From df5e6233474df30cdbadd9575356ab03aeace883 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 19 Aug 2026 22:37:56 -0700
Subject: [PATCH] feat: manage Forgejo with Argo instead of the bootstrap Helm
 release
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Values changes were inert as a bootstrap release, so the proxy-body-size fix
never reached the live Ingress. First sync is manual — the chart owns the
Forgejo PVC.
---
 k8s/argocd/apps/30-security.yaml | 44 +++++++++++++++++++++++++++++++-
 1 file changed, 43 insertions(+), 1 deletion(-)

diff --git a/k8s/argocd/apps/30-security.yaml b/k8s/argocd/apps/30-security.yaml
index 1e78989..c57fc99 100644
--- a/k8s/argocd/apps/30-security.yaml
+++ b/k8s/argocd/apps/30-security.yaml
@@ -79,7 +79,49 @@ spec:
       prune: true
       selfHeal: true
 ---
-# Forgejo runner (local chart). Forgejo itself is Phase 0 (bootstrap).
+# Forgejo itself. Was a bootstrap Helm release (phase 3) until it was brought
+# under Argo, because values changes there were inert — a proxy-body-size fix
+# sat committed while the live Ingress kept nginx's 1m default and rejected
+# every OCI push with 413.
+#
+# Wave 3: after databases (wave 2) — Forgejo needs CNPG and Redis up first.
+#
+# Retiring the Helm release: Argo adopts the existing objects on first sync.
+# Delete the release secrets afterwards so helm stops claiming ownership:
+#   kubectl -n cicd delete secret -l owner=helm,name=forgejo
+#
+# automated sync is deliberately absent. This chart owns the Forgejo PVC and
+# the git forge itself; the first sync is manual so its diff can be read before
+# anything is applied. Turn on automated+selfHeal once that diff is clean.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: forgejo
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "3"
+spec:
+  project: homelab
+  sources:
+    - repoURL: https://dl.gitea.com/charts/
+      chart: gitea
+      targetRevision: 12.7.0
+      helm:
+        valueFiles:
+          - $values/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
+    - repoURL: https://github.com/Riotpiaole/riotpiao.homelab.com.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: cicd
+  syncPolicy:
+    syncOptions:
+      # Adopt the objects the bootstrap Helm release already created rather
+      # than failing on "already exists".
+      - ServerSideApply=true
+---
+# Forgejo runner (local chart).
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata: