docker-compose.yml

# Services the e2e tier talks to. Tests run on the host, so every provider is
# published on an offset port (see tests/Services.php) and each bootstrap drops
# the access token it mints into tests/.tokens, where the host can read it.
#
# A bootstrap provisions and then idles: `docker compose up --wait` waits for
# containers to report healthy, and a token file that exists is what "ready"
# means here.
services:
  gitea:
    image: gitea/gitea:1.21.5
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - GITEA__database__DB_TYPE=sqlite3
      - GITEA__security__INSTALL_LOCK=true
      - GITEA__webhook__ALLOWED_HOST_LIST=*
      - GITEA__webhook__SKIP_TLS_VERIFY=true
      - GITEA__webhook__DELIVER_TIMEOUT=10
      - GITEA__server__ROOT_URL=http://127.0.0.1:13000/
      - GITEA__server__LOCAL_ROOT_URL=http://gitea:3000/
    ports:
      - "13000:3000"
    volumes:
      - gitea-data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/healthz"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s

  gitea-bootstrap:
    image: gitea/gitea:1.21.5
    volumes:
      - gitea-data:/data
      - ./tests/.tokens:/tokens
    depends_on:
      gitea:
        condition: service_healthy
    entrypoint: /bin/sh
    environment:
      - ADMIN_USERNAME=${GITEA_ADMIN_USERNAME:-utopia}
      - ADMIN_PASSWORD=${GITEA_ADMIN_PASSWORD:-password}
      - ADMIN_EMAIL=${GITEA_ADMIN_EMAIL:-utopia@example.com}
      - TOKEN_FILE=/tokens/gitea.txt
    command: >
      -c "
        rm -f $$TOKEN_FILE &&
        su git -c \"gitea admin user create --username $$ADMIN_USERNAME --password $$ADMIN_PASSWORD --email $$ADMIN_EMAIL --admin --must-change-password=false\" || true &&
        su git -c \"gitea admin user generate-access-token --username $$ADMIN_USERNAME --token-name token-$$(date +%s) --scopes all --raw\" > $$TOKEN_FILE &&
        tail -f /dev/null
      "
    healthcheck:
      test: ["CMD-SHELL", "test -s $$TOKEN_FILE"]
      interval: 2s
      timeout: 2s
      retries: 60

  forgejo:
    image: codeberg.org/forgejo/forgejo:9
    environment:
      - USER_UID=1000
      - USER_GID=1000
      - FORGEJO__database__DB_TYPE=sqlite3
      - FORGEJO__security__INSTALL_LOCK=true
      - FORGEJO__webhook__ALLOWED_HOST_LIST=*
      - FORGEJO__webhook__SKIP_TLS_VERIFY=true
      - FORGEJO__webhook__DELIVER_TIMEOUT=10
      - FORGEJO__server__ROOT_URL=http://127.0.0.1:13001/
      - FORGEJO__server__LOCAL_ROOT_URL=http://forgejo:3000/
    ports:
      - "13001:3000"
    volumes:
      - forgejo-data:/data
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/healthz"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 10s

  forgejo-bootstrap:
    image: codeberg.org/forgejo/forgejo:9
    volumes:
      - forgejo-data:/data
      - ./tests/.tokens:/tokens
    depends_on:
      forgejo:
        condition: service_healthy
    entrypoint: /bin/sh
    environment:
      - ADMIN_USERNAME=${FORGEJO_ADMIN_USERNAME:-utopia}
      - ADMIN_PASSWORD=${FORGEJO_ADMIN_PASSWORD:-password}
      - ADMIN_EMAIL=${FORGEJO_ADMIN_EMAIL:-utopia@example.com}
      - TOKEN_FILE=/tokens/forgejo.txt
    command: >
      -c "
        rm -f $$TOKEN_FILE &&
        su git -c \"forgejo admin user create --username $$ADMIN_USERNAME --password $$ADMIN_PASSWORD --email $$ADMIN_EMAIL --admin --must-change-password=false\" || true &&
        su git -c \"forgejo admin user generate-access-token --username $$ADMIN_USERNAME --token-name token-$$(date +%s) --scopes all --raw\" > $$TOKEN_FILE &&
        tail -f /dev/null
      "
    healthcheck:
      test: ["CMD-SHELL", "test -s $$TOKEN_FILE"]
      interval: 2s
      timeout: 2s
      retries: 60

  gogs:
    image: gogs/gogs:0.14
    volumes:
      - gogs-data:/data
      - ./resources/gogs/app.ini:/data/gogs/conf/app.ini
    ports:
      - "13002:3000"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/"]
      interval: 10s
      timeout: 5s
      retries: 10
      start_period: 15s

  gogs-bootstrap:
    image: gogs/gogs:0.14
    volumes:
      - gogs-data:/data
      - ./resources/gogs/app.ini:/data/gogs/conf/app.ini
      - ./tests/.tokens:/tokens
    depends_on:
      gogs:
        condition: service_healthy
    entrypoint: /bin/sh
    environment:
      - ADMIN_USERNAME=${GOGS_ADMIN_USERNAME:-utopia}
      - ADMIN_PASSWORD=${GOGS_ADMIN_PASSWORD:-password}
      - ADMIN_EMAIL=${GOGS_ADMIN_EMAIL:-utopia@example.com}
      - TOKEN_FILE=/tokens/gogs.txt
    command:
      - -c
      - |
        rm -f $$TOKEN_FILE

        USER=git /app/gogs/gogs admin create-user \
          --admin \
          --name $$ADMIN_USERNAME \
          --password $$ADMIN_PASSWORD \
          --email $$ADMIN_EMAIL \
          --config /data/gogs/conf/app.ini || true

        sleep 2
        TOKEN=$$(curl -s \
          -X POST \
          -u $$ADMIN_USERNAME:$$ADMIN_PASSWORD \
          -H "Content-Type: application/json" \
          -d "{\"name\":\"token-$$(date +%s)\"}" \
          http://gogs:3000/api/v1/users/$$ADMIN_USERNAME/tokens \
          | grep -o '"sha1":"[^"]*"' | cut -d'"' -f4)
        if [ -z "$$TOKEN" ]; then echo "Failed to get token"; exit 1; fi
        echo $$TOKEN > $$TOKEN_FILE

        tail -f /dev/null
    healthcheck:
      test: ["CMD-SHELL", "test -s $$TOKEN_FILE"]
      interval: 2s
      timeout: 2s
      retries: 60

  gitlab:
    image: gitlab/gitlab-ce:18.10.1-ce.0
    environment:
      - GITLAB_ROOT_PASSWORD=${GITLAB_ROOT_PASSWORD:-;asiweml@562}
      - GITLAB_ROOT_EMAIL=${GITLAB_ROOT_EMAIL:-utopia@example.com}
      - >-
        GITLAB_OMNIBUS_CONFIG=external_url 'http://127.0.0.1:13003';
        nginx['listen_port'] = 80;
        gitlab_rails['initial_root_password'] = ENV['GITLAB_ROOT_PASSWORD'];
        gitlab_rails['gitlab_signup_enabled'] = false;
        gitlab_rails['allow_local_requests_from_web_hooks_and_services'] = true;
        puma['worker_processes'] = 0;
        sidekiq['concurrency'] = 10;
        prometheus_monitoring['enable'] = false;
        prometheus['enable'] = false;
        alertmanager['enable'] = false;
        gitlab_exporter['enable'] = false;
        node_exporter['enable'] = false;
        postgres_exporter['enable'] = false;
        redis_exporter['enable'] = false;
        puma['exporter_enabled'] = false;
        sidekiq['metrics_enabled'] = false;
        gitlab_kas['enable'] = false;
    volumes:
      - gitlab-data:/var/opt/gitlab
    ports:
      - "13003:80"
    healthcheck:
      # Readiness checks Rails and its dependencies (PostgreSQL, Redis and
      # Gitaly), unlike /-/health, which only says the app server answered.
      test: ["CMD-SHELL", "curl --fail --silent 'http://localhost/-/readiness?all=1' > /dev/null"]
      interval: 5s
      timeout: 5s
      retries: 60
      start_period: 300s

  gitlab-bootstrap:
    image: alpine/curl:8.12.1
    volumes:
      - ./tests/.tokens:/tokens
    depends_on:
      gitlab:
        condition: service_healthy
    environment:
      - GITLAB_ROOT_PASSWORD=${GITLAB_ROOT_PASSWORD:-;asiweml@562}
      - TOKEN_FILE=/tokens/gitlab.txt
    entrypoint: /bin/sh
    command:
      - -c
      - |
        rm -f $$TOKEN_FILE

        json_field() {
          printf '%s' "$$1" | grep -oE "\"$$2\"[[:space:]]*:[[:space:]]*\"[^\"]*\"" | cut -d'"' -f4
        }

        OAUTH_TOKEN=
        i=1
        while [ "$$i" -le 30 ]; do
          RESPONSE=$$(curl -sS --connect-timeout 5 --max-time 15 -w '\n%{http_code}' \
            -X POST http://gitlab:80/oauth/token \
            --data-urlencode "grant_type=password" \
            --data-urlencode "username=root" \
            --data-urlencode "password=$$GITLAB_ROOT_PASSWORD" \
            --data-urlencode "scope=api" || true)
          HTTP=$$(printf '%s\n' "$$RESPONSE" | tail -n 1)
          BODY=$$(printf '%s\n' "$$RESPONSE" | sed '$$d')
          OAUTH_TOKEN=$$(json_field "$$BODY" access_token)
          if [ -n "$$OAUTH_TOKEN" ]; then
            break
          fi
          ERROR=$$(json_field "$$BODY" error)
          [ -n "$$ERROR" ] || ERROR=none
          echo "OAuth token attempt $$i/30 http=$$HTTP error=$$ERROR"
          i=$$((i + 1))
          sleep 2
        done
        if [ -z "$$OAUTH_TOKEN" ]; then echo "Failed to get OAuth token"; exit 1; fi

        TOKEN=
        i=1
        while [ "$$i" -le 15 ]; do
          RESPONSE=$$(curl -sS --connect-timeout 5 --max-time 15 -w '\n%{http_code}' \
            -X POST http://gitlab:80/api/v4/users/1/personal_access_tokens \
            -H "Authorization: Bearer $$OAUTH_TOKEN" \
            -H "Content-Type: application/json" \
            -d '{"name":"bootstrap","scopes":["api","read_user","read_repository","write_repository"]}' || true)
          HTTP=$$(printf '%s\n' "$$RESPONSE" | tail -n 1)
          BODY=$$(printf '%s\n' "$$RESPONSE" | sed '$$d')
          TOKEN=$$(json_field "$$BODY" token)
          if [ -n "$$TOKEN" ]; then
            break
          fi
          ERROR=$$(json_field "$$BODY" error)
          [ -n "$$ERROR" ] || ERROR=none
          echo "PAT attempt $$i/15 http=$$HTTP error=$$ERROR"
          i=$$((i + 1))
          sleep 2
        done
        if [ -z "$$TOKEN" ]; then echo "Failed to get token"; exit 1; fi

        curl -s -X PUT "http://gitlab:80/api/v4/application/settings" \
          -H "PRIVATE-TOKEN: $$TOKEN" \
          -H "Content-Type: application/json" \
          -d '{"allow_local_requests_from_web_hooks_and_services":true,"allow_local_requests_from_system_hooks":true}'

        echo $$TOKEN > $$TOKEN_FILE

        tail -f /dev/null
    healthcheck:
      test: ["CMD-SHELL", "test -s $$TOKEN_FILE"]
      interval: 2s
      timeout: 2s
      retries: 60

  # Where the providers deliver their webhooks, so a test can read back what
  # they sent. Providers reach it in the network, tests over the offset port.
  request-catcher:
    image: appwrite/requestcatcher:1.1.0
    ports:
      - "15000:5000"

volumes:
  gitea-data:
  forgejo-data:
  gogs-data:
  gitlab-data: