homelab/k8s/talos-ci-cd/forgejo-values.yaml

# k8s/talos-ci-cd/forgejo-values.yaml
# Forgejo deployed via the gitea-charts/gitea Helm chart with image override.
# Admin password injected via helmfile --set (FORGEJO_ADMIN_PASSWORD in .env).
# Runner is managed by a separate helmfile release (charts/forgejo-runner/).
#
# Chart docs: https://gitea.com/gitea/helm-chart

# ── Image (Forgejo replaces Gitea — drop-in compatible) ──────────────────────
image:
  repository: codeberg.org/forgejo/forgejo
  tag: "13"        # pin exact release — check codeberg.org/forgejo/forgejo/releases
  pullPolicy: IfNotPresent

# ── Bootstrap admin (provisioned by a post-install Job inside the chart) ──────
gitea:
  admin:
    username: rock
    email: [email protected]
    # password: injected via helmfile --set (FORGEJO_ADMIN_PASSWORD from .env)

  config:
    server:
      PROTOCOL: http        # nginx ingress handles TLS; pod serves plain HTTP
      DOMAIN: forgejo.riotpiao.homelab.com
      ROOT_URL: https://forgejo.riotpiao.homelab.com/
      HTTP_PORT: 3000
      START_SSH_SERVER: true
      SSH_DOMAIN: forgejo.riotpiao.homelab.com
      SSH_PORT: 2222
      SSH_LISTEN_PORT: 2222
    database:
      DB_TYPE: sqlite3
      PATH: /data/forgejo.db
    repository:
      ROOT: /data/git
    actions:
      ENABLED: true
    packages:
      ENABLED: true      # built-in OCI registry
    metrics:
      ENABLED: true      # Prometheus at /metrics
    service:
      DISABLE_REGISTRATION: true    # no self-signup; Authentik OAuth2 auto-creates accounts
    oauth2:
      ENABLED: true
      PROVIDER: openidconnect
      OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.homelab.com/application/o/forgejo/.well-known/openid-configuration
      CLIENT_ID: forgejo
      AUTO_DISCOVER_URL: https://authentik.riotpiao.homelab.com/application/o/forgejo/.well-known/openid-configuration
    cache:
      ADAPTER: memory    # no Redis — single-replica SQLite setup
    session:
      PROVIDER: memory
    queue:
      TYPE: channel      # in-memory queue; no file lock, no LevelDB contention on rollout

  metrics:
    enabled: true
    serviceMonitor:
      enabled: true      # kube-prometheus-stack discovers ServiceMonitors cluster-wide

# ── Persistence (Longhorn RWO — SQLite lives here) ────────────────────────────
persistence:
  enabled: true
  storageClass: longhorn
  size: 20Gi
  accessModes:
    - ReadWriteOnce

# ── Deployment strategy ────────────────────────────────────────────────────────
# RWO PVC + SQLite: old pod must terminate before new one mounts the volume.
deployment:
  strategy:
    type: Recreate
  env:
    - name: SSL_CERT_DIR
      value: /homelab-ca

# ── Cert / CA auto-reload ─────────────────────────────────────────────────────
# nginx serves the wildcard-tls cert — Forgejo itself never reads a TLS secret.
# The only reload trigger is homelab-ca: if the root CA rotates, the mounted
# ConfigMap changes and Forgejo must restart to pick up the new CA bundle for OIDC.
podAnnotations:
  configmap.reloader.stakater.com/reload: "homelab-ca"

# ── Services (Cilium LB-IPAM pins both to 192.168.1.165) ─────────────────────
service:
  http:
    type: LoadBalancer
    port: 3000
    targetPort: 3000
    annotations:
      io.cilium/lb-ipam-ips: "192.168.1.165"
      io.cilium/lb-ipam-sharing-key: "forgejo"
  ssh:
    type: LoadBalancer
    port: 2222
    targetPort: 2222
    annotations:
      io.cilium/lb-ipam-ips: "192.168.1.165"
      io.cilium/lb-ipam-sharing-key: "forgejo"

# ── Resources ─────────────────────────────────────────────────────────────────
resources:
  requests:
    cpu: 250m
    memory: 512Mi
  limits:
    cpu: "1"
    memory: 1Gi

# ── Node resilience ───────────────────────────────────────────────────────────
tolerations:
  - key: node-role.kubernetes.io/control-plane
    operator: Exists
    effect: NoSchedule

# ── CA trust ─────────────────────────────────────────────────────────────────
# Go reads SSL_CERT_DIR as an additional cert directory ON TOP OF the default
# cert files (ca-certificates.crt stays intact — no init container needed).
# Setting SSL_CERT_DIR=/homelab-ca makes Go also read homelab-ca.crt from there,
# trusting both the standard Mozilla bundle and our homelab CA.
# Required for OIDC: Forgejo fetches Authentik's discovery endpoint which
# presents a cert signed by homelab-ca.
extraVolumes:
  - name: homelab-ca
    configMap:
      name: homelab-ca

extraVolumeMounts:
  - name: homelab-ca
    mountPath: /homelab-ca
    readOnly: true

# ── Ingress: disabled — rule lives in k8s/ingress/ingress.yaml ───────────────
ingress:
  enabled: false

# ── Bundled databases + cache: all disabled — SQLite + memory is the chosen backend ──
postgresql:
  enabled: false
postgresql-ha:
  enabled: false
mysql:
  enabled: false
redis-cluster:
  enabled: false   # 6-node cluster is overkill for single-replica SQLite Forgejo

# ── Act runner subchart: disabled — managed by the forgejo-runner helmfile release
act_runner:
  enabled: false