services:
  # Prepares the shared socket dir, then prunes old cache on a schedule.
  buildkit-helper:
    image: moby/buildkit
    user: "0:0"
    entrypoint: ["/bin/sh", "-c"]
    command:
      - |
        set -eu
        mkdir -p /run/buildkit
        touch /run/buildkit/.ready
        echo "buildkit-helper: socket dir ready"

        addr="$${BUILDKIT_HOST}"
        keep="$${BUILDKIT_PRUNE_KEEP_DURATION}"
        interval="$${BUILDKIT_PRUNE_INTERVAL_SECONDS}"
        echo "buildkit-helper: waiting for $${addr}"
        while [ ! -S /run/buildkit/buildkitd.sock ]; do
          sleep 1
        done

        echo "buildkit-helper: prune keep-duration=$${keep} interval=$${interval}s"
        while true; do
          echo "buildkit-helper: running prune..."
          buildctl --addr "$${addr}" prune --keep-duration "$${keep}" --verbose \
            || echo "buildkit-helper: prune failed (will retry)"
          sleep "$${interval}"
        done
    environment:
      BUILDKIT_HOST: unix:///run/buildkit/buildkitd.sock
      BUILDKIT_PRUNE_KEEP_DURATION: 168h
      BUILDKIT_PRUNE_INTERVAL_SECONDS: 86400
    volumes:
      - buildkit-socket:/run/buildkit
    healthcheck:
      test: ["CMD", "test", "-f", "/run/buildkit/.ready"]
      interval: 1s
      timeout: 2s
      retries: 30
      start_period: 1s
    restart: unless-stopped

  buildkit:
    image: moby/buildkit
    privileged: true
    entrypoint: ["/bin/sh", "-c"]
    # Replace ip in resolv.conf with BUILDKIT_DNS if set
    command:
      - |
        set -eu
        if [ -n "$${BUILDKIT_DNS:-}" ]; then
          sed "s/^nameserver .*/nameserver $${BUILDKIT_DNS}/" /etc/resolv.conf \
            > /tmp/buildkit-resolv.conf
          cat /tmp/buildkit-resolv.conf > /etc/resolv.conf
        fi
        exec buildkitd --addr unix:///run/buildkit/buildkitd.sock
    environment:
      BUILDKIT_DNS: ${BUILDKIT_DNS:-}
    volumes:
      - /pool/forgejo/buildkit-cache:/var/lib/buildkit
      - buildkit-socket:/run/buildkit
    depends_on:
      buildkit-helper:
        condition: service_healthy
    restart: unless-stopped

  build-service:
    container_name: build-service
    ports:
      - 9876:8080
    build: .
    environment:
      JWT_SECRET: ${JWT_SECRET:?Set JWT_SECRET in .env or the environment}
      GIT_HOST: ${GIT_HOST:-git.lschaefer.xyz}
      WORK_DIR: /tmp/builds
      BUILDKIT_HOST: unix:///run/buildkit/buildkitd.sock
      GIT_CLONE_TIMEOUT_SECONDS: 300
      BUILD_TIMEOUT_SECONDS: 1800
      MAX_FILE_BYTES: ${MAX_FILE_BYTES:-209715200}
      MAX_UPLOAD_BYTES: ${MAX_UPLOAD_BYTES:-419430400}
    volumes:
      - build-work:/tmp/builds
      - buildkit-socket:/run/buildkit
    depends_on:
      - buildkit
    # You can remove this network
    networks:
      - caddy_buildkit
    restart: unless-stopped

volumes:
  build-work:
  buildkit-socket:

# You can remove this network
networks:
  caddy_buildkit:
    external: true