feat:Fix the bootstrap to be deploy key application

2026-07-23 19:07:39 -07:00
parent eba9f2144c
commit 1c7395d9e1
37 changed files with 1216 additions and 1202 deletions
@@ -0,0 +1,122 @@
+# Forgejo PostgreSQL Database — CNPG Cluster CR
+# This is the source of truth for Forgejo's database
+# ArgoCD will adopt this (not recreate it)
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: forgejo
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: forgejo-db
+  namespace: forgejo
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false  # Let ArgoCD adopt, don't delete
+  labels:
+    app: forgejo-db
+    layer: data
+spec:
+  instances: 3  # HA configuration
+
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.2
+
+  bootstrap:
+    initdb:
+      database: forgejo
+      owner: forgejo
+      encoding: UTF8
+      localeCollate: C
+      localeCType: C
+
+  enableSuperuserAccess: false
+
+  # Resource limits per best practices
+  resources:
+    requests:
+      memory: "4Gi"
+      cpu: "1"
+    limits:
+      memory: "8Gi"
+      cpu: "2"
+
+  postgresql:
+    parameters:
+      # Tuned for 4-8GB RAM
+      shared_buffers: "1GB"
+      effective_cache_size: "3GB"
+      maintenance_work_mem: "512MB"
+      work_mem: "64MB"
+      max_connections: "100"
+      max_parallel_workers: "2"
+      max_parallel_workers_per_gather: "1"
+      # WAL
+      wal_buffers: "16MB"
+      checkpoint_completion_target: "0.9"
+      min_wal_size: "512MB"
+      max_wal_size: "2GB"
+      # Logging
+      log_destination: "csvlog"
+      log_directory: "/controller/log"
+      log_filename: "postgres"
+
+  storage:
+    size: 50Gi
+    storageClass: longhorn-cnpg  # Uses postgres UID/GID mount options
+
+  monitoring:
+    enablePodMonitor: true
+
+  affinity:
+    podAntiAffinityType: required
+    topologyKey: kubernetes.io/hostname
+---
+# Forgejo Redis (cache, session, queue)
+apiVersion: v1
+kind: Service
+metadata:
+  name: forgejo-redis
+  namespace: forgejo
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+spec:
+  ports:
+    - port: 6379
+      targetPort: 6379
+      protocol: TCP
+  selector:
+    app: forgejo-redis
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: forgejo-redis
+  namespace: forgejo
+  annotations:
+    argocd.argoproj.io/sync-options: Prune=false
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: forgejo-redis
+  template:
+    metadata:
+      labels:
+        app: forgejo-redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          ports:
+            - containerPort: 6379
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
@@ -0,0 +1,86 @@
+# Forgejo Helm Values — Single Source of Truth
+# Chart: https://codeberg.org/forgejo-contrib/forgejo-helm
+
+gitea:
+  admin:
+    username: "admin"
+    email: "[email protected]"
+    # Password set via secret (not in values)
+
+  config:
+    server:
+      DOMAIN: forgejo.riotpiao.com
+      ROOT_URL: https://forgejo.riotpiao.com
+      SSH_DOMAIN: forgejo.riotpiao.com
+      SSH_PORT: 22
+      
+    database:
+      DB_TYPE: postgres
+      HOST: forgejo-db-rw.forgejo.svc.cluster.local:5432
+      NAME: forgejo
+      # User/password from CNPG-generated secret
+      USER:
+        valueFrom:
+          secretKeyRef:
+            name: forgejo-db-app
+            key: username
+      PASSWD:
+        valueFrom:
+          secretKeyRef:
+            name: forgejo-db-app
+            key: password
+      
+    cache:
+      ADAPTER: redis
+      HOST: redis://forgejo-redis.forgejo.svc.cluster.local:6379/0
+      
+    session:
+      PROVIDER: redis
+      PROVIDER_CONFIG: redis://forgejo-redis.forgejo.svc.cluster.local:6379/1
+      
+    queue:
+      TYPE: redis
+      CONN_STR: redis://forgejo-redis.forgejo.svc.cluster.local:6379/2
+
+# Persistence (shared storage for repos)
+persistence:
+  enabled: true
+  storageClass: longhorn
+  size: 20Gi
+  accessModes:
+    - ReadWriteOnce
+
+# Ingress
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+  hosts:
+    - host: forgejo.riotpiao.com
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: forgejo-tls
+      hosts:
+        - forgejo.riotpiao.com
+
+# Resources
+resources:
+  requests:
+    cpu: 200m
+    memory: 512Mi
+  limits:
+    cpu: 1000m
+    memory: 2Gi
+
+# Tolerations for control-plane
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+# ArgoCD adoption labels
+labels:
+  argocd.argoproj.io/instance: forgejo