# 只加入 runner 与 Gitea 共用的内部网络，不发布端口，不挂 Docker socket。
services:
  gitea-runner-fetch-gate:
    image: ${GITEA_FETCH_GATE_IMAGE:?Set a verified no-object-cache CI image ID with Python 3}
    container_name: gitea-runner-fetch-gate
    restart: unless-stopped
    entrypoint: ['python3', '/app/gitea-runner-fetch-gate.py']
    environment:
      GITEA_RUNNER_UPSTREAM: http://gitea:3000
    read_only: true
    cap_drop: [ALL]
    security_opt: [no-new-privileges:true]
    cpus: 0.5
    mem_limit: 256m
    pids_limit: 128
    volumes:
      - /opt/genarrative-ci-cache/scripts/gitea-runner-fetch-gate.py:/app/gitea-runner-fetch-gate.py:ro
      - /var/lib/genarrative-ci-cache-gate:/control
    networks: [gitea-actions]

networks:
  gitea-actions:
    external: true