docker-compose.yml

services:
  gitea:
    image: gitea/gitea:1.25
    container_name: sandbox-gitea
    environment:
      - GITEA__server__ROOT_URL=http://localhost:${GITEA_PORT:-3000}
      - GITEA__server__HTTP_PORT=3000
      - GITEA__server__PUBLIC_URL_DETECTION=auto
      - GITEA__server__LANDING_PAGE=explore
      - GITEA__database__DB_TYPE=sqlite3
      - GITEA__security__SECRET_KEY=${GITEA_SECRET_KEY}
      - GITEA__security__INSTALL_LOCK=true
      - GITEA__service__DISABLE_REGISTRATION=true
      - GITEA__service__REQUIRE_SIGNIN_VIEW=false
      - GITEA__mirror__ENABLED=true
      - GITEA__mirror__MIN_INTERVAL=${MIRROR_INTERVAL:-1m}
      - GITEA__mirror__DEFAULT_INTERVAL=${MIRROR_INTERVAL:-1m}
      - GITEA__cron__update_mirrors__SCHEDULE=@every ${MIRROR_INTERVAL:-1m}
      - GITEA__repository__DEFAULT_BRANCH=main
      # Disable features we don't need
      - GITEA__openid__ENABLE_OPENID_SIGNIN=false
      - GITEA__openid__ENABLE_OPENID_SIGNUP=false
    volumes:
      - gitea-data:/data
    ports:
      - "${GITEA_PORT:-3000}:3000"
    networks:
      - dev-sandbox
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/api/v1/version"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 30s

  router:
    build: ./router
    container_name: sandbox-router
    networks:
      - dev-sandbox
    cap_add:
      - NET_ADMIN
      - NET_RAW
    sysctls:
      - net.ipv4.ip_forward=1
    volumes:
      - router-rules:/etc/sandbox/rules
    restart: unless-stopped


volumes:
  gitea-data:
  router-rules:

networks:
  # Infrastructure network: has internet access via Docker gateway.
  # Agent networks are created per-project by sandbox.py (internal, routed through sandbox-router).
  dev-sandbox:
    name: dev-sandbox
    driver: bridge