ce7cb702218693d08ea6d83464d2457c9250027c

2026-11-12 20:46:28 +09:00 · 2026-11-12 20:46:28 +09:00 · 34c5f8963c
commit 34c5f8963c
1 changed files with 145336 additions and 0 deletions
--- a/vendor/workloads/forgejo-public/helm-values.yaml
+++ b/vendor/workloads/forgejo-public/helm-values.yaml
@ -0,0 +1,331 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: forgejo-public-common-values
+  namespace: forgejo-public
+data:
+  values.yaml: |
+    replicaCount: 2
+    strategy:
+      type: RollingUpdate
+      rollingUpdate:
+        maxUnavailable: 0
+        maxSurge: 1
+    image:
+      registry: code.forgejo.org
+      repository: forgejo/forgejo
+      tag: 17.0.1
+      digest: sha256:5ef02fbcf22beef56b8c844952ffad58cfe177b6f98e46e6abb5df90b88dc8d3
+      pullPolicy: IfNotPresent
+      rootless: true
+    initPreScript: |
+      mkdir -p /data/gitea/log
+      chmod ug+rwx /data/gitea/log
+    serviceAccount:
+      create: false
+      name: forgejo-public
+      automountServiceAccountToken: false
+    podSecurityContext:
+      fsGroup: 1000
+    containerSecurityContext:
+      allowPrivilegeEscalation: false
+      privileged: false
+      readOnlyRootFilesystem: true
+      runAsNonRoot: true
+      runAsUser: 1000
+      runAsGroup: 1000
+      capabilities:
+        drop:
+          - ALL
+        add:
+          - SYS_CHROOT
+    deployment:
+      env:
+        - name: SSL_CERT_DIR
+          value: /usr/local/share/ca-certificates
+    extraVolumes:
+      - name: internal-ca
+        secret:
+          secretName: forgejo-public-internal-ca
+      - name: private-config
+        emptyDir: {}
+    extraContainerVolumeMounts:
+      - name: internal-ca
+        mountPath: /usr/local/share/ca-certificates
+        readOnly: true
+      - name: private-config
+        mountPath: /data/gitea/conf
+    extraInitVolumeMounts:
+      - name: private-config
+        mountPath: /data/gitea/conf
+    service:
+      http:
+        type: ClusterIP
+        port: 3000
+      ssh:
+        type: ClusterIP
+        port: 22
+    persistence:
+      enabled: true
+      create: false
+      claimName: forgejo-public-shared-storage-rwx
+      size: 20Gi
+      accessModes:
+        - ReadWriteMany
+      storageClass: longhorn-rwx
+    resources:
+      requests:
+        cpu: 250m
+        memory: 512Mi
+      limits:
+        memory: 2Gi
+    gitea:
+      admin:
+        existingSecret: ""
+        username: ""
+      additionalConfigSources:
+        - secret:
+            secretName: forgejo-public-secrets
+      additionalConfigFromEnvs:
+        - name: FORGEJO__DATABASE__PASSWD
+          valueFrom:
+            secretKeyRef:
+              name: forgejo-public-db
+              key: password
+      config:
+        APP_NAME: "Quorate Git"
+        log:
+          LEVEL: info
+          LOGGER_ROUTER_MODE: console
+          ROOT_PATH: /data/gitea/log
+        server:
+          PROTOCOL: http
+          HTTP_PORT: 3000
+          LANDING_PAGE: explore
+          OFFLINE_MODE: true
+          DISABLE_SSH: true
+          START_SSH_SERVER: false
+          SSH_EXPOSE_ANONYMOUS: false
+          LFS_START_SERVER: false
+        database:
+          DB_TYPE: postgres
+          HOST: main-rw.postgres.svc.cluster.local:5432
+          NAME: forgejo_public
+          USER: forgejo_public
+          SSL_MODE: require
+        security:
+          INSTALL_LOCK: true
+          DISABLE_QUERY_AUTH_TOKEN: true
+          DISABLE_GIT_HOOKS: true
+          DISABLE_WEBHOOKS: true
+          REVERSE_PROXY_LIMIT: 0
+        service:
+          DISABLE_REGISTRATION: false
+          ALLOW_ONLY_EXTERNAL_REGISTRATION: true
+          SHOW_REGISTRATION_BUTTON: false
+          REQUIRE_SIGNIN_VIEW: false
+          ENABLE_INTERNAL_SIGNIN: false
+          ENABLE_BASIC_AUTHENTICATION: false
+          ENABLE_REVERSE_PROXY_AUTHENTICATION: false
+          ENABLE_REVERSE_PROXY_AUTHENTICATION_API: false
+          DEFAULT_KEEP_EMAIL_PRIVATE: true
+          DEFAULT_ALLOW_CREATE_ORGANIZATION: false
+          DEFAULT_USER_IS_RESTRICTED: true
+          ENABLE_USER_HEATMAP: false
+          AUTO_WATCH_NEW_REPOS: false
+        service.explore:
+          REQUIRE_SIGNIN_VIEW: false
+          DISABLE_USERS_PAGE: true
+          DISABLE_ORGANIZATIONS_PAGE: false
+          DISABLE_CODE_PAGE: true
+        admin:
+          DEFAULT_EMAIL_NOTIFICATIONS: disabled
+          DISABLE_REGULAR_ORG_CREATION: true
+          EXTERNAL_USER_DISABLE_FEATURES: deletion,manage_ssh_keys,manage_password
+        repository:
+          ROOT: /data/git/repositories
+          DEFAULT_PRIVATE: public
+          DEFAULT_PUSH_CREATE_PRIVATE: false
+          MAX_CREATION_LIMIT: 0
+          DISABLE_HTTP_GIT: false
+          ENABLE_PUSH_CREATE_USER: false
+          ENABLE_PUSH_CREATE_ORG: false
+          DISABLED_REPO_UNITS: repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages,repo.actions,repo.ext_issues,repo.ext_wiki
+          DEFAULT_REPO_UNITS: repo.code,repo.releases
+          DISABLE_MIGRATIONS: true
+          DISABLE_STARS: true
+          DISABLE_FORKS: true
+          DISABLE_DOWNLOAD_SOURCE_ARCHIVES: false
+          DEFAULT_BRANCH: main
+        repository.upload:
+          ENABLED: false
+        indexer:
+          ISSUE_INDEXER_TYPE: db
+          REPO_INDEXER_ENABLED: false
+        git.timeout:
+          GREP: 2
+        openid:
+          ENABLE_OPENID_SIGNIN: false
+          ENABLE_OPENID_SIGNUP: false
+        api:
+          ENABLE_SWAGGER: false
+          MAX_RESPONSE_ITEMS: 50
+          DEFAULT_PAGING_NUM: 30
+          DEFAULT_MAX_BLOB_SIZE: 10485760
+        packages:
+          ENABLED: false
+        federation:
+          ENABLED: false
+        camo:
+          ENABLED: false
+        mirror:
+          ENABLED: false
+        actions:
+          ENABLED: false
+        cron:
+          ENABLED: false
+        mailer:
+          ENABLED: false
+        email.incoming:
+          ENABLED: false
+        metrics:
+          ENABLED: false
+        other:
+          SHOW_FOOTER_VERSION: false
+          SHOW_FOOTER_TEMPLATE_LOAD_TIME: false
+          ENABLE_SITEMAP: true
+          ENABLE_FEED: true
+    test:
+      enabled: false
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: forge-code-values
+  namespace: forgejo-public
+data:
+  values.yaml: |
+    fullnameOverride: forge-code
+    extraVolumes:
+      - name: internal-ca
+        secret:
+          secretName: forgejo-public-internal-ca
+      - name: private-config
+        emptyDir: {}
+      - name: theme
+        configMap:
+          name: forge-code-theme
+    extraContainerVolumeMounts:
+      - name: internal-ca
+        mountPath: /usr/local/share/ca-certificates
+        readOnly: true
+      - name: private-config
+        mountPath: /data/gitea/conf
+      - name: theme
+        mountPath: /data/gitea/public/assets/css
+        readOnly: true
+    service:
+      http:
+        labels:
+          health.quorate.dev/name: Code
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: forgejo
+            app.kubernetes.io/instance: forge-code
+    gitea:
+      additionalConfigSources:
+        - secret:
+            secretName: forgejo-public-secrets
+        - secret:
+            secretName: forge-code-session
+      config:
+        ui:
+          DEFAULT_THEME: quorate
+          THEMES: quorate,forgejo-auto
+        oauth2:
+          ENABLED: false
+        server:
+          DOMAIN: code.quorate.dev
+          ROOT_URL: https://code.quorate.dev/
+        session:
+          COOKIE_SECURE: true
+          COOKIE_NAME: forge_code_session
+          DOMAIN: ""
+          SAME_SITE: lax
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: forge-git-values
+  namespace: forgejo-public
+data:
+  values.yaml: |
+    fullnameOverride: forge-git
+    service:
+      http:
+        labels:
+          health.quorate.dev/name: Git
+      ssh:
+        type: LoadBalancer
+        port: 22
+        externalTrafficPolicy: Local
+        annotations:
+          lbipam.cilium.io/ips: "10.47.201.154"
+        labels:
+          io.cilium/bgp-announce: "true"
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: forgejo
+            app.kubernetes.io/instance: forge-git
+    gitea:
+      oauth:
+        - name: Zitadel
+          provider: openidConnect
+          existingSecret: forge-git-oidc-zitadel
+          autoDiscoverUrl: https://auth.quorate.dev/.well-known/openid-configuration
+          scopes: "openid profile email groups"
+          requiredClaimName: "groups"
+          requiredClaimValue: "forgejo_login"
+          groupClaimName: "groups"
+          adminGroup: "forgejo_admin"
+          restrictedGroup: "forgejo_restricted"
+      additionalConfigSources:
+        - secret:
+            secretName: forgejo-public-secrets
+        - secret:
+            secretName: forge-git-session
+      config:
+        server:
+          DOMAIN: git.quorate.dev
+          ROOT_URL: https://git.quorate.dev/
+          DISABLE_SSH: false
+          START_SSH_SERVER: true
+          SSH_DOMAIN: git-ssh.quorate.internal
+          SSH_PORT: 22
+          SSH_LISTEN_PORT: 2222
+        admin:
+          EXTERNAL_USER_DISABLE_FEATURES: deletion,manage_password
+        oauth2_client:
+          OPENID_CONNECT_SCOPES: "openid profile email groups"
+          ENABLE_AUTO_REGISTRATION: true
+          USERNAME: nickname
+          ACCOUNT_LINKING: disabled
+          UPDATE_AVATAR: false
+          GROUP_CLAIM_NAME: groups
+          ADMIN_GROUP: forgejo_admin
+          ENABLE_OIDC_GROUP_CLAIM: true
+          RE_MANAGE_GROUPS_ON_SIGNIN: true
+          FETCH_USER_INFO_FROM_USERINFO_ENDPOINT: true
+        session:
+          COOKIE_SECURE: true
+          COOKIE_NAME: forge_git_session
+          DOMAIN: ""
+          SAME_SITE: lax