      --submission-solver-service /run/secrets/ocaml-ci-solver.cap 
      --migration-path /migrations
      --verbosity info
      --github-account-allowlist talex5,ocurrent,ocaml,mirage,avsm,samoht,kit-ty-kate,tarides,aantron,ocamllabs,realworldocaml,NathanReb,0install,gpetiot,ocaml-ppx,CraigFe,pascutto,Julow,ocaml-gospel,vbmithr,gs0510,MagnusS,dune-universe,janestreet,emillon,capnproto,ocaml-opam,ocaml-dune,favonia,joelburget,jeffa5,bikallem,jonludlam,g2p,stedolan,ocsigen,dinosaure,hannesm,mirleft,robur-coop,MisterDA,ocaml-multicore,cdaringe,inhabitedtype,tmcgilchrist,ocaml-doc,grievejia,Leonidas-from-XIV,ocaml-community,verbosemode,tomjridge,thizanne,n-osborne,TheLortex,patricoferris,routineco,moby,djs55,hyunha,hyper-systems,coco33920,sanette,maiste,yomimono,c-cube,novemberkilo,joaosreis,mtelvers,ygrek,geocaml,panglesd,SimonJF,haesbaert,benmandrew,andrenth,backtracking,jmid,shindere,gildor478,mefyl,ElectreAAS,well-typed-lightbulbs,johnyob,lasamlai,zshipko,andreas,bobot,dialohq,reynir,nilsbecker,ngernest,progman1,moyodiallo,edwintorok,smuenzel,9glenda
    environment:
      - "CAPNP_PROFILE=production"
      - "PLATFORMS=all"
      - "DOCKER_BUILDKIT=1"
      - "PROGRESS_NO_TRUNC=1"
    ports:
      - '8102:9000'
    volumes:
      - 'data:/var/lib/ocurrent'
      - '/var/run/docker.sock:/var/run/docker.sock'
      - 'capnp-secrets:/capnp-secrets'
    secrets:
      - 'ocaml-ci-oauth'
      - 'ocaml-ci-github-key'
      - 'ocaml-ci-submission.cap'
      - 'ocaml-ci-solver.cap'
      - 'ocaml-ci-webhook-secret'
    sysctls:
      - 'net.ipv4.tcp_keepalive_time=60'

  gitlab:
    image: ocurrent/ocaml-ci-gitlab-service:live
    # image: ocaml-ci-gitlab-service
    # For local deploys using docker -c ocaml.ci.dev build -t ocaml-ci-gitlab-service -f Dockerfile.gitlab .
    command: >
      --gitlab-oauth /run/secrets/ocaml-ci-gitlab-oauth
      --gitlab-token-file /run/secrets/ocaml-ci-gitlab-token
      --gitlab-webhook-secret-file /run/secrets/ocaml-ci-gitlab-webhook-secret
      --submission-service /run/secrets/ocaml-ci-submission.cap
      --submission-solver-service /run/secrets/ocaml-ci-solver.cap
      --capnp-public-address=tcp:ocaml.ci.dev:8202
      --capnp-listen-address=tcp:0.0.0.0:9000
      --migration-path /migrations
      --verbosity info
    environment:
      - "CAPNP_PROFILE=production"
      - "PLATFORMS=all"
      - "DOCKER_BUILDKIT=1"
      - "PROGRESS_NO_TRUNC=1"
    ports:
      - '8202:9000'
    volumes:
      - 'gitlab-data:/var/lib/ocurrent'
      - '/var/run/docker.sock:/var/run/docker.sock'
      - 'gitlab-capnp-secrets:/capnp-secrets'
    secrets:
      - 'ocaml-ci-gitlab-oauth'
      - 'ocaml-ci-gitlab-token'
      - 'ocaml-ci-submission.cap'
      - 'ocaml-ci-solver.cap'
      - 'ocaml-ci-gitlab-webhook-secret'
    sysctls:
      - 'net.ipv4.tcp_keepalive_time=60'

  web:
    image: ocurrent/ocaml-ci-web:live
    # image: ocaml-ci-web
    # For local deploys using docker -c ocaml.ci.dev build -t ocaml-ci-web -f Dockerfile.web .
    command: >
      --backend /capnp-secrets/ocaml-ci-admin.cap
      --gitlab-backend /gitlab-capnp-secrets/ocaml-ci-gitlab-admin.cap
      --listen-prometheus=9090
    volumes:
      - 'capnp-secrets:/capnp-secrets:ro'
      - 'gitlab-capnp-secrets:/gitlab-capnp-secrets:ro'
    sysctls:
      - 'net.ipv4.tcp_keepalive_time=60'