ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/forgejo/helm-release.yaml

@@ -0,0 +1,200 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: forgejo
+  namespace: forgejo
+spec:
+  interval: 15m
+  releaseName: forgejo
+  targetNamespace: forgejo
+  chart:
+    spec:
+      chart: forgejo
+      version: 17.3.2
+      sourceRef:
+        kind: HelmRepository
+        name: forgejo
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  # Chart merges deployment.labels into spec.selector (immutable). Pod-only label.
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: Deployment
+              name: forgejo
+            patch: |-
+              - op: add
+                path: /spec/template/metadata/labels/gateway.quorate.internal~1allow-gateway-client
+                value: "true"
+              - op: add
+                path: /spec/template/metadata/labels/quorate.dev~1zitadel-relay
+                value: "true"
+  values:
+    image:
+      registry: code.forgejo.org
+      repository: forgejo/forgejo
+      tag: 17.0.1
+      digest: sha256:5ef02fbcf22beef56b8c844952ffad58cfe177b6f98e46e6abb5df90b88dc8d3
+      rootless: true
+    replicaCount: 2
+    strategy:
+      type: RollingUpdate
+      rollingUpdate:
+        maxUnavailable: 0
+        maxSurge: 1
+    minReadySeconds: 5
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: forgejo
+            app.kubernetes.io/instance: forgejo
+    initPreScript: |
+      mkdir -p /data/gitea/log
+      chmod ug+rwx /data/gitea/log
+    serviceAccount:
+      create: false
+      name: forgejo
+    podSecurityContext:
+      fsGroup: 1000
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      capabilities:
+        drop:
+          - ALL
+        add:
+          - SYS_CHROOT
+    deployment:
+      env:
+        # Forgejo MinIO uses Go http.Transport; SSL_CERT_DIR is reliable for custom CAs.
+        - name: SSL_CERT_DIR
+          value: /usr/local/share/ca-certificates
+    extraVolumes:
+      - name: internal-ca
+        secret:
+          secretName: forgejo-internal-ca
+    extraContainerVolumeMounts:
+      - name: internal-ca
+        mountPath: /usr/local/share/ca-certificates
+        readOnly: true
+    service:
+      http:
+        type: ClusterIP
+        port: 3000
+      ssh:
+        type: LoadBalancer
+        port: 22
+        externalTrafficPolicy: Local
+        annotations:
+          lbipam.cilium.io/ips: "10.190.165.53"
+        labels:
+          io.cilium/bgp-announce: "true"
+    persistence:
+      enabled: true
+      create: false
+      claimName: forgejo-shared-storage-rwx
+      size: 20Gi
+      accessModes:
+        - ReadWriteMany
+      storageClass: longhorn-rwx
+    resources:
+      requests:
+        cpu: 250m
+        memory: 512Mi
+      limits:
+        memory: 2Gi
+    gitea:
+      admin:
+        existingSecret: ""
+        username: ""
+      oauth:
+        - name: Zitadel
+          provider: openidConnect
+          existingSecret: forgejo-oidc-zitadel
+          autoDiscoverUrl: https://auth.quorate.dev/.well-known/openid-configuration
+          scopes: "openid profile email groups"
+          requiredClaimName: "groups"
+          requiredClaimValue: "forgejo_login"
+          groupClaimName: "groups"
+          adminGroup: "forgejo_admin"
+          restrictedGroup: "forgejo_restricted"
+      additionalConfigSources:
+        - secret:
+            secretName: forgejo-secrets
+      additionalConfigFromEnvs:
+        - name: FORGEJO__DATABASE__PASSWD
+          valueFrom:
+            secretKeyRef:
+              name: forgejo-db
+              key: password
+      config:
+        APP_NAME: "Quorate Forge"
+        log:
+          LEVEL: info
+          LOGGER_ROUTER_MODE: console
+          ROOT_PATH: /data/gitea/log
+        server:
+          DOMAIN: forge.quorate.internal
+          ROOT_URL: https://forge.quorate.internal/
+          PROTOCOL: http
+          HTTP_PORT: 3000
+          SSH_DOMAIN: forge-ssh.quorate.internal
+          SSH_PORT: 22
+          SSH_LISTEN_PORT: 2222
+          LFS_START_SERVER: false
+        database:
+          DB_TYPE: postgres
+          HOST: main-rw.postgres.svc.cluster.local:5432
+          NAME: forgejo
+          USER: forgejo
+          SSL_MODE: require
+        openid:
+          ENABLE_OPENID_SIGNIN: false
+          ENABLE_OPENID_SIGNUP: false
+        oauth2_client:
+          OPENID_CONNECT_SCOPES: "openid profile email groups"
+          ENABLE_AUTO_REGISTRATION: true
+          USERNAME: nickname
+          ACCOUNT_LINKING: disabled
+          UPDATE_AVATAR: true
+          GROUP_CLAIM_NAME: "groups"
+          ADMIN_GROUP: "forgejo_admin"
+          ENABLE_OIDC_GROUP_CLAIM: true
+          RE_MANAGE_GROUPS_ON_SIGNIN: true
+          FETCH_USER_INFO_FROM_USERINFO_ENDPOINT: true
+        service:
+          DISABLE_REGISTRATION: false
+          ALLOW_ONLY_EXTERNAL_REGISTRATION: true
+          REQUIRE_SIGNIN_VIEW: true
+          SHOW_REGISTRATION_BUTTON: false
+          ENABLE_INTERNAL_SIGNIN: false
+        repository:
+          ROOT: /data/git/repositories
+          DISABLED_REPO_UNITS: "repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages,repo.actions,repo.ext_issues,repo.ext_wiki"
+          DEFAULT_REPO_UNITS: "repo.code,repo.releases"
+          DISABLE_MIGRATIONS: true
+        indexer:
+          REPO_INDEXER_ENABLED: false
+        cron:
+          ENABLED: false
+        mirror:
+          ENABLED: false
+        actions:
+          ENABLED: false
+        metrics:
+          ENABLED: false
+    test:
+      enabled: false