ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
210
vendor/workloads/forgejo-public/vso.yaml
vendored
Normal file
210
vendor/workloads/forgejo-public/vso.yaml
vendored
Normal file
|
|
@ -0,0 +1,210 @@
|
|||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultAuth
|
||||
metadata:
|
||||
name: default
|
||||
namespace: forgejo-public
|
||||
spec:
|
||||
method: kubernetes
|
||||
mount: kubernetes
|
||||
kubernetes:
|
||||
role: forgejo-public
|
||||
serviceAccount: forgejo-public
|
||||
vaultConnectionRef: vault/vault
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: forge-git-oidc-zitadel
|
||||
namespace: forgejo-public
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: forgejo-public/oidc/zitadel
|
||||
destination:
|
||||
name: forge-git-oidc-zitadel
|
||||
create: true
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: forge-git
|
||||
vaultAuthRef: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultDynamicSecret
|
||||
metadata:
|
||||
name: forgejo-public-db
|
||||
namespace: forgejo-public
|
||||
spec:
|
||||
mount: database
|
||||
path: static-creds/forgejo-public
|
||||
destination:
|
||||
name: forgejo-public-db
|
||||
create: true
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: forge-code
|
||||
- kind: Deployment
|
||||
name: forge-git
|
||||
vaultAuthRef: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: forgejo-public-secrets
|
||||
namespace: forgejo-public
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: forgejo-public/secrets
|
||||
destination:
|
||||
name: forgejo-public-secrets
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes:
|
||||
- .*
|
||||
templates:
|
||||
cache:
|
||||
text: |
|
||||
ADAPTER=redis
|
||||
HOST=redis://default:{{ get .Secrets "redis_password" }}@forgejo-public.dragonfly.svc.cluster.local:6379/0?pool_size=100&idle_timeout=180s
|
||||
queue:
|
||||
text: |
|
||||
TYPE=redis
|
||||
CONN_STR=redis://default:{{ get .Secrets "redis_password" }}@forgejo-public.dragonfly.svc.cluster.local:6379/2?pool_size=100&idle_timeout=180s
|
||||
attachment:
|
||||
text: |
|
||||
STORAGE_TYPE=minio
|
||||
MINIO_ENDPOINT=s3.quorate.internal
|
||||
MINIO_ACCESS_KEY_ID=forgejo-public
|
||||
MINIO_SECRET_ACCESS_KEY={{ get .Secrets "s3_secret_key" }}
|
||||
MINIO_BUCKET=forgejo-public
|
||||
MINIO_BUCKET_LOOKUP=path
|
||||
MINIO_LOCATION=us-east-1
|
||||
MINIO_USE_SSL=true
|
||||
MINIO_INSECURE_SKIP_VERIFY=false
|
||||
MINIO_BASE_PATH=attachments/
|
||||
avatar:
|
||||
text: |
|
||||
STORAGE_TYPE=minio
|
||||
MINIO_ENDPOINT=s3.quorate.internal
|
||||
MINIO_ACCESS_KEY_ID=forgejo-public
|
||||
MINIO_SECRET_ACCESS_KEY={{ get .Secrets "s3_secret_key" }}
|
||||
MINIO_BUCKET=forgejo-public
|
||||
MINIO_BUCKET_LOOKUP=path
|
||||
MINIO_LOCATION=us-east-1
|
||||
MINIO_USE_SSL=true
|
||||
MINIO_INSECURE_SKIP_VERIFY=false
|
||||
MINIO_BASE_PATH=avatars/
|
||||
repo-avatar:
|
||||
text: |
|
||||
STORAGE_TYPE=minio
|
||||
MINIO_ENDPOINT=s3.quorate.internal
|
||||
MINIO_ACCESS_KEY_ID=forgejo-public
|
||||
MINIO_SECRET_ACCESS_KEY={{ get .Secrets "s3_secret_key" }}
|
||||
MINIO_BUCKET=forgejo-public
|
||||
MINIO_BUCKET_LOOKUP=path
|
||||
MINIO_LOCATION=us-east-1
|
||||
MINIO_USE_SSL=true
|
||||
MINIO_INSECURE_SKIP_VERIFY=false
|
||||
MINIO_BASE_PATH=repo-avatars/
|
||||
repo-archive:
|
||||
text: |
|
||||
STORAGE_TYPE=minio
|
||||
MINIO_ENDPOINT=s3.quorate.internal
|
||||
MINIO_ACCESS_KEY_ID=forgejo-public
|
||||
MINIO_SECRET_ACCESS_KEY={{ get .Secrets "s3_secret_key" }}
|
||||
MINIO_BUCKET=forgejo-public
|
||||
MINIO_BUCKET_LOOKUP=path
|
||||
MINIO_LOCATION=us-east-1
|
||||
MINIO_USE_SSL=true
|
||||
MINIO_INSECURE_SKIP_VERIFY=false
|
||||
MINIO_BASE_PATH=repo-archives/
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: forge-code
|
||||
- kind: Deployment
|
||||
name: forge-git
|
||||
vaultAuthRef: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: forge-code-session
|
||||
namespace: forgejo-public
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: forgejo-public/secrets
|
||||
destination:
|
||||
name: forge-code-session
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes:
|
||||
- .*
|
||||
templates:
|
||||
session:
|
||||
text: |
|
||||
PROVIDER=redis
|
||||
PROVIDER_CONFIG=redis://default:{{ get .Secrets "redis_password" }}@forgejo-public.dragonfly.svc.cluster.local:6379/1?pool_size=100&idle_timeout=180s&prefix=forge-code:
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: forge-code
|
||||
vaultAuthRef: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: forge-git-session
|
||||
namespace: forgejo-public
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: forgejo-public/secrets
|
||||
destination:
|
||||
name: forge-git-session
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes:
|
||||
- .*
|
||||
templates:
|
||||
session:
|
||||
text: |
|
||||
PROVIDER=redis
|
||||
PROVIDER_CONFIG=redis://default:{{ get .Secrets "redis_password" }}@forgejo-public.dragonfly.svc.cluster.local:6379/1?pool_size=100&idle_timeout=180s&prefix=forge-git:
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: forge-git
|
||||
vaultAuthRef: default
|
||||
---
|
||||
apiVersion: secrets.hashicorp.com/v1beta1
|
||||
kind: VaultStaticSecret
|
||||
metadata:
|
||||
name: forgejo-public-internal-ca
|
||||
namespace: forgejo-public
|
||||
spec:
|
||||
type: kv-v2
|
||||
mount: secret
|
||||
path: forgejo-public/secrets
|
||||
destination:
|
||||
name: forgejo-public-internal-ca
|
||||
create: true
|
||||
overwrite: true
|
||||
transformation:
|
||||
excludeRaw: true
|
||||
excludes:
|
||||
- .*
|
||||
templates:
|
||||
internal-ca.crt:
|
||||
text: |
|
||||
{{ get .Secrets "internal_ca_cert" }}
|
||||
rolloutRestartTargets:
|
||||
- kind: Deployment
|
||||
name: forge-code
|
||||
- kind: Deployment
|
||||
name: forge-git
|
||||
vaultAuthRef: default
|
||||
Loading…
Reference in a new issue