Story Crater Bot
86f5603063
Adds missing CLIENT_SECRET env injection + nodeSelector constraint:
- k8s/argocd/bootstrap/forgejo.yaml: inject GITEA__oauth2__CLIENT_SECRET
from forgejo-oidc Secret (created by authentik-provision Job), and pin
pods to talos-cp-1 via nodeSelector (only node with Longhorn storage —
gitea-shared-storage PVC can't attach on cp-2/cp-3)
Root cause chain for 'Forgejo SSO not working':
1. Authentik 2026.5.5 requires explicit grant_types on OAuth2 providers
2. Old provision script never set it → all providers had grant_types=[]
3. /authorize returned 'Invalid grant_type for provider' → all SSO broken
4. Fixed in k8s/security/iam/scripts/authentik-provision.py (commit be2a56c)
+ successfully re-ran via iam-jobs Application sync
5. But Forgejo deployment still missing CLIENT_SECRET env var → no creds
6. Forgejo bootstrap App used inline valuesObject (chicken-egg with git
repo self-hosting), but missing the extraEnv block that was only in
k8s/security/ci-cd/forgejo-values.yaml → CLIENT_SECRET never injected
All 4 OAuth2 providers now have correct grant_types=['authorization_code',
'refresh_token'], Forgejo pods now have CLIENT_SECRET env, and pods are
constrained to the storage node. SSO login flow should now work end-to-end.
158 lines
5.0 KiB
YAML
158 lines
5.0 KiB
YAML
apiVersion: argoproj.io/v1alpha1
|
|
kind: Application
|
|
metadata:
|
|
name: forgejo
|
|
namespace: argocd
|
|
annotations:
|
|
argocd.argoproj.io/sync-wave: "7"
|
|
# Must sync after cnpg-operator (wave 0) and the ddb-cluster/forgejo-database
|
|
# (wave 6, k8s/data) — Forgejo's DB connection depends on both existing first.
|
|
spec:
|
|
project: homelab
|
|
source:
|
|
repoURL: https://dl.gitea.com/charts/
|
|
chart: gitea
|
|
targetRevision: "~10"
|
|
helm:
|
|
# Mirrors k8s/security/ci-cd/forgejo-values.yaml inline — avoids the
|
|
# git-repo chicken-egg (Forgejo can't source its own values from a repo
|
|
# it hosts). Keep both files in sync when editing either one.
|
|
valuesObject:
|
|
image:
|
|
repository: codeberg.org/forgejo/forgejo
|
|
tag: "13"
|
|
pullPolicy: IfNotPresent
|
|
gitea:
|
|
admin:
|
|
username: rock
|
|
email: [email protected]
|
|
config:
|
|
server:
|
|
PROTOCOL: http
|
|
DOMAIN: forgejo.riotpiao.com
|
|
ROOT_URL: https://forgejo.riotpiao.com/
|
|
HTTP_PORT: 3000
|
|
START_SSH_SERVER: true
|
|
SSH_DOMAIN: forgejo.riotpiao.com
|
|
SSH_PORT: 2222
|
|
SSH_LISTEN_PORT: 2222
|
|
database:
|
|
DB_TYPE: postgres
|
|
HOST: ddb-cluster-rw.ddb.svc:5432
|
|
NAME: forgejo
|
|
USER: app
|
|
repository:
|
|
ROOT: /data/git
|
|
actions:
|
|
ENABLED: true
|
|
packages:
|
|
ENABLED: true
|
|
metrics:
|
|
ENABLED: true
|
|
service:
|
|
DISABLE_REGISTRATION: true
|
|
oauth2:
|
|
ENABLED: true
|
|
PROVIDER: openidconnect
|
|
OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
|
|
CLIENT_ID: forgejo
|
|
AUTO_DISCOVER_URL: https://authentik.riotpiao.com/application/o/forgejo/.well-known/openid-configuration
|
|
cache:
|
|
ADAPTER: redis
|
|
HOST: "redis://forgejo-redis.cicd.svc:6379/0"
|
|
session:
|
|
PROVIDER: redis
|
|
PROVIDER_CONFIG: "redis://forgejo-redis.cicd.svc:6379/1"
|
|
queue:
|
|
TYPE: redis
|
|
CONN_STR: "redis://forgejo-redis.cicd.svc:6379/2"
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: false
|
|
persistence:
|
|
enabled: true
|
|
storageClass: longhorn
|
|
size: 20Gi
|
|
accessModes:
|
|
- ReadWriteMany
|
|
replicaCount: 2
|
|
deployment:
|
|
strategy:
|
|
type: RollingUpdate
|
|
env:
|
|
- name: SSL_CERT_DIR
|
|
value: /homelab-ca
|
|
- name: GITEA__database__PASSWD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: ddb-cluster-app
|
|
key: password
|
|
- name: GITEA__oauth2__CLIENT_SECRET
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: forgejo-oidc
|
|
key: CLIENT_SECRET
|
|
podAnnotations:
|
|
configmap.reloader.stakater.com/reload: "homelab-ca"
|
|
service:
|
|
http:
|
|
type: LoadBalancer
|
|
port: 3000
|
|
targetPort: 3000
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "192.168.1.165"
|
|
io.cilium/lb-ipam-sharing-key: "forgejo"
|
|
ssh:
|
|
type: LoadBalancer
|
|
port: 2222
|
|
targetPort: 2222
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "192.168.1.165"
|
|
io.cilium/lb-ipam-sharing-key: "forgejo"
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
nodeSelector:
|
|
kubernetes.io/hostname: talos-cp-1
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
extraVolumes:
|
|
- name: homelab-ca
|
|
configMap:
|
|
name: homelab-ca
|
|
extraVolumeMounts:
|
|
- name: homelab-ca
|
|
mountPath: /homelab-ca
|
|
readOnly: true
|
|
ingress:
|
|
enabled: false
|
|
postgresql:
|
|
enabled: false
|
|
postgresql-ha:
|
|
enabled: false
|
|
mysql:
|
|
enabled: false
|
|
redis-cluster:
|
|
enabled: false
|
|
act_runner:
|
|
enabled: false
|
|
destination:
|
|
server: https://kubernetes.default.svc
|
|
namespace: cicd
|
|
syncPolicy:
|
|
# NO CreateNamespace — cicd must be pre-created and labelled
|
|
# pod-security.kubernetes.io/enforce=privileged (DinD/runner needs it);
|
|
# ArgoCD's CreateNamespace would make it with the cluster-default baseline.
|
|
# The Phase 0 runbook creates+labels cicd before this app is applied.
|
|
#
|
|
# NO automated sync — Forgejo is what CI uses to push commits; auto-sync
|
|
# would let a bad CI commit break the system CI depends on. Manual only.
|
|
syncOptions: []
|