147 lines
4.5 KiB
YAML
147 lines
4.5 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: forgejo
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "7"
|
|
# Must sync after cnpg-operator (wave 0) and the ddb-cluster/forgejo-database
|
|
# (wave 6, k8s/data) — Forgejo's DB connection depends on both existing first.
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://dl.gitea.com/charts/
|
|
chart: gitea
|
|
targetRevision: "~10"
|
|
helm:
|
|
# Mirrors k8s/security/ci-cd/forgejo-values.yaml inline — avoids the
|
|
# git-repo chicken-egg (Forgejo can't source its own values from a repo
|
|
# it hosts). Keep both files in sync when editing either one.
|
|
valuesObject:
|
|
image:
|
|
repository: codeberg.org/forgejo/forgejo
|
|
tag: "13"
|
|
pullPolicy: IfNotPresent
|
|
gitea:
|
|
admin:
|
|
username: rock
|
|
email: [email protected]
|
|
config:
|
|
server:
|
|
PROTOCOL: http
|
|
DOMAIN: forgejo.riotpiao.com
|
|
ROOT_URL: https://forgejo.riotpiao.com/
|
|
HTTP_PORT: 3000
|
|
START_SSH_SERVER: true
|
|
SSH_DOMAIN: forgejo.riotpiao.com
|
|
SSH_PORT: 2222
|
|
SSH_LISTEN_PORT: 2222
|
|
database:
|
|
DB_TYPE: postgres
|
|
HOST: ddb-cluster-rw.ddb.svc:5432
|
|
NAME: forgejo
|
|
USER: app
|
|
repository:
|
|
ROOT: /data/git
|
|
actions:
|
|
ENABLED: true
|
|
packages:
|
|
ENABLED: true
|
|
metrics:
|
|
ENABLED: true
|
|
service:
|
|
DISABLE_REGISTRATION: true
|
|
oauth2:
|
|
ENABLED: true
|
|
PROVIDER: openidconnect
|
|
OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
|
|
CLIENT_ID: forgejo
|
|
AUTO_DISCOVER_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
|
|
cache:
|
|
ADAPTER: redis
|
|
HOST: "redis://forgejo-redis.cicd.svc:6379/0"
|
|
session:
|
|
PROVIDER: redis
|
|
PROVIDER_CONFIG: "redis://forgejo-redis.cicd.svc:6379/1"
|
|
queue:
|
|
TYPE: redis
|
|
CONN_STR: "redis://forgejo-redis.cicd.svc:6379/2"
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: false
|
|
persistence:
|
|
enabled: true
|
|
storageClass: longhorn
|
|
size: 20Gi
|
|
accessModes:
|
|
- ReadWriteMany
|
|
replicaCount: 2
|
|
deployment:
|
|
strategy:
|
|
type: RollingUpdate
|
|
env:
|
|
- name: SSL_CERT_DIR
|
|
value: /homelab-ca
|
|
- name: GITEA__database__PASSWD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ddb-cluster-app
|
|
key: password
|
|
podAnnotations:
|
|
configmap.reloader.stakater.com/reload: "homelab-ca"
|
|
service:
|
|
http:
|
|
type: LoadBalancer
|
|
port: 3000
|
|
targetPort: 3000
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "192.168.1.165"
|
|
io.cilium/lb-ipam-sharing-key: "forgejo"
|
|
ssh:
|
|
type: LoadBalancer
|
|
port: 2222
|
|
targetPort: 2222
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "192.168.1.165"
|
|
io.cilium/lb-ipam-sharing-key: "forgejo"
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
extraVolumes:
|
|
- name: homelab-ca
|
|
configMap:
|
|
name: homelab-ca
|
|
extraVolumeMounts:
|
|
- name: homelab-ca
|
|
mountPath: /homelab-ca
|
|
readOnly: true
|
|
ingress:
|
|
enabled: false
|
|
postgresql:
|
|
enabled: false
|
|
postgresql-ha:
|
|
enabled: false
|
|
mysql:
|
|
enabled: false
|
|
redis-cluster:
|
|
enabled: false
|
|
act_runner:
|
|
enabled: false
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cicd
|
|
syncPolicy:
|
|
syncOptions:
|
|
- CreateNamespace=true
|
|
# NO automated sync — Forgejo is what CI uses to push commits; auto-sync
|
|
# would let a bad CI commit break the system CI depends on. Manual only.
|