feat(gitops): migrate domain to riotpiao.com, add CNPG + Forgejo HA on Redis/Postgres, wire ArgoCD apps — enables cluster rebuild after etcd wipe and unblocks the git-source chicken-egg via standalone Helm-source Applications

k8s/security/ci-cd/forgejo-values.yaml

@@ -1,7 +1,10 @@
-# k8s/talos-ci-cd/forgejo-values.yaml
-# Forgejo deployed via the gitea-charts/gitea Helm chart with image override.
-# Admin password injected via helmfile --set (FORGEJO_ADMIN_PASSWORD in .env).
-# Runner is managed by a separate helmfile release (charts/forgejo-runner/).
+# k8s/security/ci-cd/forgejo-values.yaml
+# Forgejo deployed via the gitea-charts/gitea Helm chart with image override,
+# as an ArgoCD Application with an inline Helm source (k8s/argocd/apps/forgejo.yaml).
+# Admin password set via --set at install time (FORGEJO_ADMIN_PASSWORD in .env).
+# DB: CNPG (k8s/data/ddb-cluster.yaml + forgejo-database.yaml), not SQLite.
+# Cache/session/queue: dedicated Redis (forgejo-redis.yaml), not in-memory —
+# required once replicaCount > 1, since in-memory state isn't shared across pods.
 #
 # Chart docs: https://gitea.com/gitea/helm-chart
 
@@ -21,16 +24,18 @@ gitea:
   config:
     server:
       PROTOCOL: http        # nginx ingress handles TLS; pod serves plain HTTP
-      DOMAIN: forgejo.riotpiao.homelab.com
-      ROOT_URL: https://forgejo.riotpiao.homelab.com/
+      DOMAIN: forgejo.riotpiao.com
+      ROOT_URL: https://forgejo.riotpiao.com/
       HTTP_PORT: 3000
       START_SSH_SERVER: true
-      SSH_DOMAIN: forgejo.riotpiao.homelab.com
+      SSH_DOMAIN: forgejo.riotpiao.com
       SSH_PORT: 2222
       SSH_LISTEN_PORT: 2222
     database:
-      DB_TYPE: sqlite3
-      PATH: /data/forgejo.db
+      DB_TYPE: postgres
+      HOST: ddb-cluster-rw.ddb.svc:5432
+      NAME: forgejo
+      USER: app
     repository:
       ROOT: /data/git
     actions:
@@ -44,37 +49,49 @@ gitea:
     oauth2:
       ENABLED: true
       PROVIDER: openidconnect
-      OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.homelab.com/application/o/forgejo/.well-known/openid-configuration
+      OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
       CLIENT_ID: forgejo
-      AUTO_DISCOVER_URL: https://authentik.riotpiao.homelab.com/application/o/forgejo/.well-known/openid-configuration
+      AUTO_DISCOVER_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
     cache:
-      ADAPTER: memory    # no Redis — single-replica SQLite setup
+      ADAPTER: redis
+      HOST: redis://forgejo-redis.cicd.svc:6379/0
     session:
-      PROVIDER: memory
+      PROVIDER: redis
+      PROVIDER_CONFIG: redis://forgejo-redis.cicd.svc:6379/1
     queue:
-      TYPE: channel      # in-memory queue; no file lock, no LevelDB contention on rollout
+      TYPE: redis
+      CONN_STR: redis://forgejo-redis.cicd.svc:6379/2
 
   metrics:
     enabled: true
     serviceMonitor:
       enabled: true      # kube-prometheus-stack discovers ServiceMonitors cluster-wide
 
-# ── Persistence (Longhorn RWO — SQLite lives here) ────────────────────────────
+# ── Persistence (Longhorn RWX — git repo data shared across replicas) ────────
 persistence:
   enabled: true
   storageClass: longhorn
   size: 20Gi
   accessModes:
-    - ReadWriteOnce
+    - ReadWriteMany
+
+# ── Replicas ──────────────────────────────────────────────────────────────────
+# Postgres (CNPG) + Redis (session/cache/queue) + RWX storage means replicas
+# no longer need to serialize on a single pod like the old SQLite setup did.
+replicaCount: 2
 
 # ── Deployment strategy ────────────────────────────────────────────────────────
-# RWO PVC + SQLite: old pod must terminate before new one mounts the volume.
 deployment:
   strategy:
-    type: Recreate
+    type: RollingUpdate
   env:
     - name: SSL_CERT_DIR
       value: /homelab-ca
+    - name: GITEA__database__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: ddb-cluster-app
+          key: password
 
 # ── Cert / CA auto-reload ─────────────────────────────────────────────────────
 # nginx serves the wildcard-tls cert — Forgejo itself never reads a TLS secret.