331 lines
9.4 KiB
YAML
331 lines
9.4 KiB
YAML
|
apiVersion: v1
|
||
|
|
kind: ConfigMap
|
||
|
|
metadata:
|
||
|
|
name: forgejo-public-common-values
|
||
|
|
namespace: forgejo-public
|
||
|
|
data:
|
||
|
|
values.yaml: |
|
||
|
|
replicaCount: 2
|
||
|
|
strategy:
|
||
|
|
type: RollingUpdate
|
||
|
|
rollingUpdate:
|
||
|
|
maxUnavailable: 0
|
||
|
|
maxSurge: 1
|
||
|
|
image:
|
||
|
|
registry: code.forgejo.org
|
||
|
|
repository: forgejo/forgejo
|
||
|
|
tag: 17.0.1
|
||
|
|
digest: sha256:5ef02fbcf22beef56b8c844952ffad58cfe177b6f98e46e6abb5df90b88dc8d3
|
||
|
|
pullPolicy: IfNotPresent
|
||
|
|
rootless: true
|
||
|
|
initPreScript: |
|
||
|
|
mkdir -p /data/gitea/log
|
||
|
|
chmod ug+rwx /data/gitea/log
|
||
|
|
serviceAccount:
|
||
|
|
create: false
|
||
|
|
name: forgejo-public
|
||
|
|
automountServiceAccountToken: false
|
||
|
|
podSecurityContext:
|
||
|
|
fsGroup: 1000
|
||
|
|
containerSecurityContext:
|
||
|
|
allowPrivilegeEscalation: false
|
||
|
|
privileged: false
|
||
|
|
readOnlyRootFilesystem: true
|
||
|
|
runAsNonRoot: true
|
||
|
|
runAsUser: 1000
|
||
|
|
runAsGroup: 1000
|
||
|
|
capabilities:
|
||
|
|
drop:
|
||
|
|
- ALL
|
||
|
|
add:
|
||
|
|
- SYS_CHROOT
|
||
|
|
deployment:
|
||
|
|
env:
|
||
|
|
- name: SSL_CERT_DIR
|
||
|
|
value: /usr/local/share/ca-certificates
|
||
|
|
extraVolumes:
|
||
|
|
- name: internal-ca
|
||
|
|
secret:
|
||
|
|
secretName: forgejo-public-internal-ca
|
||
|
|
- name: private-config
|
||
|
|
emptyDir: {}
|
||
|
|
extraContainerVolumeMounts:
|
||
|
|
- name: internal-ca
|
||
|
|
mountPath: /usr/local/share/ca-certificates
|
||
|
|
readOnly: true
|
||
|
|
- name: private-config
|
||
|
|
mountPath: /data/gitea/conf
|
||
|
|
extraInitVolumeMounts:
|
||
|
|
- name: private-config
|
||
|
|
mountPath: /data/gitea/conf
|
||
|
|
service:
|
||
|
|
http:
|
||
|
|
type: ClusterIP
|
||
|
|
port: 3000
|
||
|
|
ssh:
|
||
|
|
type: ClusterIP
|
||
|
|
port: 22
|
||
|
|
persistence:
|
||
|
|
enabled: true
|
||
|
|
create: false
|
||
|
|
claimName: forgejo-public-shared-storage-rwx
|
||
|
|
size: 20Gi
|
||
|
|
accessModes:
|
||
|
|
- ReadWriteMany
|
||
|
|
storageClass: longhorn-rwx
|
||
|
|
resources:
|
||
|
|
requests:
|
||
|
|
cpu: 250m
|
||
|
|
memory: 512Mi
|
||
|
|
limits:
|
||
|
|
memory: 2Gi
|
||
|
|
gitea:
|
||
|
|
admin:
|
||
|
|
existingSecret: ""
|
||
|
|
username: ""
|
||
|
|
additionalConfigSources:
|
||
|
|
- secret:
|
||
|
|
secretName: forgejo-public-secrets
|
||
|
|
additionalConfigFromEnvs:
|
||
|
|
- name: FORGEJO__DATABASE__PASSWD
|
||
|
|
valueFrom:
|
||
|
|
secretKeyRef:
|
||
|
|
name: forgejo-public-db
|
||
|
|
key: password
|
||
|
|
config:
|
||
|
|
APP_NAME: "Quorate Git"
|
||
|
|
log:
|
||
|
|
LEVEL: info
|
||
|
|
LOGGER_ROUTER_MODE: console
|
||
|
|
ROOT_PATH: /data/gitea/log
|
||
|
|
server:
|
||
|
|
PROTOCOL: http
|
||
|
|
HTTP_PORT: 3000
|
||
|
|
LANDING_PAGE: explore
|
||
|
|
OFFLINE_MODE: true
|
||
|
|
DISABLE_SSH: true
|
||
|
|
START_SSH_SERVER: false
|
||
|
|
SSH_EXPOSE_ANONYMOUS: false
|
||
|
|
LFS_START_SERVER: false
|
||
|
|
database:
|
||
|
|
DB_TYPE: postgres
|
||
|
|
HOST: main-rw.postgres.svc.cluster.local:5432
|
||
|
|
NAME: forgejo_public
|
||
|
|
USER: forgejo_public
|
||
|
|
SSL_MODE: require
|
||
|
|
security:
|
||
|
|
INSTALL_LOCK: true
|
||
|
|
DISABLE_QUERY_AUTH_TOKEN: true
|
||
|
|
DISABLE_GIT_HOOKS: true
|
||
|
|
DISABLE_WEBHOOKS: true
|
||
|
|
REVERSE_PROXY_LIMIT: 0
|
||
|
|
service:
|
||
|
|
DISABLE_REGISTRATION: false
|
||
|
|
ALLOW_ONLY_EXTERNAL_REGISTRATION: true
|
||
|
|
SHOW_REGISTRATION_BUTTON: false
|
||
|
|
REQUIRE_SIGNIN_VIEW: false
|
||
|
|
ENABLE_INTERNAL_SIGNIN: false
|
||
|
|
ENABLE_BASIC_AUTHENTICATION: false
|
||
|
|
ENABLE_REVERSE_PROXY_AUTHENTICATION: false
|
||
|
|
ENABLE_REVERSE_PROXY_AUTHENTICATION_API: false
|
||
|
|
DEFAULT_KEEP_EMAIL_PRIVATE: true
|
||
|
|
DEFAULT_ALLOW_CREATE_ORGANIZATION: false
|
||
|
|
DEFAULT_USER_IS_RESTRICTED: true
|
||
|
|
ENABLE_USER_HEATMAP: false
|
||
|
|
AUTO_WATCH_NEW_REPOS: false
|
||
|
|
service.explore:
|
||
|
|
REQUIRE_SIGNIN_VIEW: false
|
||
|
|
DISABLE_USERS_PAGE: true
|
||
|
|
DISABLE_ORGANIZATIONS_PAGE: false
|
||
|
|
DISABLE_CODE_PAGE: true
|
||
|
|
admin:
|
||
|
|
DEFAULT_EMAIL_NOTIFICATIONS: disabled
|
||
|
|
DISABLE_REGULAR_ORG_CREATION: true
|
||
|
|
EXTERNAL_USER_DISABLE_FEATURES: deletion,manage_ssh_keys,manage_password
|
||
|
|
repository:
|
||
|
|
ROOT: /data/git/repositories
|
||
|
|
DEFAULT_PRIVATE: public
|
||
|
|
DEFAULT_PUSH_CREATE_PRIVATE: false
|
||
|
|
MAX_CREATION_LIMIT: 0
|
||
|
|
DISABLE_HTTP_GIT: false
|
||
|
|
ENABLE_PUSH_CREATE_USER: false
|
||
|
|
ENABLE_PUSH_CREATE_ORG: false
|
||
|
|
DISABLED_REPO_UNITS: repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages,repo.actions,repo.ext_issues,repo.ext_wiki
|
||
|
|
DEFAULT_REPO_UNITS: repo.code,repo.releases
|
||
|
|
DISABLE_MIGRATIONS: true
|
||
|
|
DISABLE_STARS: true
|
||
|
|
DISABLE_FORKS: true
|
||
|
|
DISABLE_DOWNLOAD_SOURCE_ARCHIVES: false
|
||
|
|
DEFAULT_BRANCH: main
|
||
|
|
repository.upload:
|
||
|
|
ENABLED: false
|
||
|
|
indexer:
|
||
|
|
ISSUE_INDEXER_TYPE: db
|
||
|
|
REPO_INDEXER_ENABLED: false
|
||
|
|
git.timeout:
|
||
|
|
GREP: 2
|
||
|
|
openid:
|
||
|
|
ENABLE_OPENID_SIGNIN: false
|
||
|
|
ENABLE_OPENID_SIGNUP: false
|
||
|
|
api:
|
||
|
|
ENABLE_SWAGGER: false
|
||
|
|
MAX_RESPONSE_ITEMS: 50
|
||
|
|
DEFAULT_PAGING_NUM: 30
|
||
|
|
DEFAULT_MAX_BLOB_SIZE: 10485760
|
||
|
|
packages:
|
||
|
|
ENABLED: false
|
||
|
|
federation:
|
||
|
|
ENABLED: false
|
||
|
|
camo:
|
||
|
|
ENABLED: false
|
||
|
|
mirror:
|
||
|
|
ENABLED: false
|
||
|
|
actions:
|
||
|
|
ENABLED: false
|
||
|
|
cron:
|
||
|
|
ENABLED: false
|
||
|
|
mailer:
|
||
|
|
ENABLED: false
|
||
|
|
email.incoming:
|
||
|
|
ENABLED: false
|
||
|
|
metrics:
|
||
|
|
ENABLED: false
|
||
|
|
other:
|
||
|
|
SHOW_FOOTER_VERSION: false
|
||
|
|
SHOW_FOOTER_TEMPLATE_LOAD_TIME: false
|
||
|
|
ENABLE_SITEMAP: true
|
||
|
|
ENABLE_FEED: true
|
||
|
|
test:
|
||
|
|
enabled: false
|
||
|
|
---
|
||
|
|
apiVersion: v1
|
||
|
|
kind: ConfigMap
|
||
|
|
metadata:
|
||
|
|
name: forge-code-values
|
||
|
|
namespace: forgejo-public
|
||
|
|
data:
|
||
|
|
values.yaml: |
|
||
|
|
fullnameOverride: forge-code
|
||
|
|
extraVolumes:
|
||
|
|
- name: internal-ca
|
||
|
|
secret:
|
||
|
|
secretName: forgejo-public-internal-ca
|
||
|
|
- name: private-config
|
||
|
|
emptyDir: {}
|
||
|
|
- name: theme
|
||
|
|
configMap:
|
||
|
|
name: forge-code-theme
|
||
|
|
extraContainerVolumeMounts:
|
||
|
|
- name: internal-ca
|
||
|
|
mountPath: /usr/local/share/ca-certificates
|
||
|
|
readOnly: true
|
||
|
|
- name: private-config
|
||
|
|
mountPath: /data/gitea/conf
|
||
|
|
- name: theme
|
||
|
|
mountPath: /data/gitea/public/assets/css
|
||
|
|
readOnly: true
|
||
|
|
service:
|
||
|
|
http:
|
||
|
|
labels:
|
||
|
|
health.quorate.dev/name: Code
|
||
|
|
topologySpreadConstraints:
|
||
|
|
- maxSkew: 1
|
||
|
|
topologyKey: kubernetes.io/hostname
|
||
|
|
whenUnsatisfiable: DoNotSchedule
|
||
|
|
labelSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: forgejo
|
||
|
|
app.kubernetes.io/instance: forge-code
|
||
|
|
gitea:
|
||
|
|
additionalConfigSources:
|
||
|
|
- secret:
|
||
|
|
secretName: forgejo-public-secrets
|
||
|
|
- secret:
|
||
|
|
secretName: forge-code-session
|
||
|
|
config:
|
||
|
|
ui:
|
||
|
|
DEFAULT_THEME: quorate
|
||
|
|
THEMES: quorate,forgejo-auto
|
||
|
|
oauth2:
|
||
|
|
ENABLED: false
|
||
|
|
server:
|
||
|
|
DOMAIN: code.quorate.dev
|
||
|
|
ROOT_URL: https://code.quorate.dev/
|
||
|
|
session:
|
||
|
|
COOKIE_SECURE: true
|
||
|
|
COOKIE_NAME: forge_code_session
|
||
|
|
DOMAIN: ""
|
||
|
|
SAME_SITE: lax
|
||
|
|
---
|
||
|
|
apiVersion: v1
|
||
|
|
kind: ConfigMap
|
||
|
|
metadata:
|
||
|
|
name: forge-git-values
|
||
|
|
namespace: forgejo-public
|
||
|
|
data:
|
||
|
|
values.yaml: |
|
||
|
|
fullnameOverride: forge-git
|
||
|
|
service:
|
||
|
|
http:
|
||
|
|
labels:
|
||
|
|
health.quorate.dev/name: Git
|
||
|
|
ssh:
|
||
|
|
type: LoadBalancer
|
||
|
|
port: 22
|
||
|
|
externalTrafficPolicy: Local
|
||
|
|
annotations:
|
||
|
|
lbipam.cilium.io/ips: "10.47.201.154"
|
||
|
|
labels:
|
||
|
|
io.cilium/bgp-announce: "true"
|
||
|
|
topologySpreadConstraints:
|
||
|
|
- maxSkew: 1
|
||
|
|
topologyKey: kubernetes.io/hostname
|
||
|
|
whenUnsatisfiable: DoNotSchedule
|
||
|
|
labelSelector:
|
||
|
|
matchLabels:
|
||
|
|
app.kubernetes.io/name: forgejo
|
||
|
|
app.kubernetes.io/instance: forge-git
|
||
|
|
gitea:
|
||
|
|
oauth:
|
||
|
|
- name: Zitadel
|
||
|
|
provider: openidConnect
|
||
|
|
existingSecret: forge-git-oidc-zitadel
|
||
|
|
autoDiscoverUrl: https://auth.quorate.dev/.well-known/openid-configuration
|
||
|
|
scopes: "openid profile email groups"
|
||
|
|
requiredClaimName: "groups"
|
||
|
|
requiredClaimValue: "forgejo_login"
|
||
|
|
groupClaimName: "groups"
|
||
|
|
adminGroup: "forgejo_admin"
|
||
|
|
restrictedGroup: "forgejo_restricted"
|
||
|
|
additionalConfigSources:
|
||
|
|
- secret:
|
||
|
|
secretName: forgejo-public-secrets
|
||
|
|
- secret:
|
||
|
|
secretName: forge-git-session
|
||
|
|
config:
|
||
|
|
server:
|
||
|
|
DOMAIN: git.quorate.dev
|
||
|
|
ROOT_URL: https://git.quorate.dev/
|
||
|
|
DISABLE_SSH: false
|
||
|
|
START_SSH_SERVER: true
|
||
|
|
SSH_DOMAIN: git-ssh.quorate.internal
|
||
|
|
SSH_PORT: 22
|
||
|
|
SSH_LISTEN_PORT: 2222
|
||
|
|
admin:
|
||
|
|
EXTERNAL_USER_DISABLE_FEATURES: deletion,manage_password
|
||
|
|
oauth2_client:
|
||
|
|
OPENID_CONNECT_SCOPES: "openid profile email groups"
|
||
|
|
ENABLE_AUTO_REGISTRATION: true
|
||
|
|
USERNAME: nickname
|
||
|
|
ACCOUNT_LINKING: disabled
|
||
|
|
UPDATE_AVATAR: false
|
||
|
|
GROUP_CLAIM_NAME: groups
|
||
|
|
ADMIN_GROUP: forgejo_admin
|
||
|
|
ENABLE_OIDC_GROUP_CLAIM: true
|
||
|
|
RE_MANAGE_GROUPS_ON_SIGNIN: true
|
||
|
|
FETCH_USER_INFO_FROM_USERINFO_ENDPOINT: true
|
||
|
|
session:
|
||
|
|
COOKIE_SECURE: true
|
||
|
|
COOKIE_NAME: forge_git_session
|
||
|
|
DOMAIN: ""
|
||
|
|
SAME_SITE: lax
|