docker-compose.yml

services:
  # PostgreSQL database for cache metadata
  postgres:
    image: postgres:16-alpine
    container_name: actions-cache-postgres
    environment:
      POSTGRES_DB: gha_cache
      POSTGRES_USER: cache_user
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-changeme}
    volumes:
      - postgres-data:/var/lib/postgresql/data
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U cache_user -d gha_cache"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - runner-network

  # MinIO S3-compatible object storage for cache data
  minio:
    image: quay.io/minio/minio:latest
    container_name: actions-cache-minio
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER:-minio_admin}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD:-changeme123}
    volumes:
      - minio-data:/data
    ports:
      - "9000:9000"  # MinIO API
      - "9001:9001"  # MinIO Web Console
    restart: always
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - runner-network

  # Local GitHub Actions cache server for fast caching
  actions-cache:
    image: ghcr.io/falcondev-oss/github-actions-cache-server:latest
    environment:
      # API configuration
      - API_BASE_URL=http://actions-cache:3000
      # Storage backend (S3 via MinIO)
      - STORAGE_DRIVER=s3
      - STORAGE_S3_BUCKET=gh-actions-cache
      - AWS_ACCESS_KEY_ID=${MINIO_ROOT_USER:-minio_admin}
      - AWS_SECRET_ACCESS_KEY=${MINIO_ROOT_PASSWORD:-changeme123}
      - AWS_ENDPOINT_URL=http://minio:9000
      - AWS_REGION=us-east-1
      # Database backend (PostgreSQL)
      - DB_DRIVER=postgres
      - DB_POSTGRES_HOST=postgres
      - DB_POSTGRES_PORT=5432
      - DB_POSTGRES_DATABASE=gha_cache
      - DB_POSTGRES_USER=cache_user
      - DB_POSTGRES_PASSWORD=${POSTGRES_PASSWORD:-changeme}
      # Cleanup old cache entries (days)
      - CACHE_CLEANUP_OLDER_THAN_DAYS=90
      - DEBUG=false
    ports:
      - "3000:3000"  # Expose cache server for host network runners
    depends_on:
      postgres:
        condition: service_healthy
      minio:
        condition: service_healthy
    restart: always
    healthcheck:
      test: ["CMD", "wget", "--quiet", "--tries=1", "--spider", "http://localhost:3000/"]
      interval: 10s
      timeout: 5s
      retries: 5
    networks:
      - runner-network

  # GitHub Actions Runner - scales to multiple replicas
  # Scale with: docker compose up --scale github-runner=4
  # Or use ./up.sh script which reads RUNNER_REPLICAS from .env
  github-runner:
    # Build the runner image (no build args needed - DinD is embedded)
    build:
      context: .

    # Load environment variables from .env file
    env_file:
      - .env

    # Runtime environment configuration
    environment:
      # GitHub repository URL to register runner with
      # Format: https://github.com/owner/repo (constructed from GITHUB_REPO env var)
      REPO_URL: https://github.com/${GITHUB_REPO}

      # Personal Access Token for automatic runner token generation
      # Create at: https://github.com/settings/tokens with 'repo' and 'workflow' scopes
      ACCESS_TOKEN: ${ACCESS_TOKEN}

      # Runner name prefix (will append container hostname for uniqueness)
      # Results in names like: myserver-runner-github-runners-github-runner-1
      RUNNER_NAME_PREFIX: ${RUNNER_NAME_PREFIX:-docker-runner}
      
      # Runner architecture (x64 or ARM64)
      # Leave empty for auto-detection (recommended)
      RUNNER_ARCH: ${RUNNER_ARCH:-}

      # Local cache server configuration (must end with trailing slash!)
      # Runners are on same network, can access via service names
      # CUSTOM_ACTIONS_RESULTS_URL is used by the forked runner
      ACTIONS_RESULTS_URL: http://actions-cache:3000/
      CUSTOM_ACTIONS_RESULTS_URL: http://actions-cache:3000/

      # Nx remote caching configuration (enforced at runner level)
      # These environment variables enable Nx to use self-hosted S3 cache
      # without requiring workflow YAML changes
      # Runners can access MinIO via service name on same network
      NX_KEY: ${NX_KEY:-}
      AWS_ACCESS_KEY_ID: ${MINIO_ROOT_USER:-minio_admin}
      AWS_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD:-changeme123}
      AWS_ENDPOINT_URL: http://minio:9000
      AWS_REGION: us-east-1

      # Disable verbose INFO logging to stdout
      ACTIONS_RUNNER_PRINT_LOG_TO_STDOUT: 0

    # Docker-in-Docker: Each runner has its own embedded Docker daemon
    # This provides complete network isolation - no port conflicts between runners
    # Privileged mode is required for running Docker daemon inside container
    privileged: true

    # Ensure cache server is healthy before starting
    depends_on:
      actions-cache:
        condition: service_healthy

    # Automatically restart on failure or reboot
    restart: always
    
    # Use bridge network for runner-to-runner isolation
    networks:
      - runner-network
    
    # Map host.docker.internal to host gateway for accessing cache/minio
    extra_hosts:
      - "host.docker.internal:host-gateway"

# Named volumes for persistent storage
volumes:
  postgres-data:
  minio-data:

# Network for service communication
networks:
  runner-network:
    driver: bridge