Story Crater Bot
a3f261f548
- Forgejo git forge + OCI registry - Argo CD pull-based GitOps - Private CA TLS (self-signed 10-year cert) - Machine credentials scoped to repositories
152 lines
5.7 KiB
YAML
152 lines
5.7 KiB
YAML
# k8s/talos-ci-cd/forgejo-values.yaml
|
|
# Forgejo deployed via the gitea-charts/gitea Helm chart with image override.
|
|
# Admin password injected via helmfile --set (FORGEJO_ADMIN_PASSWORD in .env).
|
|
# Runner is managed by a separate helmfile release (charts/forgejo-runner/).
|
|
#
|
|
# Chart docs: https://gitea.com/gitea/helm-chart
|
|
|
|
# ── Image (Forgejo replaces Gitea — drop-in compatible) ──────────────────────
|
|
image:
|
|
repository: codeberg.org/forgejo/forgejo
|
|
tag: "13" # pin exact release — check codeberg.org/forgejo/forgejo/releases
|
|
pullPolicy: IfNotPresent
|
|
|
|
# ── Bootstrap admin (provisioned by a post-install Job inside the chart) ──────
|
|
gitea:
|
|
admin:
|
|
username: rock
|
|
email: [email protected]
|
|
# password: injected via helmfile --set (FORGEJO_ADMIN_PASSWORD from .env)
|
|
|
|
config:
|
|
server:
|
|
PROTOCOL: http # nginx ingress handles TLS; pod serves plain HTTP
|
|
DOMAIN: forgejo.riotpiao.homelab.com
|
|
ROOT_URL: https://forgejo.riotpiao.homelab.com/
|
|
HTTP_PORT: 3000
|
|
START_SSH_SERVER: true
|
|
SSH_DOMAIN: forgejo.riotpiao.homelab.com
|
|
SSH_PORT: 2222
|
|
SSH_LISTEN_PORT: 2222
|
|
database:
|
|
DB_TYPE: sqlite3
|
|
PATH: /data/forgejo.db
|
|
repository:
|
|
ROOT: /data/git
|
|
actions:
|
|
ENABLED: true
|
|
packages:
|
|
ENABLED: true # built-in OCI registry
|
|
metrics:
|
|
ENABLED: true # Prometheus at /metrics
|
|
service:
|
|
DISABLE_REGISTRATION: true # no self-signup; Authentik OAuth2 auto-creates accounts
|
|
oauth2:
|
|
ENABLED: true
|
|
PROVIDER: openidconnect
|
|
OPENID_CONNECT_DISCOVERY_URL: https://authentik.riotpiao.homelab.com/application/o/forgejo/.well-known/openid-configuration
|
|
CLIENT_ID: forgejo
|
|
AUTO_DISCOVER_URL: https://authentik.riotpiao.homelab.com/application/o/forgejo/.well-known/openid-configuration
|
|
cache:
|
|
ADAPTER: memory # no Redis — single-replica SQLite setup
|
|
session:
|
|
PROVIDER: memory
|
|
queue:
|
|
TYPE: channel # in-memory queue; no file lock, no LevelDB contention on rollout
|
|
|
|
metrics:
|
|
enabled: true
|
|
serviceMonitor:
|
|
enabled: true # kube-prometheus-stack discovers ServiceMonitors cluster-wide
|
|
|
|
# ── Persistence (Longhorn RWO — SQLite lives here) ────────────────────────────
|
|
persistence:
|
|
enabled: true
|
|
storageClass: longhorn
|
|
size: 20Gi
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
|
|
# ── Deployment strategy ────────────────────────────────────────────────────────
|
|
# RWO PVC + SQLite: old pod must terminate before new one mounts the volume.
|
|
deployment:
|
|
strategy:
|
|
type: Recreate
|
|
env:
|
|
- name: SSL_CERT_DIR
|
|
value: /homelab-ca
|
|
|
|
# ── Cert / CA auto-reload ─────────────────────────────────────────────────────
|
|
# nginx serves the wildcard-tls cert — Forgejo itself never reads a TLS secret.
|
|
# The only reload trigger is homelab-ca: if the root CA rotates, the mounted
|
|
# ConfigMap changes and Forgejo must restart to pick up the new CA bundle for OIDC.
|
|
podAnnotations:
|
|
configmap.reloader.stakater.com/reload: "homelab-ca"
|
|
|
|
# ── Services (Cilium LB-IPAM pins both to 192.168.1.165) ─────────────────────
|
|
service:
|
|
http:
|
|
type: LoadBalancer
|
|
port: 3000
|
|
targetPort: 3000
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "192.168.1.165"
|
|
io.cilium/lb-ipam-sharing-key: "forgejo"
|
|
ssh:
|
|
type: LoadBalancer
|
|
port: 2222
|
|
targetPort: 2222
|
|
annotations:
|
|
io.cilium/lb-ipam-ips: "192.168.1.165"
|
|
io.cilium/lb-ipam-sharing-key: "forgejo"
|
|
|
|
# ── Resources ─────────────────────────────────────────────────────────────────
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 512Mi
|
|
limits:
|
|
cpu: "1"
|
|
memory: 1Gi
|
|
|
|
# ── Node resilience ───────────────────────────────────────────────────────────
|
|
tolerations:
|
|
- key: node-role.kubernetes.io/control-plane
|
|
operator: Exists
|
|
effect: NoSchedule
|
|
|
|
# ── CA trust ─────────────────────────────────────────────────────────────────
|
|
# Go reads SSL_CERT_DIR as an additional cert directory ON TOP OF the default
|
|
# cert files (ca-certificates.crt stays intact — no init container needed).
|
|
# Setting SSL_CERT_DIR=/homelab-ca makes Go also read homelab-ca.crt from there,
|
|
# trusting both the standard Mozilla bundle and our homelab CA.
|
|
# Required for OIDC: Forgejo fetches Authentik's discovery endpoint which
|
|
# presents a cert signed by homelab-ca.
|
|
extraVolumes:
|
|
- name: homelab-ca
|
|
configMap:
|
|
name: homelab-ca
|
|
|
|
extraVolumeMounts:
|
|
- name: homelab-ca
|
|
mountPath: /homelab-ca
|
|
readOnly: true
|
|
|
|
# ── Ingress: disabled — rule lives in k8s/ingress/ingress.yaml ───────────────
|
|
ingress:
|
|
enabled: false
|
|
|
|
# ── Bundled databases + cache: all disabled — SQLite + memory is the chosen backend ──
|
|
postgresql:
|
|
enabled: false
|
|
postgresql-ha:
|
|
enabled: false
|
|
mysql:
|
|
enabled: false
|
|
redis-cluster:
|
|
enabled: false # 6-node cluster is overkill for single-replica SQLite Forgejo
|
|
|
|
# ── Act runner subchart: disabled — managed by the forgejo-runner helmfile release
|
|
act_runner:
|
|
enabled: false
|