feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

2026-07-19 09:29:17 -07:00
parent c6493f14ae
commit 578a707867
86 changed files with 889 additions and 446 deletions
@@ -3,7 +3,7 @@
 # Deployed via helmfile (name=argocd) so it sits alongside Authentik, MinIO, etc.
 #
 # UI is exposed via the cluster Ingress (k8s/ingress/ingress.yaml,
-# argocd.riotpiao.homelab.com) over the WireGuard/LAN-only nginx ingress —
+# argocd.riotpiao.com) over the WireGuard/LAN-only nginx ingress —
 # never as a LoadBalancer, since argocd-server holds cluster-admin
 # credentials and that Ingress isn't reachable from the WAN.
 #
@@ -12,7 +12,7 @@
 # CA trust for Forgejo repo clones injected into argocd-tls-certs-cm by postsync hook.

 global:
-  domain: argocd.riotpiao.homelab.com
+  domain: argocd.riotpiao.com

 configs:
  params:
@@ -23,10 +23,10 @@ configs:
    # Authentik (provision_oidc.py argocd_url) exactly — ArgoCD builds its
    # OIDC redirect_uri as "{url}/auth/callback", so any mismatch here is
    # what Authentik's "Invalid redirect URL" error means.
-    url: "https://argocd.riotpiao.homelab.com"
+    url: "https://argocd.riotpiao.com"
    oidc.config: |
      name: Authentik
-      issuer: https://authentik.riotpiao.homelab.com/application/o/argocd/
+      issuer: https://authentik.riotpiao.com/application/o/argocd/
      clientID: $oidc-secret:client-id
      clientSecret: $oidc-secret:client-secret
      requestedScopes: [openid, profile, email, groups]
@@ -4,7 +4,7 @@ runner:
    tag: "6"          # pin exact release before apply
  name: talos-runner
  labels: "docker:docker://node:22-bookworm"
-  forgejoUrl: https://forgejo.riotpiao.homelab.com
+  forgejoUrl: https://forgejo.riotpiao.com
  # tokenSecret: name of the K8s Secret that holds the runner registration token
  # created automatically by the helmfile presync hook (see helmfile.yaml.gotmpl)
  tokenSecret: runner-token
@@ -16,7 +16,7 @@ spec:
      containers:
        - name: api
          # CI bumps this tag on every push to main (ci.yml step "bump deploy repo")
-          image: forgejo.riotpiao.homelab.com/rock/api:latest
+          image: forgejo.riotpiao.com/rock/api:latest
          ports:
            - containerPort: 8080
          resources:
@@ -8,7 +8,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://forgejo.forge.riotpiao.homelab.com/rock/deploy.git
+    repoURL: https://forgejo.forge.riotpiao.com/rock/deploy.git
    targetRevision: main
    path: api
  destination:
@@ -8,7 +8,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://forgejo.forge.riotpiao.homelab.com/rock/deploy.git
+    repoURL: https://forgejo.forge.riotpiao.com/rock/deploy.git
    targetRevision: main
    path: argocd
  destination:
@@ -8,7 +8,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://forgejo.forge.riotpiao.homelab.com/rock/deploy.git
+    repoURL: https://forgejo.forge.riotpiao.com/rock/deploy.git
    targetRevision: main
    path: forge
  destination:
@@ -37,7 +37,7 @@ jobs:
      # ── 2. Build + push OCI image ───────────────────────────────────────────
      - name: build and push image
        env:
-          REGISTRY: forgejo.forge.riotpiao.homelab.com
+          REGISTRY: forgejo.forge.riotpiao.com
          OWNER: rock
        run: |
          REPO_NAME=${{ github.event.repository.name }}
@@ -60,7 +60,7 @@ jobs:
      # Argo CD notices the commit and rolls out the new image.
      - name: bump deploy repo
        env:
-          REGISTRY: forgejo.forge.riotpiao.homelab.com
+          REGISTRY: forgejo.forge.riotpiao.com
          OWNER: rock
        run: |
          git clone \
@@ -75,7 +75,7 @@ jobs:

          git -C /tmp/deploy \
            -c user.name="ci-bot" \
-            -c user.email="[email protected].homelab.com" \
+            -c user.email="[email protected]" \
            commit -am "${REPO_NAME}: deploy ${TAG}"

          git -C /tmp/deploy push
@@ -0,0 +1,39 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: forgejo-redis
+  namespace: cicd
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: forgejo-redis
+  template:
+    metadata:
+      labels:
+        app: forgejo-redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          ports:
+            - containerPort: 6379
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 100m
+              memory: 128Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: forgejo-redis
+  namespace: cicd
+spec:
+  selector:
+    app: forgejo-redis
+  ports:
+    - port: 6379
+      targetPort: 6379
@@ -1,7 +1,10 @@
-# k8s/talos-ci-cd/forgejo-values.yaml
-# Forgejo deployed via the gitea-charts/gitea Helm chart with image override.
-# Admin password injected via helmfile --set (FORGEJO_ADMIN_PASSWORD in .env).
-# Runner is managed by a separate helmfile release (charts/forgejo-runner/).
+# k8s/security/ci-cd/forgejo-values.yaml
+# Forgejo deployed via the gitea-charts/gitea Helm chart with image override,
+# as an ArgoCD Application with an inline Helm source (k8s/argocd/apps/forgejo.yaml).
+# Admin password set via --set at install time (FORGEJO_ADMIN_PASSWORD in .env).
+# DB: CNPG (k8s/data/ddb-cluster.yaml + forgejo-database.yaml), not SQLite.
+# Cache/session/queue: dedicated Redis (forgejo-redis.yaml), not in-memory —
+# required once replicaCount > 1, since in-memory state isn't shared across pods.
 #
 # Chart docs: https://gitea.com/gitea/helm-chart

@@ -21,16 +24,18 @@ gitea:
  config:
    server:
      PROTOCOL: http        # nginx ingress handles TLS; pod serves plain HTTP
-      DOMAIN: forgejo.riotpiao.homelab.com
-      ROOT_URL: https://forgejo.riotpiao.homelab.com/
+      DOMAIN: forgejo.riotpiao.com
+      ROOT_URL: https://forgejo.riotpiao.com/
      HTTP_PORT: 3000
      START_SSH_SERVER: true
-      SSH_DOMAIN: forgejo.riotpiao.homelab.com
+      SSH_DOMAIN: forgejo.riotpiao.com
      SSH_PORT: 2222
      SSH_LISTEN_PORT: 2222
    database:
-      DB_TYPE: sqlite3
-      PATH: /data/forgejo.db
+      DB_TYPE: postgres
+      HOST: ddb-cluster-rw.ddb.svc:5432
+      NAME: forgejo
+      USER: app
    repository:
      ROOT: /data/git
    actions:
@@ -44,37 +49,49 @@ gitea:
    oauth2:
      ENABLED: true
      PROVIDER: openidconnect
-      OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.homelab.com/application/o/forgejo/.well-known/openid-configuration
+      OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
      CLIENT_ID: forgejo
-      AUTO_DISCOVER_URL: https://authentik.riotpiao.homelab.com/application/o/forgejo/.well-known/openid-configuration
+      AUTO_DISCOVER_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
    cache:
-      ADAPTER: memory    # no Redis — single-replica SQLite setup
+      ADAPTER: redis
+      HOST: redis://forgejo-redis.cicd.svc:6379/0
    session:
-      PROVIDER: memory
+      PROVIDER: redis
+      PROVIDER_CONFIG: redis://forgejo-redis.cicd.svc:6379/1
    queue:
-      TYPE: channel      # in-memory queue; no file lock, no LevelDB contention on rollout
+      TYPE: redis
+      CONN_STR: redis://forgejo-redis.cicd.svc:6379/2

  metrics:
    enabled: true
    serviceMonitor:
      enabled: true      # kube-prometheus-stack discovers ServiceMonitors cluster-wide

-# ── Persistence (Longhorn RWO — SQLite lives here) ────────────────────────────
+# ── Persistence (Longhorn RWX — git repo data shared across replicas) ────────
 persistence:
  enabled: true
  storageClass: longhorn
  size: 20Gi
  accessModes:
-    - ReadWriteOnce
+    - ReadWriteMany
+
+# ── Replicas ──────────────────────────────────────────────────────────────────
+# Postgres (CNPG) + Redis (session/cache/queue) + RWX storage means replicas
+# no longer need to serialize on a single pod like the old SQLite setup did.
+replicaCount: 2

 # ── Deployment strategy ────────────────────────────────────────────────────────
-# RWO PVC + SQLite: old pod must terminate before new one mounts the volume.
 deployment:
  strategy:
-    type: Recreate
+    type: RollingUpdate
  env:
    - name: SSL_CERT_DIR
      value: /homelab-ca
+    - name: GITEA__database__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: ddb-cluster-app
+          key: password

 # ── Cert / CA auto-reload ─────────────────────────────────────────────────────
 # nginx serves the wildcard-tls cert — Forgejo itself never reads a TLS secret.
@@ -1,5 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: ci-cd
-resources: []
-# Helm charts (forgejo-runner) deployed via ArgoCD Helm source
+resources:
+  - forgejo-redis.yaml
+# Helm charts (forgejo, forgejo-runner) deployed via standalone ArgoCD
+# Applications with Helm sources (k8s/argocd/apps/forgejo.yaml) — not through
+# this kustomization, since layer-4-security syncs from Forgejo's own repo
+# (chicken-egg: Forgejo can't be the source of truth for deploying itself).
@@ -1,7 +1,7 @@
 # 0. Source your env (Authentik bootstrap token + Vault addr)
 set -a && source ~/.authentik/.env && set +a
-VAULT_ADDR="http://vault.riotpiao.homelab.com"
-AUTHENTIK_URL="http://authentik.riotpiao.homelab.com"
+VAULT_ADDR="http://vault.riotpiao.com"
+AUTHENTIK_URL="http://authentik.riotpiao.com"

 # 1. Fetch the real client_id + client_secret from Authentik
 PROVIDER_PK=$(curl -s \