From c7fd2801d27d4513ca88d102fa260ed2c3bf0744 Mon Sep 17 00:00:00 2001
From: Stefan <stefan@smulders.online>
Date: Fri, 30 Oct 2026 09:42:57 +0000
Subject: [PATCH] Initial Woodpecker CI setup

---
 .env.example       | 24 +++++++++++++
 .gitignore         |  1 +
 README.md          | 86 ++++++++++++++++++++++++++++++++++++++++++++++
 docker-compose.yml | 60 ++++++++++++++++++++++++++++++++
 4 files changed, 171 insertions(+)
 create mode 100644 .env.example
 create mode 100644 .gitignore
 create mode 100644 README.md
 create mode 100644 docker-compose.yml

diff --git a/.env.example b/.env.example
new file mode 100644
index 0000000..a6cdf5c
--- /dev/null
+++ b/.env.example
@@ -0,0 +1,24 @@
+# ============================================================
+# Woodpecker CI — environment variables
+# Copy to .env and fill in all values before starting
+# ============================================================
+
+# --- Gitea OAuth2 app ---
+# Create at: https://<your-gitea>/user/settings/applications
+# Redirect URI: https://pecker.smulders.online/authorize
+WOODPECKER_GITEA_CLIENT=
+WOODPECKER_GITEA_SECRET=
+
+# URL of your Gitea instance (no trailing slash)
+WOODPECKER_GITEA_URL=https://git.smulders.online
+
+# Shared secret between server and agent — generate with:
+#   openssl rand -hex 32
+WOODPECKER_AGENT_SECRET=
+
+# Public URL of this Woodpecker instance
+WOODPECKER_HOST=https://pecker.smulders.online
+
+# Gitea usernames allowed to use Woodpecker (comma-separated)
+# Leave empty to allow all users on the Gitea instance
+WOODPECKER_ADMIN=stefan
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..4c49bd7
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.env
diff --git a/README.md b/README.md
new file mode 100644
index 0000000..a056390
--- /dev/null
+++ b/README.md
@@ -0,0 +1,86 @@
+# Woodpecker CI
+
+Woodpecker CI met Gitea OAuth2, Traefik reverse proxy, en een lokale Docker-agent.
+
+## Eerste keer opstarten
+
+### 1. Gitea OAuth2 applicatie aanmaken
+
+Ga naar `https://<jouw-gitea>/user/settings/applications` en maak een nieuwe OAuth2 App:
+
+- **Application name:** Woodpecker CI
+- **Redirect URI:** `https://pecker.smulders.online/authorize`
+
+Noteer de **Client ID** en **Client Secret**.
+
+### 2. .env aanmaken
+
+```bash
+cp .env.example .env
+```
+
+Vul in:
+
+| Variabele | Waarde |
+|---|---|
+| `WOODPECKER_GITEA_CLIENT` | Client ID uit stap 1 |
+| `WOODPECKER_GITEA_SECRET` | Client Secret uit stap 1 |
+| `WOODPECKER_GITEA_URL` | URL van je Gitea instance |
+| `WOODPECKER_AGENT_SECRET` | `openssl rand -hex 32` |
+| `WOODPECKER_HOST` | `https://pecker.smulders.online` |
+| `WOODPECKER_ADMIN` | Je Gitea gebruikersnaam |
+
+### 3. Starten
+
+Via Portainer: importeer de stack en wijs de `.env` toe.
+
+Of via CLI:
+
+```bash
+docker compose up -d
+```
+
+### 4. Verificatie
+
+```bash
+docker compose logs -f woodpecker-server
+```
+
+Woodpecker is bereikbaar op `https://pecker.smulders.online`.
+
+## Architectuur
+
+```
+Internet
+  └── Traefik (traefik-proxy network)
+        └── woodpecker-server :8000  (UI + API)
+              └── woodpecker-agent    (woodpecker-internal network)
+                    └── Docker socket (pipeline containers)
+```
+
+- **Server** zit op twee netwerken: `traefik-proxy` (extern) en `woodpecker-internal` (intern naar agent)
+- **Agent** zit alleen op `woodpecker-internal` — niet direct bereikbaar van buiten
+- Agent communiceert met server via gRPC op poort `9000`
+
+## Authentik toevoegen (later)
+
+Voeg aan de server-labels toe:
+
+```yaml
+- "traefik.http.routers.woodpecker.middlewares=authentik@docker"
+```
+
+En zorg dat de Authentik forward-auth middleware beschikbaar is in Traefik.
+
+## Pipeline voorbeeld
+
+Maak `.woodpecker.yml` in een Gitea-repo:
+
+```yaml
+steps:
+  - name: build
+    image: python:3.12-slim
+    commands:
+      - pip install -r requirements.txt
+      - python -m pytest
+```
diff --git a/docker-compose.yml b/docker-compose.yml
new file mode 100644
index 0000000..d8a74c3
--- /dev/null
+++ b/docker-compose.yml
@@ -0,0 +1,60 @@
+---
+services:
+
+  woodpecker-server:
+    image: woodpeckerci/woodpecker-server:latest
+    container_name: woodpecker-server
+    restart: unless-stopped
+    networks:
+      - traefik-proxy
+      - woodpecker-internal
+    volumes:
+      - woodpecker-server-data:/var/lib/woodpecker
+    environment:
+      WOODPECKER_OPEN: "false"
+      WOODPECKER_GITEA: "true"
+      WOODPECKER_GITEA_URL: ${WOODPECKER_GITEA_URL}
+      WOODPECKER_GITEA_CLIENT: ${WOODPECKER_GITEA_CLIENT}
+      WOODPECKER_GITEA_SECRET: ${WOODPECKER_GITEA_SECRET}
+      WOODPECKER_HOST: ${WOODPECKER_HOST}
+      WOODPECKER_AGENT_SECRET: ${WOODPECKER_AGENT_SECRET}
+      WOODPECKER_ADMIN: ${WOODPECKER_ADMIN}
+      WOODPECKER_LOG_LEVEL: info
+    labels:
+      - "traefik.enable=true"
+      - "traefik.docker.network=traefik-proxy"
+
+      # Router
+      - "traefik.http.routers.woodpecker.rule=Host(`pecker.smulders.online`)"
+      - "traefik.http.routers.woodpecker.entrypoints=websecure"
+      - "traefik.http.routers.woodpecker.tls=true"
+      - "traefik.http.routers.woodpecker.tls.certresolver=letsencrypt"
+
+      # Service
+      - "traefik.http.services.woodpecker.loadbalancer.server.port=8000"
+
+  woodpecker-agent:
+    image: woodpeckerci/woodpecker-agent:latest
+    container_name: woodpecker-agent
+    restart: unless-stopped
+    depends_on:
+      - woodpecker-server
+    networks:
+      - woodpecker-internal
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+    environment:
+      WOODPECKER_SERVER: woodpecker-server:9000
+      WOODPECKER_AGENT_SECRET: ${WOODPECKER_AGENT_SECRET}
+      WOODPECKER_MAX_WORKFLOWS: 4
+      WOODPECKER_LOG_LEVEL: info
+      WOODPECKER_BACKEND: docker
+
+networks:
+  traefik-proxy:
+    external: true
+  woodpecker-internal:
+    driver: bridge
+
+volumes:
+  woodpecker-server-data: