services:
  k3s-server:
    image: rancher/k3s:v1.36.2-k3s1
    container_name: k3s-server
    command:
      - server
      - --tls-san=127.0.0.1
      - --tls-san=k3s-server
      - --tls-san=${K3S_API_HOST:-127.0.0.1}   # внешний IP/домен для доступа к apiserver извне
      - --disable=traefik
    privileged: true
    cgroup: host          # kubelet в cgroup v2 (Ubuntu 22.04+/RedOS)
    restart: unless-stopped
    environment:
      K3S_TOKEN: ${K3S_TOKEN:-supersecrettoken}
      K3S_KUBECONFIG_OUTPUT: /output/kubeconfig.yaml
      K3S_KUBECONFIG_MODE: "644"
    ports:
      - "6443:6443"   # kube-apiserver — доступен извне; ОБЯЗАТЕЛЬНО ограничь фаерволом до доверенных IP
      - "80:80"        # ingress http  — задействуются после установки ingress-контроллера
      - "443:443"      # ingress https
    volumes:
      - k3s-server-data:/var/lib/rancher/k3s   # etcd/state, образы, манифесты — только named volume
      - ./k3s:/output:z                 # отсюда забираем контекст k8s (:z — SELinux label для RedOS)
    tmpfs:
      - /run
      - /var/run
    ulimits:
      nproc: 65535
      nofile:
        soft: 65535
        hard: 65535
    healthcheck:
      test: ["CMD", "kubectl", "get", "--raw=/readyz"]
      interval: 10s
      timeout: 5s
      retries: 30
      start_period: 30s

  k3s-worker:
    image: rancher/k3s:v1.36.2-k3s1
    container_name: k3s-worker
    command:
      - agent
    privileged: true
    cgroup: host          # kubelet в cgroup v2 (Ubuntu 22.04+/RedOS)
    restart: unless-stopped
    depends_on:
      k3s-server:
        condition: service_healthy
    environment:
      K3S_URL: https://k3s-server:6443
      K3S_TOKEN: ${K3S_TOKEN:-supersecrettoken}
    volumes:
      - k3s-worker-data:/var/lib/rancher/k3s
    tmpfs:
      - /run
      - /var/run
    ulimits:
      nproc: 65535
      nofile:
        soft: 65535
        hard: 65535

  gitea:
    image: gitea/gitea:1.22
    container_name: gitea
    restart: unless-stopped
    environment:
      USER_UID: 1000
      USER_GID: 1000
      GITEA__server__ROOT_URL: ${GITEA_ROOT_URL:-http://localhost:3000/}
      GITEA__server__SSH_PORT: ${GITEA_SSH_PORT:-2222}
    ports:
      - "3000:3000"                       # web UI (80/443 заняты k3s)
      - "${GITEA_SSH_PORT:-2222}:22"      # git over ssh
    volumes:
      - ./gitea-data:/data:z            # :z — SELinux label для RedOS
    healthcheck:
      test: ["CMD", "curl", "-fsS", "http://localhost:3000/api/healthz"]
      interval: 10s
      timeout: 5s
      retries: 12
      start_period: 20s

volumes:
  k3s-server-data:
  k3s-worker-data:
  gitea-data: