.env.sample

@@ -1,30 +1,39 @@
 TYPE=woodpecker
-
 DOMAIN=woodpecker.example.com
+COMPOSE_FILE="compose.yml"
 
 ## Domain aliases
 #EXTRA_DOMAINS=', `www.woodpecker.example.com`'
 
 LETS_ENCRYPT_ENV=production
 
+# Change if you're only setting the agent on this machine
+WOODPECKER_SERVER=server:9000
+SECRET_AGENT_SECRET_VERSION=v1 # length=64 charset=hex
+
+# Agent
+WOODPECKER_MAX_PROCS=4
+
+# Server
+#COMPOSE_FILE="$COMPOSE_FILE:compose.server.yml"
+WOODPECKER_HOST=https://${DOMAIN}
 WOODPECKER_OPEN=true
 WOODPECKER_ADMIN=
+WOODPECKER_LOG_LEVEL=info
+WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx
+WOODPECKER_PLUGINS_TRUSTED_CLONE=woodpeckerci/plugin-docker-buildx
+WOODPECKER_AUTHENTICATE_PUBLIC_REPOS=true
+#WOODPECKER_DEFAULT_PIPELINE_TIMEOUT=
+#WOODPECKER_MAX_PIPELINE_TIMEOUT=
 
-## Gitea
-COMPOSE_FILE="compose.yml:compose.gitea.yml"
+# Gitea
+# https://woodpecker-ci.org/docs/administration/configuration/forges/gitea
+COMPOSE_FILE="$COMPOSE_FILE:compose.gitea.yml"
 WOODPECKER_GITEA_URL=https://git.example.org
-WOODPECKER_GITEA_CLIENT=
-# see: https://woodpecker-ci.org/docs/administration/vcs/gitea
+SECRET_GITEA_CLIENT_VERSION=v1 # generate=false
+SECRET_CLIENT_SECRET_VERSION=v1 # generate=false
 
-## Github
-# COMPOSE_FILE="compose.yml:compose.github.yml"
-# WOODPECKER_GITHUB_CLIENT=
-# WOODPECKER_GITHUB_SECRET=
-
-## SECRETS
-SECRET_AGENT_SECRET_VERSION=v1
-CLIENT_SECRET_VERSION=v1
-
-## Agent
-
-WOODPECKER_MAX_PROCS=4
+# Github
+#COMPOSE_FILE="$COMPOSE_FILE:compose.github.yml"
+#WOODPECKER_GITHUB_CLIENT=
+#SECRET_CLIENT_SECRET_VERSION=v1 # generate=false

compose.gitea.yml

@@ -1,16 +1,19 @@
+---
 version: '3.8'
-
 services:
-  app:
+  server:
     environment:
       - WOODPECKER_GITEA=true
       - WOODPECKER_GITEA_URL
-      - WOODPECKER_GITEA_CLIENT
-      - WOODPECKER_GITEA_SECRET
+      - WOODPECKER_GITEA_CLIENT_FILE=/run/secrets/gitea_client
+      - WOODPECKER_GITEA_SECRET_FILE=/run/secrets/client_secret
     secrets:
       - client_secret
-
+      - gitea_client
 secrets:
   client_secret:
     name: ${STACK_NAME}_client_secret_${SECRET_CLIENT_SECRET_VERSION}
     external: true
+  gitea_client:
+    name: ${STACK_NAME}_gitea_client_${SECRET_GITEA_CLIENT_VERSION}
+    external: true

compose.github.yml

@@ -1,14 +1,13 @@
+---
 version: '3.8'
-
 services:
-  app:
+  server:
     environment:
       - WOODPECKER_GITHUB=true
       - WOODPECKER_GITHUB_CLIENT
-      - WOODPECKER_GITHUB_SECRET
+      - WOODPECKER_GITHUB_SECRET_FILE=/run/secrets/client_secret
     secrets:
       - client_secret
-
 secrets:
   client_secret:
     name: ${STACK_NAME}_client_secret_${SECRET_CLIENT_SECRET_VERSION}

compose.server.yml

@@ -0,0 +1,34 @@
+---
+version: "3.8"
+services:
+  server:
+    image: woodpeckerci/woodpecker-server:v3.20.1
+    volumes:
+      - data:/var/lib/woodpecker/
+    environment:
+      - WOODPECKER_OPEN
+      - WOODPECKER_HOST
+      - WOODPECKER_ADMIN
+      - WOODPECKER_AGENT_SECRET_FILE=/run/secrets/agent_secret
+      - WOODPECKER_LOG_LEVEL
+      - WOODPECKER_PLUGINS_PRIVILEGED
+      - WOODPECKER_PLUGINS_TRUSTED_CLONE
+      - WOODPECKER_AUTHENTICATE_PUBLIC_REPOS
+      - WOODPECKER_DEFAULT_PIPELINE_TIMEOUT=${WOODPECKER_DEFAULT_PIPELINE_TIMEOUT:-60}
+      - WOODPECKER_MAX_PIPELINE_TIMEOUT=${WOODPECKER_MAX_PIPELINE_TIMEOUT:-120}
+    secrets:
+      - agent_secret
+    networks:
+      - proxy
+      - internal
+    deploy:
+      restart_policy:
+        condition: on-failure
+      labels:
+        - "traefik.enable=true"
+        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8000"
+        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
+        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
+        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
+volumes:
+  data:

compose.yml

@@ -1,72 +1,34 @@
 ---
 version: "3.8"
-
 services:
   app:
-    image: woodpeckerci/woodpecker-server:v0.15.6-alpine
-    volumes:
-      - data:/var/lib/woodpecker/
-    configs:
-      - source: woodpecker_env
-        target: .env
-    environment:
-      - WOODPECKER_OPEN
-      - WOODPECKER_HOST=https://${DOMAIN}
-      - WOODPECKER_ADMIN
-    secrets:
-      - agent_secret
-    networks:
-      - proxy
-      - internal
-    deploy:
-      restart_policy:
-        condition: on-failure
-      labels:
-        - "traefik.enable=true"
-        - "traefik.http.services.${STACK_NAME}.loadbalancer.server.port=8000"
-        - "traefik.http.routers.${STACK_NAME}.rule=Host(`${DOMAIN}`${EXTRA_DOMAINS})"
-        - "traefik.http.routers.${STACK_NAME}.entrypoints=web-secure"
-        - "traefik.http.routers.${STACK_NAME}.tls.certresolver=${LETS_ENCRYPT_ENV}"
-        - "coop-cloud.${STACK_NAME}.version=0.1.0+v0.15.6-alpine"
-
-  agent:
-    image: woodpeckerci/woodpecker-agent:v0.15.6-alpine
+    image: woodpeckerci/woodpecker-agent:v3.20.1
     command: agent
     depends_on:
       - woodpecker-server
     volumes:
       - /var/run/docker.sock:/var/run/docker.sock
+      - agent:/etc/woodpecker
     environment:
-      - WOODPECKER_SERVER=app:9000
+      - WOODPECKER_SERVER
       - WOODPECKER_MAX_PROCS
+      - WOODPECKER_AGENT_SECRET_FILE=/run/secrets/agent_secret
     networks:
       - internal
-    configs:
-      - source: woodpecker_env
-        target: .env
     secrets:
       - agent_secret
     deploy:
       restart_policy:
         condition: on-failure
-
+      labels:
+        - "coop-cloud.${STACK_NAME}.version=0.1.0+v0.15.6-alpine"
 networks:
   proxy:
     external: true
   internal:
-
-
-volumes:
-  data:
-
-
-configs:
-  woodpecker_env:
-    name: ${STACK_NAME}_woodpecker_env_${WOODPECKER_ENV_VERSION}
-    file: woodpecker.env.tmpl
-    template_driver: golang
-
 secrets:
   agent_secret:
     name: ${STACK_NAME}_agent_secret_${SECRET_AGENT_SECRET_VERSION}
     external: true
+volumes:
+  agent:

woodpecker.env.tmpl

@@ -1,7 +0,0 @@
-WOODPECKER_AGENT_SECRET={{ secret "agent_secret" }}
-{{ if (env "WOODPECKER_GITEA_CLIENT") }}
-WOODPECKER_GITEA_SECRET={{ secret "client_secret" }}
-{{ end }}
-{{ if (env "WOODPECKER_GITHUB_CLIENT") }}
-WOODPECKER_GITHUB_SECRET={{ secret "client_secret" }}
-{{ end }}