docker-compose.yml

services:
  db:
    image: postgres:15-alpine
    volumes:
      - db-data:/var/lib/postgresql/data
    secrets:
      - db_password.txt
    environment:
      POSTGRES_DB: buildbot
      POSTGRES_USER: buildbot
      POSTGRES_PASSWORD_FILE: /run/secrets/db_password.txt
    logging:
      driver: local
    restart: unless-stopped

  buildbot:
    build:
      context: .
      dockerfile: master/Dockerfile
    # Buildbot registers itself in the `masters` DB table under the name
    # "{hostname}:{basedir}". Without a pinned hostname, Docker assigns a new
    # random one (the container ID) every time the container is recreated,
    # so each update would otherwise create a brand-new master row forever.
    hostname: buildbot-master
    depends_on:
      - db
    ports:
      - "9990:9990"
    secrets:
      - db_password.txt
      - github_token.txt
      - halide_bb_pass.txt
      - webhook_token.txt
      - buildbot_www_pass.txt
    environment:
      HALIDE_BB_MASTER_SECRETS_DIR: /run/secrets
      HALIDE_BB_MASTER_DB_URL: "postgresql://buildbot:{DB_PASSWORD}@db/buildbot"
    logging:
      driver: local
    restart: unless-stopped

  caddy:
    image: caddy:2-alpine
    # --watch reloads the Caddyfile on change. It works only because the
    # config and assets are bind-mounted as directories below: a single-file
    # bind pins the original inode, so git's atomic-rename-on-pull would be
    # invisible to the running container (and a reload would re-read stale
    # content). Mounting the parent dirs lets the new inodes show through.
    command: caddy run --config /etc/caddy/Caddyfile --adapter caddyfile --watch
    ports:
      - "80:80"
      - "443:443"
      - "443:443/udp"
    volumes:
      - ./caddy:/etc/caddy:ro
      - ./www:/srv:ro
      - caddy-data:/data
      - caddy-config:/config
    logging:
      driver: local
    restart: unless-stopped

volumes:
  caddy-data:
  caddy-config:
  db-data:

secrets:
  db_password.txt:
    file: ${HALIDE_BB_MASTER_SECRETS_DIR:-./secrets}/db_password.txt
  github_token.txt:
    file: ${HALIDE_BB_MASTER_SECRETS_DIR:-./secrets}/github_token.txt
  halide_bb_pass.txt:
    file: ${HALIDE_BB_MASTER_SECRETS_DIR:-./secrets}/halide_bb_pass.txt
  webhook_token.txt:
    file: ${HALIDE_BB_MASTER_SECRETS_DIR:-./secrets}/webhook_token.txt
  buildbot_www_pass.txt:
    file: ${HALIDE_BB_MASTER_SECRETS_DIR:-./secrets}/buildbot_www_pass.txt