{
  "module": "gitea",
  "version": "1",

  "requires": ["postgres-database"],
  "contributes": {
    "postgres-database": {"name": "gitea"}
  },
  "binds": {"postgres-database": "/var/lib/gitea/database.json"},
  "secrets": {"postgres-database": "/var/lib/gitea/database.secret"},

  "capabilities": ["container-runtime"],

  "listens": [
    {"port": 3000, "protocol": "tcp", "from": "mesh", "why": "the forge, over http"},
    {"port": 2222, "protocol": "tcp", "from": "mesh",
     "why": "git over ssh. Not 22: the machine's own daemon holds that, and a module does not take it"}
  ],

  "own-secrets": {"internal-token": "/var/lib/gitea/internal-token.secret"},

  "resources": [
    {"id": "state", "type": "directory", "path": "/var/lib/gitea", "mode": "0700"},

    {"id": "server-env", "type": "file", "path": "/var/lib/gitea/server.env", "mode": "0600",
     "content": "GITEA__security__INTERNAL_TOKEN=${secret:internal-token}\nGITEA__database__DB_TYPE=postgres\nGITEA__database__HOST=${bound:postgres-database:at}:${bound:postgres-database:port}\nGITEA__database__NAME=gitea\nGITEA__database__USER=${bound:postgres-database:as}\nGITEA__database__PASSWD=${secret:postgres-database}\n"},

    {"id": "server", "type": "container", "name": "gitea",
     "image": "gitea/gitea@sha256:dfc61e347c8b582df918f4556401bf2cecdfbdb56c5282ae9488dd76fca3e41c",
     "env": {"DB_TYPE": "postgres", "USER_UID": "1000", "USER_GID": "1000"},
     "env-file": ["/var/lib/gitea/server.env"],
     "ports": ["3000:3000", "2222:22"],
     "volumes": ["/services/gitea/gitea:/data"],
     "restart-on": ["server-env"]}
  ]
}