apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: forgejo
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-wave: "7"
    # Must sync after cnpg-operator (wave 0) and the ddb-cluster/forgejo-database
    # (wave 6, k8s/data) — Forgejo's DB connection depends on both existing first.
spec:
  project: homelab
  source:
    repoURL: https://dl.gitea.com/charts/
    chart: gitea
    targetRevision: "~10"
    helm:
      # Mirrors k8s/security/ci-cd/forgejo-values.yaml inline — avoids the
      # git-repo chicken-egg (Forgejo can't source its own values from a repo
      # it hosts). Keep both files in sync when editing either one.
      valuesObject:
        image:
          repository: codeberg.org/forgejo/forgejo
          tag: "13"
          pullPolicy: IfNotPresent
        gitea:
          admin:
            username: rock
            email: locartrock@gmail.com
          config:
            server:
              PROTOCOL: http
              DOMAIN: forgejo.riotpiao.com
              ROOT_URL: https://forgejo.riotpiao.com/
              HTTP_PORT: 3000
              START_SSH_SERVER: true
              SSH_DOMAIN: forgejo.riotpiao.com
              SSH_PORT: 2222
              SSH_LISTEN_PORT: 2222
            database:
              DB_TYPE: postgres
              HOST: ddb-cluster-rw.ddb.svc:5432
              NAME: forgejo
              USER: app
            repository:
              ROOT: /data/git
            actions:
              ENABLED: true
            packages:
              ENABLED: true
            metrics:
              ENABLED: true
            service:
              DISABLE_REGISTRATION: true
            oauth2:
              ENABLED: true
              PROVIDER: openidconnect
              OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
              CLIENT_ID: forgejo
              AUTO_DISCOVER_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
            cache:
              ADAPTER: redis
              HOST: "redis://forgejo-redis.cicd.svc:6379/0"
            session:
              PROVIDER: redis
              PROVIDER_CONFIG: "redis://forgejo-redis.cicd.svc:6379/1"
            queue:
              TYPE: redis
              CONN_STR: "redis://forgejo-redis.cicd.svc:6379/2"
          metrics:
            enabled: true
            serviceMonitor:
              enabled: false
        persistence:
          enabled: true
          storageClass: longhorn
          size: 20Gi
          accessModes:
            - ReadWriteMany
        replicaCount: 2
        deployment:
          strategy:
            type: RollingUpdate
          env:
            - name: SSL_CERT_DIR
              value: /homelab-ca
            - name: GITEA__database__PASSWD
              valueFrom:
                secretKeyRef:
                  name: ddb-cluster-app
                  key: password
            - name: GITEA__oauth2__CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: forgejo-oidc
                  key: CLIENT_SECRET
        podAnnotations:
          configmap.reloader.stakater.com/reload: "homelab-ca"
        service:
          http:
            type: LoadBalancer
            port: 3000
            targetPort: 3000
            annotations:
              io.cilium/lb-ipam-ips: "192.168.1.165"
              io.cilium/lb-ipam-sharing-key: "forgejo"
          ssh:
            type: LoadBalancer
            port: 2222
            targetPort: 2222
            annotations:
              io.cilium/lb-ipam-ips: "192.168.1.165"
              io.cilium/lb-ipam-sharing-key: "forgejo"
        resources:
          requests:
            cpu: 250m
            memory: 512Mi
          limits:
            cpu: "1"
            memory: 1Gi
        nodeSelector:
          kubernetes.io/hostname: talos-cp-1
        tolerations:
          - key: node-role.kubernetes.io/control-plane
            operator: Exists
            effect: NoSchedule
        extraVolumes:
          - name: homelab-ca
            configMap:
              name: homelab-ca
        extraVolumeMounts:
          - name: homelab-ca
            mountPath: /homelab-ca
            readOnly: true
        ingress:
          enabled: false
        postgresql:
          enabled: false
        postgresql-ha:
          enabled: false
        mysql:
          enabled: false
        redis-cluster:
          enabled: false
        act_runner:
          enabled: false
  destination:
    server: https://kubernetes.default.svc
    namespace: cicd
  syncPolicy:
    # NO CreateNamespace — cicd must be pre-created and labelled
    # pod-security.kubernetes.io/enforce=privileged (DinD/runner needs it);
    # ArgoCD's CreateNamespace would make it with the cluster-default baseline.
    # The Phase 0 runbook creates+labels cicd before this app is applied.
    #
    # NO automated sync — Forgejo is what CI uses to push commits; auto-sync
    # would let a bad CI commit break the system CI depends on. Manual only.
    syncOptions: []