migrate
This commit is contained in:
21
clusters/cl01tl/helm/gitea/Chart.lock
Normal file
21
clusters/cl01tl/helm/gitea/Chart.lock
Normal file
@@ -0,0 +1,21 @@
|
||||
dependencies:
|
||||
- name: gitea
|
||||
repository: https://dl.gitea.io/charts/
|
||||
version: 12.4.0
|
||||
- name: gitea-actions
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.2.1
|
||||
- name: app-template
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: meilisearch
|
||||
repository: https://meilisearch.github.io/meilisearch-kubernetes
|
||||
version: 0.17.1
|
||||
- name: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.0
|
||||
- name: postgres-cluster
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 6.16.0
|
||||
digest: sha256:6e72cd4abc36e238a5129d0ee471bc296435f8ff1c8be7f3132fc33193a39f23
|
||||
generated: "2025-12-01T20:25:50.496342-06:00"
|
||||
50
clusters/cl01tl/helm/gitea/Chart.yaml
Normal file
50
clusters/cl01tl/helm/gitea/Chart.yaml
Normal file
@@ -0,0 +1,50 @@
|
||||
apiVersion: v2
|
||||
name: gitea
|
||||
version: 1.0.0
|
||||
description: Gitea
|
||||
keywords:
|
||||
- gitea
|
||||
- git
|
||||
- code
|
||||
home: https://wiki.alexlebens.dev/s/94060f71-fd05-4f78-9af2-053f8f221acd
|
||||
sources:
|
||||
- https://github.com/go-gitea/gitea
|
||||
- https://github.com/renovatebot/renovate
|
||||
- https://github.com/Angatar/s3cmd
|
||||
- https://github.com/meilisearch/meilisearch
|
||||
- https://github.com/cloudflare/cloudflared
|
||||
- https://github.com/cloudnative-pg/cloudnative-pg
|
||||
- https://hub.docker.com/r/gitea/gitea
|
||||
- https://hub.docker.com/r/renovate/renovate
|
||||
- https://hub.docker.com/r/d3fk/s3cmd/
|
||||
- https://gitea.com/gitea/helm-chart
|
||||
- https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
|
||||
- https://github.com/meilisearch/meilisearch-kubernetes/tree/main/charts/meilisearch
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
|
||||
- https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
|
||||
maintainers:
|
||||
- name: alexlebens
|
||||
dependencies:
|
||||
- name: gitea
|
||||
version: 12.4.0
|
||||
repository: https://dl.gitea.io/charts/
|
||||
- name: gitea-actions
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 0.2.1
|
||||
- name: app-template
|
||||
alias: backup
|
||||
repository: https://bjw-s-labs.github.io/helm-charts/
|
||||
version: 4.4.0
|
||||
- name: meilisearch
|
||||
version: 0.17.1
|
||||
repository: https://meilisearch.github.io/meilisearch-kubernetes
|
||||
- name: cloudflared
|
||||
alias: cloudflared
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
version: 1.23.0
|
||||
- name: postgres-cluster
|
||||
alias: postgres-17-cluster
|
||||
version: 6.16.0
|
||||
repository: oci://harbor.alexlebens.net/helm-charts
|
||||
icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/gitea.png
|
||||
appVersion: 1.23.7
|
||||
318
clusters/cl01tl/helm/gitea/templates/external-secret.yaml
Normal file
318
clusters/cl01tl/helm/gitea/templates/external-secret.yaml
Normal file
@@ -0,0 +1,318 @@
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-admin-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-admin-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: username
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/gitea/auth/admin
|
||||
metadataPolicy: None
|
||||
property: username
|
||||
- secretKey: password
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/gitea/auth/admin
|
||||
metadataPolicy: None
|
||||
property: password
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-oidc-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-oidc-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: secret
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /authentik/oidc/gitea
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
- secretKey: key
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /authentik/oidc/gitea
|
||||
metadataPolicy: None
|
||||
property: client
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-runner-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-runner-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: token
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/gitea/runner
|
||||
metadataPolicy: None
|
||||
property: token
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-renovate-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-renovate-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: RENOVATE_ENDPOINT
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/gitea/renovate
|
||||
metadataPolicy: None
|
||||
property: RENOVATE_ENDPOINT
|
||||
- secretKey: RENOVATE_GIT_AUTHOR
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/gitea/renovate
|
||||
metadataPolicy: None
|
||||
property: RENOVATE_GIT_AUTHOR
|
||||
- secretKey: RENOVATE_TOKEN
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/gitea/renovate
|
||||
metadataPolicy: None
|
||||
property: RENOVATE_TOKEN
|
||||
- secretKey: RENOVATE_GIT_PRIVATE_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/gitea/renovate
|
||||
metadataPolicy: None
|
||||
property: id_rsa
|
||||
- secretKey: RENOVATE_GITHUB_COM_TOKEN
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /github/gitea-cl01tl
|
||||
metadataPolicy: None
|
||||
property: token
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-renovate-ssh-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-renovate-ssh-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: config
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/gitea/renovate
|
||||
metadataPolicy: None
|
||||
property: ssh_config
|
||||
- secretKey: id_rsa
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/gitea/renovate
|
||||
metadataPolicy: None
|
||||
property: id_rsa
|
||||
- secretKey: id_rsa.pub
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/gitea/renovate
|
||||
metadataPolicy: None
|
||||
property: id_rsa.pub
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-s3cmd-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-s3cmd-config
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: .s3cfg
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/gitea-backup
|
||||
metadataPolicy: None
|
||||
property: s3cfg
|
||||
- secretKey: BUCKET
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/gitea-backup
|
||||
metadataPolicy: None
|
||||
property: BUCKET
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-meilisearch-master-key-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-meilisearch-master-key-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
target:
|
||||
template:
|
||||
mergePolicy: Merge
|
||||
engineVersion: v2
|
||||
data:
|
||||
ISSUE_INDEXER_CONN_STR: "http://:{{ `{{ .MEILI_MASTER_KEY }}` }}@gitea-meilisearch.gitea:7700/"
|
||||
data:
|
||||
- secretKey: MEILI_MASTER_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cl01tl/gitea/meilisearch
|
||||
metadataPolicy: None
|
||||
property: MEILI_MASTER_KEY
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-cloudflared-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-cloudflared-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: cf-tunnel-token
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /cloudflare/tunnels/gitea
|
||||
metadataPolicy: None
|
||||
property: token
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-postgresql-17-cluster-backup-secret
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-postgresql-17-cluster-backup-secret
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: access
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /digital-ocean/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: secret
|
||||
|
||||
---
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ExternalSecret
|
||||
metadata:
|
||||
name: gitea-postgresql-17-cluster-backup-secret-garage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-postgresql-17-cluster-backup-secret-garage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
secretStoreRef:
|
||||
kind: ClusterSecretStore
|
||||
name: vault
|
||||
data:
|
||||
- secretKey: ACCESS_KEY_ID
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_KEY_ID
|
||||
- secretKey: ACCESS_SECRET_KEY
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_SECRET_KEY
|
||||
- secretKey: ACCESS_REGION
|
||||
remoteRef:
|
||||
conversionStrategy: Default
|
||||
decodingStrategy: None
|
||||
key: /garage/home-infra/postgres-backups
|
||||
metadataPolicy: None
|
||||
property: ACCESS_REGION
|
||||
28
clusters/cl01tl/helm/gitea/templates/http-route.yaml
Normal file
28
clusters/cl01tl/helm/gitea/templates/http-route.yaml
Normal file
@@ -0,0 +1,28 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: http-route-gitea
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: http-route-gitea
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
hostnames:
|
||||
- gitea.alexlebens.net
|
||||
rules:
|
||||
- matches:
|
||||
- path:
|
||||
type: PathPrefix
|
||||
value: /
|
||||
backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: gitea-http
|
||||
port: 3000
|
||||
weight: 100
|
||||
29
clusters/cl01tl/helm/gitea/templates/ingress.yaml
Normal file
29
clusters/cl01tl/helm/gitea/templates/ingress.yaml
Normal file
@@ -0,0 +1,29 @@
|
||||
apiVersion: networking.k8s.io/v1
|
||||
kind: Ingress
|
||||
metadata:
|
||||
name: gitea-tailscale
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-tailscale
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
tailscale.com/proxy-class: no-metrics
|
||||
annotations:
|
||||
tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
|
||||
spec:
|
||||
ingressClassName: tailscale
|
||||
tls:
|
||||
- hosts:
|
||||
- gitea-cl01tl
|
||||
secretName: gitea-cl01tl
|
||||
rules:
|
||||
- host: gitea-cl01tl
|
||||
http:
|
||||
paths:
|
||||
- path: /
|
||||
pathType: ImplementationSpecific
|
||||
backend:
|
||||
service:
|
||||
name: gitea-http
|
||||
port:
|
||||
name: http
|
||||
11
clusters/cl01tl/helm/gitea/templates/namespace.yaml
Normal file
11
clusters/cl01tl/helm/gitea/templates/namespace.yaml
Normal file
@@ -0,0 +1,11 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: gitea
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
pod-security.kubernetes.io/audit: privileged
|
||||
pod-security.kubernetes.io/enforce: privileged
|
||||
pod-security.kubernetes.io/warn: privileged
|
||||
@@ -0,0 +1,36 @@
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: gitea-nfs-storage-backup
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-nfs-storage-backup
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeMode: Filesystem
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: PersistentVolumeClaim
|
||||
metadata:
|
||||
name: gitea-themes-storage
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-themes-storage
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
volumeMode: Filesystem
|
||||
storageClassName: nfs-client
|
||||
accessModes:
|
||||
- ReadWriteOnce
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
66
clusters/cl01tl/helm/gitea/templates/redis-replication.yaml
Normal file
66
clusters/cl01tl/helm/gitea/templates/redis-replication.yaml
Normal file
@@ -0,0 +1,66 @@
|
||||
apiVersion: redis.redis.opstreelabs.in/v1beta2
|
||||
kind: RedisReplication
|
||||
metadata:
|
||||
name: redis-replication-gitea
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-gitea
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
clusterSize: 3
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
kubernetesConfig:
|
||||
image: quay.io/opstree/redis:v8.0.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
storage:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: ceph-block
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 10Gi
|
||||
redisExporter:
|
||||
enabled: true
|
||||
image: quay.io/opstree/redis-exporter:v1.48.0
|
||||
|
||||
---
|
||||
apiVersion: redis.redis.opstreelabs.in/v1beta2
|
||||
kind: RedisReplication
|
||||
metadata:
|
||||
name: redis-replication-renovate
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-renovate
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
clusterSize: 3
|
||||
podSecurityContext:
|
||||
runAsUser: 1000
|
||||
fsGroup: 1000
|
||||
kubernetesConfig:
|
||||
image: quay.io/opstree/redis:v8.0.3
|
||||
imagePullPolicy: IfNotPresent
|
||||
resources:
|
||||
requests:
|
||||
cpu: 50m
|
||||
memory: 128Mi
|
||||
storage:
|
||||
volumeClaimTemplate:
|
||||
spec:
|
||||
storageClassName: ceph-block
|
||||
accessModes: ["ReadWriteOnce"]
|
||||
resources:
|
||||
requests:
|
||||
storage: 1Gi
|
||||
redisExporter:
|
||||
enabled: true
|
||||
image: quay.io/opstree/redis-exporter:v1.48.0
|
||||
17
clusters/cl01tl/helm/gitea/templates/role-binding.yaml
Normal file
17
clusters/cl01tl/helm/gitea/templates/role-binding.yaml
Normal file
@@ -0,0 +1,17 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: gitea-backup
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-backup
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: gitea-backup
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: gitea-backup
|
||||
namespace: {{ .Release.Namespace }}
|
||||
25
clusters/cl01tl/helm/gitea/templates/role.yaml
Normal file
25
clusters/cl01tl/helm/gitea/templates/role.yaml
Normal file
@@ -0,0 +1,25 @@
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: gitea-backup
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea-backup
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- pods
|
||||
- pods/exec
|
||||
verbs:
|
||||
- create
|
||||
- list
|
||||
- apiGroups:
|
||||
- apps
|
||||
resources:
|
||||
- deployments
|
||||
verbs:
|
||||
- get
|
||||
- list
|
||||
39
clusters/cl01tl/helm/gitea/templates/service-monitor.yaml
Normal file
39
clusters/cl01tl/helm/gitea/templates/service-monitor.yaml
Normal file
@@ -0,0 +1,39 @@
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: gitea
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: gitea
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
matchExpressions:
|
||||
- { key: app.kubernetes.io/controller, operator: NotIn, values: [backup] }
|
||||
endpoints:
|
||||
- port: http
|
||||
|
||||
---
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: redis-replication-gitea
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: redis-replication-gitea
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
redis-operator: "true"
|
||||
env: production
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
redis_setup_type: replication
|
||||
endpoints:
|
||||
- port: redis-exporter
|
||||
interval: 30s
|
||||
scrapeTimeout: 10s
|
||||
23
clusters/cl01tl/helm/gitea/templates/tcp-route.yaml
Normal file
23
clusters/cl01tl/helm/gitea/templates/tcp-route.yaml
Normal file
@@ -0,0 +1,23 @@
|
||||
apiVersion: gateway.networking.k8s.io/v1alpha2
|
||||
kind: TCPRoute
|
||||
metadata:
|
||||
name: tcp-route-gitea-ssh
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app.kubernetes.io/name: tcp-route-gitea-ssh
|
||||
app.kubernetes.io/instance: {{ .Release.Name }}
|
||||
app.kubernetes.io/part-of: {{ .Release.Name }}
|
||||
spec:
|
||||
parentRefs:
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
name: traefik-gateway
|
||||
namespace: traefik
|
||||
sectionName: ssh
|
||||
rules:
|
||||
- backendRefs:
|
||||
- group: ''
|
||||
kind: Service
|
||||
name: gitea-ssh
|
||||
port: 22
|
||||
weight: 100
|
||||
378
clusters/cl01tl/helm/gitea/values.yaml
Normal file
378
clusters/cl01tl/helm/gitea/values.yaml
Normal file
@@ -0,0 +1,378 @@
|
||||
gitea:
|
||||
global:
|
||||
imageRegistry: registry.hub.docker.com
|
||||
replicaCount: 3
|
||||
image:
|
||||
repository: gitea/gitea
|
||||
tag: 1.25.2
|
||||
service:
|
||||
http:
|
||||
type: ClusterIP
|
||||
port: 3000
|
||||
clusterIP: 10.103.160.139
|
||||
ssh:
|
||||
type: ClusterIP
|
||||
port: 22
|
||||
clusterIP: 10.103.160.140
|
||||
ingress:
|
||||
enabled: false
|
||||
persistence:
|
||||
storageClass: ceph-filesystem
|
||||
size: 40Gi
|
||||
accessModes:
|
||||
- ReadWriteMany
|
||||
extraVolumes:
|
||||
- name: gitea-nfs-storage-backup
|
||||
persistentVolumeClaim:
|
||||
claimName: gitea-nfs-storage-backup
|
||||
- name: gitea-themes-storage
|
||||
persistentVolumeClaim:
|
||||
claimName: gitea-themes-storage
|
||||
extraInitVolumeMounts:
|
||||
- name: gitea-themes-storage
|
||||
readOnly: false
|
||||
mountPath: /data/gitea/public/assets/css
|
||||
extraContainerVolumeMounts:
|
||||
- mountPath: /opt/backup
|
||||
name: gitea-nfs-storage-backup
|
||||
readOnly: false
|
||||
- name: gitea-themes-storage
|
||||
readOnly: true
|
||||
mountPath: /data/gitea/public/assets/css
|
||||
initPreScript: |
|
||||
wget https://github.com/catppuccin/gitea/releases/latest/download/catppuccin-gitea.tar.gz;
|
||||
tar -xvzf catppuccin-gitea.tar.gz -C /data/gitea/public/assets/css;
|
||||
rm catppuccin-gitea.tar.gz;
|
||||
gitea:
|
||||
metrics:
|
||||
enabled: true
|
||||
serviceMonitor:
|
||||
enabled: false
|
||||
oauth:
|
||||
- name: Authentik
|
||||
provider: openidConnect
|
||||
existingSecret: gitea-oidc-secret
|
||||
autoDiscoverUrl: https://auth.alexlebens.dev/application/o/gitea/.well-known/openid-configuration
|
||||
iconUrl: https://goauthentik.io/img/icon.png
|
||||
scopes: "email profile"
|
||||
config:
|
||||
APP_NAME: Gitea
|
||||
server:
|
||||
PROTOCOL: http
|
||||
DOMAIN: gitea.alexlebens.dev
|
||||
ROOT_URL: https://gitea.alexlebens.dev
|
||||
LOCAL_ROOT_URL: http://gitea-http.gitea.svc.cluster.local:3000
|
||||
START_SSH_SERVER: true
|
||||
SSH_DOMAIN: gitea.alexlebens.net
|
||||
SSH_PORT: 22
|
||||
SSH_LISTEN_PORT: 22
|
||||
ENABLE_PPROF: true
|
||||
LANDING_PAGE: explore
|
||||
database:
|
||||
DB_TYPE: postgres
|
||||
SCHEMA: public
|
||||
oauth2_client:
|
||||
ENABLE_AUTO_REGISTRATION: true
|
||||
cache:
|
||||
ENABLED: true
|
||||
ADAPTER: redis
|
||||
HOST: redis://redis-replication-gitea-master.gitea:6379
|
||||
queue:
|
||||
TYPE: redis
|
||||
CONN_STR: redis://redis-replication-gitea-master.gitea:6379
|
||||
session:
|
||||
PROVIDER: redis
|
||||
PROVIDER_CONFIG: redis://redis-replication-gitea-master.gitea:6379
|
||||
indexer:
|
||||
ISSUE_INDEXER_ENABLED: true
|
||||
ISSUE_INDEXER_TYPE: meilisearch
|
||||
REPO_INDEXER_ENABLED: false
|
||||
actions:
|
||||
ENABLED: true
|
||||
service:
|
||||
REGISTER_MANUAL_CONFIRM: true
|
||||
SHOW_REGISTRATION_BUTTON: false
|
||||
ALLOW_ONLY_EXTERNAL_REGISTRATION: true
|
||||
explore:
|
||||
REQUIRE_SIGNIN_VIEW: true
|
||||
webhook:
|
||||
ALLOWED_HOST_LIST: private
|
||||
ui:
|
||||
DEFAULT_THEME: gitea-auto
|
||||
THEMES: gitea-light,gitea-dark,gitea-auto,catppuccin-rosewater-auto,catppuccin-flamingo-auto,catppuccin-pink-auto,catppuccin-mauve-auto,catppuccin-red-auto,catppuccin-maroon-auto,catppuccin-peach-auto,catppuccin-yellow-auto,catppuccin-green-auto,catppuccin-teal-auto,catppuccin-sky-auto,catppuccin-sapphire-auto,catppuccin-blue-auto,catppuccin-lavender-auto,catppuccin-latte-rosewater,catppuccin-latte-flamingo,catppuccin-latte-pink,catppuccin-latte-mauve,catppuccin-latte-red,catppuccin-latte-maroon,catppuccin-latte-peach,catppuccin-latte-yellow,catppuccin-latte-green,catppuccin-latte-teal,catppuccin-latte-sky,catppuccin-latte-sapphire,catppuccin-latte-blue,catppuccin-latte-lavender,catppuccin-frappe-rosewater,catppuccin-frappe-flamingo,catppuccin-frappe-pink,catppuccin-frappe-mauve,catppuccin-frappe-red,catppuccin-frappe-maroon,catppuccin-frappe-peach,catppuccin-frappe-yellow,catppuccin-frappe-green,catppuccin-frappe-teal,catppuccin-frappe-sky,catppuccin-frappe-sapphire,catppuccin-frappe-blue,catppuccin-frappe-lavender,catppuccin-macchiato-rosewater,catppuccin-macchiato-flamingo,catppuccin-macchiato-pink,catppuccin-macchiato-mauve,catppuccin-macchiato-red,catppuccin-macchiato-maroon,catppuccin-macchiato-peach,catppuccin-macchiato-yellow,catppuccin-macchiato-green,catppuccin-macchiato-teal,catppuccin-macchiato-sky,catppuccin-macchiato-sapphire,catppuccin-macchiato-blue,catppuccin-macchiato-lavender,catppuccin-mocha-rosewater,catppuccin-mocha-flamingo,catppuccin-mocha-pink,catppuccin-mocha-mauve,catppuccin-mocha-red,catppuccin-mocha-maroon,catppuccin-mocha-peach,catppuccin-mocha-yellow,catppuccin-mocha-green,catppuccin-mocha-teal,catppuccin-mocha-sky,catppuccin-mocha-sapphire,catppuccin-mocha-blue,catppuccin-mocha-lavender
|
||||
mirror:
|
||||
DEFAULT_INTERVAL: 10m
|
||||
repo-archive:
|
||||
ENABLED: false
|
||||
additionalConfigFromEnvs:
|
||||
- name: GITEA__DATABASE__HOST
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-postgresql-17-cluster-app
|
||||
key: host
|
||||
- name: GITEA__DATABASE__NAME
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-postgresql-17-cluster-app
|
||||
key: dbname
|
||||
- name: GITEA__DATABASE__USER
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-postgresql-17-cluster-app
|
||||
key: user
|
||||
- name: GITEA__DATABASE__PASSWD
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-postgresql-17-cluster-app
|
||||
key: password
|
||||
- name: GITEA__INDEXER__ISSUE_INDEXER_CONN_STR
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-meilisearch-master-key-secret
|
||||
key: ISSUE_INDEXER_CONN_STR
|
||||
valkey-cluster:
|
||||
enabled: false
|
||||
valkey:
|
||||
enabled: false
|
||||
postgresql-ha:
|
||||
enabled: false
|
||||
postgresql:
|
||||
enabled: false
|
||||
gitea-actions:
|
||||
enabled: true
|
||||
global:
|
||||
fullnameOverride: gitea-actions
|
||||
statefulset:
|
||||
replicas: 6
|
||||
actRunner:
|
||||
repository: gitea/act_runner
|
||||
tag: 0.2.13
|
||||
config: |
|
||||
log:
|
||||
level: debug
|
||||
cache:
|
||||
enabled: false
|
||||
runner:
|
||||
labels:
|
||||
- "ubuntu-latest:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-24.04"
|
||||
- "ubuntu-js:docker://harbor.alexlebens.net/proxy-ghcr.io/catthehacker/ubuntu:js-24.04"
|
||||
- "ubuntu-24.04:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-24.04"
|
||||
- "ubuntu-22.04:docker://harbor.alexlebens.net/proxy-hub.docker/gitea/runner-images:ubuntu-22.04"
|
||||
dind:
|
||||
repository: docker
|
||||
tag: 25.0.2-dind
|
||||
persistence:
|
||||
storageClass: ceph-block
|
||||
size: 5Gi
|
||||
init:
|
||||
image:
|
||||
repository: busybox
|
||||
tag: "1.37.0"
|
||||
existingSecret: gitea-runner-secret
|
||||
existingSecretKey: token
|
||||
giteaRootURL: http://gitea-http.gitea:3000
|
||||
backup:
|
||||
global:
|
||||
fullnameOverride: gitea-backup
|
||||
controllers:
|
||||
backup:
|
||||
type: cronjob
|
||||
cronjob:
|
||||
suspend: false
|
||||
concurrencyPolicy: Forbid
|
||||
timeZone: US/Central
|
||||
schedule: 0 4 */2 * *
|
||||
startingDeadlineSeconds: 90
|
||||
successfulJobsHistory: 3
|
||||
failedJobsHistory: 3
|
||||
backoffLimit: 3
|
||||
parallelism: 1
|
||||
serviceAccount:
|
||||
name: gitea-backup
|
||||
pod:
|
||||
automountServiceAccountToken: true
|
||||
initContainers:
|
||||
backup:
|
||||
image:
|
||||
repository: bitnami/kubectl
|
||||
tag: latest
|
||||
pullPolicy: IfNotPresent
|
||||
command:
|
||||
- sh
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
kubectl exec -it deploy/gitea -n gitea -- rm -f /opt/backup/gitea-backup.zip;
|
||||
kubectl exec -it deploy/gitea -n gitea -- /app/gitea/gitea dump -c /data/gitea/conf/app.ini --file /opt/backup/gitea-backup.zip;
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
containers:
|
||||
s3-backup:
|
||||
image:
|
||||
repository: d3fk/s3cmd
|
||||
tag: latest@sha256:7bdbd33bb3d044884598898b9e9b383385759fbd6ebf52888700bd9b0e0fab91
|
||||
pullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
echo ">> Running S3 backup for Gitea"
|
||||
s3cmd put --no-check-md5 --no-check-certificate -v /opt/backup/gitea-backup.zip ${BUCKET}/cl01tl/gitea-backup-$(date +"%Y%m%d-%H-%M").zip;
|
||||
mv /opt/backup/gitea-backup.zip /opt/backup/gitea-backup-$(date +"%Y%m%d-%H-%M").zip;
|
||||
echo ">> Completed S3 backup for Gitea"
|
||||
env:
|
||||
- name: BUCKET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-s3cmd-config
|
||||
key: BUCKET
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
s3-prune:
|
||||
image:
|
||||
repository: d3fk/s3cmd
|
||||
tag: latest@sha256:7bdbd33bb3d044884598898b9e9b383385759fbd6ebf52888700bd9b0e0fab91
|
||||
pullPolicy: IfNotPresent
|
||||
command:
|
||||
- /bin/sh
|
||||
args:
|
||||
- -ec
|
||||
- |
|
||||
export DATE_RANGE=$(date -d @$(( $(date +%s) - 604800 )) +%Y%m%d);
|
||||
export FILE_MATCH="$BUCKET/cl01tl/gitea-backup-$DATE_RANGE-09-00.zip"
|
||||
echo ">> Running S3 prune for Gitea backup repository"
|
||||
echo ">> Backups prior to '$DATE_RANGE' will be removed"
|
||||
echo ">> Backups to be removed:"
|
||||
s3cmd ls ${BUCKET}/cl01tl/ |
|
||||
awk -v file_match="$FILE_MATCH" '$4 < file_match {print $4}'
|
||||
echo ">> Deleting ..."
|
||||
s3cmd ls ${BUCKET}/cl01tl/ |
|
||||
awk -v file_match="$FILE_MATCH" '$4 < file_match {print $4}' |
|
||||
while read file; do
|
||||
s3cmd del "$file";
|
||||
done;
|
||||
echo ">> Completed S3 prune for Gitea backup repository"
|
||||
env:
|
||||
- name: BUCKET
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: gitea-s3cmd-config
|
||||
key: BUCKET
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 128Mi
|
||||
serviceAccount:
|
||||
gitea-backup:
|
||||
enabled: true
|
||||
persistence:
|
||||
config:
|
||||
existingClaim: gitea-nfs-storage-backup
|
||||
advancedMounts:
|
||||
backup:
|
||||
s3-backup:
|
||||
- path: /opt/backup
|
||||
readOnly: false
|
||||
s3cmd-config:
|
||||
enabled: true
|
||||
type: secret
|
||||
name: gitea-s3cmd-config
|
||||
advancedMounts:
|
||||
backup:
|
||||
s3-backup:
|
||||
- path: /root/.s3cfg
|
||||
readOnly: true
|
||||
mountPropagation: None
|
||||
subPath: .s3cfg
|
||||
s3-prune:
|
||||
- path: /root/.s3cfg
|
||||
readOnly: true
|
||||
mountPropagation: None
|
||||
subPath: .s3cfg
|
||||
meilisearch:
|
||||
environment:
|
||||
MEILI_NO_ANALYTICS: true
|
||||
MEILI_ENV: production
|
||||
MEILI_EXPERIMENTAL_DUMPLESS_UPGRADE: true
|
||||
auth:
|
||||
existingMasterKeySecret: gitea-meilisearch-master-key-secret
|
||||
service:
|
||||
type: ClusterIP
|
||||
port: 7700
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: ceph-block
|
||||
size: 5Gi
|
||||
resources:
|
||||
requests:
|
||||
cpu: 10m
|
||||
memory: 128Mi
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
cloudflared:
|
||||
existingSecretName: gitea-cloudflared-secret
|
||||
postgres-17-cluster:
|
||||
mode: recovery
|
||||
cluster:
|
||||
storage:
|
||||
storageClass: local-path
|
||||
walStorage:
|
||||
storageClass: local-path
|
||||
monitoring:
|
||||
enabled: true
|
||||
prometheusRule:
|
||||
enabled: true
|
||||
resources:
|
||||
requests:
|
||||
memory: 1Gi
|
||||
cpu: 200m
|
||||
recovery:
|
||||
method: objectStore
|
||||
objectStore:
|
||||
destinationPath: s3://postgres-backups/cl01tl/gitea/gitea-postgresql-17-cluster
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
index: 1
|
||||
endpointCredentials: gitea-postgresql-17-cluster-backup-secret-garage
|
||||
backup:
|
||||
objectStore:
|
||||
- name: external
|
||||
destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gitea/gitea-postgresql-17-cluster
|
||||
index: 1
|
||||
retentionPolicy: "30d"
|
||||
isWALArchiver: false
|
||||
- name: garage-local
|
||||
destinationPath: s3://postgres-backups/cl01tl/gitea/gitea-postgresql-17-cluster
|
||||
index: 1
|
||||
endpointURL: http://garage-main.garage:3900
|
||||
endpointCredentials: gitea-postgresql-17-cluster-backup-secret-garage
|
||||
endpointCredentialsIncludeRegion: true
|
||||
retentionPolicy: "3d"
|
||||
isWALArchiver: true
|
||||
# - name: garage-remote
|
||||
# destinationPath: s3://postgres-backups/cl01tl/gitea/gitea-postgresql-17-cluster
|
||||
# index: 1
|
||||
# endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
|
||||
# endpointCredentials: gitea-postgresql-17-cluster-backup-secret-garage
|
||||
# retentionPolicy: "30d"
|
||||
# data:
|
||||
# compression: bzip2
|
||||
# jobs: 2
|
||||
scheduledBackups:
|
||||
- name: daily-backup
|
||||
suspend: false
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: external
|
||||
- name: live-backup
|
||||
suspend: false
|
||||
immediate: true
|
||||
schedule: "0 0 0 * * *"
|
||||
backupName: garage-local
|
||||
# - name: weekly-backup
|
||||
# suspend: false
|
||||
# schedule: "0 0 4 * * SAT"
|
||||
# backupName: garage-remote
|
||||
Reference in New Issue
Block a user