homelab/k8s/bootstrap-local/04-forgejo.yaml

# Forgejo - Git server hosting the GitOps repo (bootstrap only, manual sync).
# ArgoCD cannot auto-sync Forgejo because Forgejo hosts the repo ArgoCD syncs
# from → circular dependency. Apply once via bootstrap, manual sync only afterward.
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "0"  # Bootstrap wave
    bootstrap-phase: "0"
    description: "Bootstrap-only: Forgejo hosts the GitOps repo"
spec:
  project: homelab
  source:
    repoURL: https://dl.gitea.com/charts/
    chart: gitea
    targetRevision: "~10"
    helm:
      # Inline values (git-independent) - keep in sync with k8s/security/ci-cd/forgejo-values.yaml
      valuesObject:
        image:
          repository: codeberg.org/forgejo/forgejo
          tag: "13"
          pullPolicy: IfNotPresent
        gitea:
          admin:
            username: rock
            email: [email protected]
          config:
            server:
              PROTOCOL: http
              DOMAIN: forgejo.riotpiao.com
              ROOT_URL: https://forgejo.riotpiao.com/
              HTTP_PORT: 3000
              START_SSH_SERVER: true
              SSH_DOMAIN: forgejo.riotpiao.com
              SSH_PORT: 2222
              SSH_LISTEN_PORT: 2222
            database:
              DB_TYPE: postgres
              HOST: ddb-cluster-rw.ddb.svc:5432
              NAME: forgejo
              USER: app
            repository:
              ROOT: /data/git
            actions:
              ENABLED: true
            packages:
              ENABLED: true
            metrics:
              ENABLED: true
            service:
              DISABLE_REGISTRATION: true
            oauth2:
              ENABLED: true
              PROVIDER: openidconnect
              OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
              CLIENT_ID: forgejo
              AUTO_DISCOVER_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
            cache:
              ADAPTER: redis
              HOST: "redis://forgejo-redis.cicd.svc:6379/0"
            session:
              PROVIDER: redis
              PROVIDER_CONFIG: "redis://forgejo-redis.cicd.svc:6379/1"
            queue:
              TYPE: redis
              CONN_STR: "redis://forgejo-redis.cicd.svc:6379/2"
          metrics:
            enabled: true
            serviceMonitor:
              enabled: false
        persistence:
          enabled: true
          storageClass: longhorn
          size: 20Gi
          accessModes:
            - ReadWriteMany
        replicaCount: 2
        deployment:
          strategy:
            type: RollingUpdate
          env:
            - name: SSL_CERT_DIR
              value: /homelab-ca
            - name: GITEA__database__PASSWD
              valueFrom:
                secretKeyRef:
                  name: ddb-cluster-app
                  key: password
            - name: GITEA__oauth2__CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: forgejo-oidc
                  key: CLIENT_SECRET
        podAnnotations:
          configmap.reloader.stakater.com/reload: "homelab-ca"
        service:
          http:
            type: LoadBalancer
            port: 3000
            targetPort: 3000
            annotations:
              io.cilium/lb-ipam-ips: "192.168.1.165"
              io.cilium/lb-ipam-sharing-key: "forgejo"
          ssh:
            type: LoadBalancer
            port: 2222
            targetPort: 2222
            annotations:
              io.cilium/lb-ipam-ips: "192.168.1.165"
              io.cilium/lb-ipam-sharing-key: "forgejo"
        resources:
          requests:
            cpu: 250m
            memory: 512Mi
          limits:
            cpu: "1"
            memory: 1Gi
        tolerations:
          - key: node-role.kubernetes.io/control-plane
            operator: Exists
            effect: NoSchedule
        extraVolumes:
          - name: homelab-ca
            configMap:
              name: homelab-ca
        extraVolumeMounts:
          - name: homelab-ca
            mountPath: /homelab-ca
            readOnly: true
        ingress:
          enabled: false
        postgresql:
          enabled: false
        postgresql-ha:
          enabled: false
        mysql:
          enabled: false
        redis-cluster:
          enabled: false
        act_runner:
          enabled: false
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  syncPolicy:
    # NO automated sync - Forgejo hosts the repo; auto-sync would let a bad
    # CI commit break the system CI depends on. Manual sync only.
    syncOptions: []