k8s/ci-cd: add forgejo gitops and argocd deployment

- Forgejo git forge + OCI registry - Argo CD pull-based GitOps - Private CA TLS (self-signed 10-year cert) - Machine credentials scoped to repositories
2026-07-11 19:17:34 -07:00
parent 63d7256b9e
commit 4ab596196e
14 changed files with 738 additions and 0 deletions
@@ -0,0 +1,151 @@
+# k8s/talos-ci-cd/forgejo-values.yaml
+# Forgejo deployed via the gitea-charts/gitea Helm chart with image override.
+# Admin password injected via helmfile --set (FORGEJO_ADMIN_PASSWORD in .env).
+# Runner is managed by a separate helmfile release (charts/forgejo-runner/).
+#
+# Chart docs: https://gitea.com/gitea/helm-chart
+
+# ── Image (Forgejo replaces Gitea — drop-in compatible) ──────────────────────
+image:
+  repository: codeberg.org/forgejo/forgejo
+  tag: "13"        # pin exact release — check codeberg.org/forgejo/forgejo/releases
+  pullPolicy: IfNotPresent
+
+# ── Bootstrap admin (provisioned by a post-install Job inside the chart) ──────
+gitea:
+  admin:
+    username: rock
+    email: [email protected]
+    # password: injected via helmfile --set (FORGEJO_ADMIN_PASSWORD from .env)
+
+  config:
+    server:
+      PROTOCOL: http        # nginx ingress handles TLS; pod serves plain HTTP
+      DOMAIN: forgejo.riotpiao.homelab.com
+      ROOT_URL: https://forgejo.riotpiao.homelab.com/
+      HTTP_PORT: 3000
+      START_SSH_SERVER: true
+      SSH_DOMAIN: forgejo.riotpiao.homelab.com
+      SSH_PORT: 2222
+      SSH_LISTEN_PORT: 2222
+    database:
+      DB_TYPE: sqlite3
+      PATH: /data/forgejo.db
+    repository:
+      ROOT: /data/git
+    actions:
+      ENABLED: true
+    packages:
+      ENABLED: true      # built-in OCI registry
+    metrics:
+      ENABLED: true      # Prometheus at /metrics
+    service:
+      DISABLE_REGISTRATION: true    # no self-signup; Authentik OAuth2 auto-creates accounts
+    oauth2:
+      ENABLED: true
+      PROVIDER: openidconnect
+      OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.homelab.com/application/o/forgejo/.well-known/openid-configuration
+      CLIENT_ID: forgejo
+      AUTO_DISCOVER_URL: https://authentik.riotpiao.homelab.com/application/o/forgejo/.well-known/openid-configuration
+    cache:
+      ADAPTER: memory    # no Redis — single-replica SQLite setup
+    session:
+      PROVIDER: memory
+    queue:
+      TYPE: channel      # in-memory queue; no file lock, no LevelDB contention on rollout
+
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true      # kube-prometheus-stack discovers ServiceMonitors cluster-wide
+
+# ── Persistence (Longhorn RWO — SQLite lives here) ────────────────────────────
+persistence:
+  enabled: true
+  storageClass: longhorn
+  size: 20Gi
+  accessModes:
+    - ReadWriteOnce
+
+# ── Deployment strategy ────────────────────────────────────────────────────────
+# RWO PVC + SQLite: old pod must terminate before new one mounts the volume.
+deployment:
+  strategy:
+    type: Recreate
+  env:
+    - name: SSL_CERT_DIR
+      value: /homelab-ca
+
+# ── Cert / CA auto-reload ─────────────────────────────────────────────────────
+# nginx serves the wildcard-tls cert — Forgejo itself never reads a TLS secret.
+# The only reload trigger is homelab-ca: if the root CA rotates, the mounted
+# ConfigMap changes and Forgejo must restart to pick up the new CA bundle for OIDC.
+podAnnotations:
+  configmap.reloader.stakater.com/reload: "homelab-ca"
+
+# ── Services (Cilium LB-IPAM pins both to 192.168.1.165) ─────────────────────
+service:
+  http:
+    type: LoadBalancer
+    port: 3000
+    targetPort: 3000
+    annotations:
+      io.cilium/lb-ipam-ips: "192.168.1.165"
+      io.cilium/lb-ipam-sharing-key: "forgejo"
+  ssh:
+    type: LoadBalancer
+    port: 2222
+    targetPort: 2222
+    annotations:
+      io.cilium/lb-ipam-ips: "192.168.1.165"
+      io.cilium/lb-ipam-sharing-key: "forgejo"
+
+# ── Resources ─────────────────────────────────────────────────────────────────
+resources:
+  requests:
+    cpu: 250m
+    memory: 512Mi
+  limits:
+    cpu: "1"
+    memory: 1Gi
+
+# ── Node resilience ───────────────────────────────────────────────────────────
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+# ── CA trust ─────────────────────────────────────────────────────────────────
+# Go reads SSL_CERT_DIR as an additional cert directory ON TOP OF the default
+# cert files (ca-certificates.crt stays intact — no init container needed).
+# Setting SSL_CERT_DIR=/homelab-ca makes Go also read homelab-ca.crt from there,
+# trusting both the standard Mozilla bundle and our homelab CA.
+# Required for OIDC: Forgejo fetches Authentik's discovery endpoint which
+# presents a cert signed by homelab-ca.
+extraVolumes:
+  - name: homelab-ca
+    configMap:
+      name: homelab-ca
+
+extraVolumeMounts:
+  - name: homelab-ca
+    mountPath: /homelab-ca
+    readOnly: true
+
+# ── Ingress: disabled — rule lives in k8s/ingress/ingress.yaml ───────────────
+ingress:
+  enabled: false
+
+# ── Bundled databases + cache: all disabled — SQLite + memory is the chosen backend ──
+postgresql:
+  enabled: false
+postgresql-ha:
+  enabled: false
+mysql:
+  enabled: false
+redis-cluster:
+  enabled: false   # 6-node cluster is overkill for single-replica SQLite Forgejo
+
+# ── Act runner subchart: disabled — managed by the forgejo-runner helmfile release
+act_runner:
+  enabled: false