apiVersion: v1 kind: ConfigMap metadata: name: forgejo-public-common-values namespace: forgejo-public data: values.yaml: | replicaCount: 2 strategy: type: RollingUpdate rollingUpdate: maxUnavailable: 0 maxSurge: 1 image: registry: code.forgejo.org repository: forgejo/forgejo tag: 17.0.1 digest: sha256:5ef02fbcf22beef56b8c844952ffad58cfe177b6f98e46e6abb5df90b88dc8d3 pullPolicy: IfNotPresent rootless: true initPreScript: | mkdir -p /data/gitea/log chmod ug+rwx /data/gitea/log serviceAccount: create: false name: forgejo-public automountServiceAccountToken: false podSecurityContext: fsGroup: 1000 containerSecurityContext: allowPrivilegeEscalation: false privileged: false readOnlyRootFilesystem: true runAsNonRoot: true runAsUser: 1000 runAsGroup: 1000 capabilities: drop: - ALL add: - SYS_CHROOT deployment: env: - name: SSL_CERT_DIR value: /usr/local/share/ca-certificates extraVolumes: - name: internal-ca secret: secretName: forgejo-public-internal-ca - name: private-config emptyDir: {} extraContainerVolumeMounts: - name: internal-ca mountPath: /usr/local/share/ca-certificates readOnly: true - name: private-config mountPath: /data/gitea/conf extraInitVolumeMounts: - name: private-config mountPath: /data/gitea/conf service: http: type: ClusterIP port: 3000 ssh: type: ClusterIP port: 22 persistence: enabled: true create: false claimName: forgejo-public-shared-storage-rwx size: 20Gi accessModes: - ReadWriteMany storageClass: longhorn-rwx resources: requests: cpu: 250m memory: 512Mi limits: memory: 2Gi gitea: admin: existingSecret: "" username: "" additionalConfigSources: - secret: secretName: forgejo-public-secrets additionalConfigFromEnvs: - name: FORGEJO__DATABASE__PASSWD valueFrom: secretKeyRef: name: forgejo-public-db key: password config: APP_NAME: "Quorate Git" log: LEVEL: info LOGGER_ROUTER_MODE: console ROOT_PATH: /data/gitea/log server: PROTOCOL: http HTTP_PORT: 3000 LANDING_PAGE: explore OFFLINE_MODE: true DISABLE_SSH: true START_SSH_SERVER: false SSH_EXPOSE_ANONYMOUS: false LFS_START_SERVER: false database: DB_TYPE: postgres HOST: main-rw.postgres.svc.cluster.local:5432 NAME: forgejo_public USER: forgejo_public SSL_MODE: require security: INSTALL_LOCK: true DISABLE_QUERY_AUTH_TOKEN: true DISABLE_GIT_HOOKS: true DISABLE_WEBHOOKS: true REVERSE_PROXY_LIMIT: 0 service: DISABLE_REGISTRATION: false ALLOW_ONLY_EXTERNAL_REGISTRATION: true SHOW_REGISTRATION_BUTTON: false REQUIRE_SIGNIN_VIEW: false ENABLE_INTERNAL_SIGNIN: false ENABLE_BASIC_AUTHENTICATION: false ENABLE_REVERSE_PROXY_AUTHENTICATION: false ENABLE_REVERSE_PROXY_AUTHENTICATION_API: false DEFAULT_KEEP_EMAIL_PRIVATE: true DEFAULT_ALLOW_CREATE_ORGANIZATION: false DEFAULT_USER_IS_RESTRICTED: true ENABLE_USER_HEATMAP: false AUTO_WATCH_NEW_REPOS: false service.explore: REQUIRE_SIGNIN_VIEW: false DISABLE_USERS_PAGE: true DISABLE_ORGANIZATIONS_PAGE: false DISABLE_CODE_PAGE: true admin: DEFAULT_EMAIL_NOTIFICATIONS: disabled DISABLE_REGULAR_ORG_CREATION: true EXTERNAL_USER_DISABLE_FEATURES: deletion,manage_ssh_keys,manage_password repository: ROOT: /data/git/repositories DEFAULT_PRIVATE: public DEFAULT_PUSH_CREATE_PRIVATE: false MAX_CREATION_LIMIT: 0 DISABLE_HTTP_GIT: false ENABLE_PUSH_CREATE_USER: false ENABLE_PUSH_CREATE_ORG: false DISABLED_REPO_UNITS: repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages,repo.actions,repo.ext_issues,repo.ext_wiki DEFAULT_REPO_UNITS: repo.code,repo.releases DISABLE_MIGRATIONS: true DISABLE_STARS: true DISABLE_FORKS: true DISABLE_DOWNLOAD_SOURCE_ARCHIVES: false DEFAULT_BRANCH: main repository.upload: ENABLED: false indexer: ISSUE_INDEXER_TYPE: db REPO_INDEXER_ENABLED: false git.timeout: GREP: 2 openid: ENABLE_OPENID_SIGNIN: false ENABLE_OPENID_SIGNUP: false api: ENABLE_SWAGGER: false MAX_RESPONSE_ITEMS: 50 DEFAULT_PAGING_NUM: 30 DEFAULT_MAX_BLOB_SIZE: 10485760 packages: ENABLED: false federation: ENABLED: false camo: ENABLED: false mirror: ENABLED: false actions: ENABLED: false cron: ENABLED: false mailer: ENABLED: false email.incoming: ENABLED: false metrics: ENABLED: false other: SHOW_FOOTER_VERSION: false SHOW_FOOTER_TEMPLATE_LOAD_TIME: false ENABLE_SITEMAP: true ENABLE_FEED: true test: enabled: false --- apiVersion: v1 kind: ConfigMap metadata: name: forge-code-values namespace: forgejo-public data: values.yaml: | fullnameOverride: forge-code extraVolumes: - name: internal-ca secret: secretName: forgejo-public-internal-ca - name: private-config emptyDir: {} - name: theme configMap: name: forge-code-theme extraContainerVolumeMounts: - name: internal-ca mountPath: /usr/local/share/ca-certificates readOnly: true - name: private-config mountPath: /data/gitea/conf - name: theme mountPath: /data/gitea/public/assets/css readOnly: true service: http: labels: health.quorate.dev/name: Code topologySpreadConstraints: - maxSkew: 1 topologyKey: kubernetes.io/hostname whenUnsatisfiable: DoNotSchedule labelSelector: matchLabels: app.kubernetes.io/name: forgejo app.kubernetes.io/instance: forge-code gitea: additionalConfigSources: - secret: secretName: forgejo-public-secrets - secret: secretName: forge-code-session config: ui: DEFAULT_THEME: quorate THEMES: quorate,forgejo-auto oauth2: ENABLED: false server: DOMAIN: code.quorate.dev ROOT_URL: https://code.quorate.dev/ session: COOKIE_SECURE: true COOKIE_NAME: forge_code_session DOMAIN: "" SAME_SITE: lax --- apiVersion: v1 kind: ConfigMap metadata: name: forge-git-values namespace: forgejo-public data: values.yaml: | fullnameOverride: forge-git service: http: labels: health.quorate.dev/name: Git ssh: type: LoadBalancer port: 22 externalTrafficPolicy: Local annotations: lbipam.cilium.io/ips: "10.47.201.154" labels: io.cilium/bgp-announce: "true" topologySpreadConstraints: - maxSkew: 1 topologyKey: kubernetes.io/hostname whenUnsatisfiable: DoNotSchedule labelSelector: matchLabels: app.kubernetes.io/name: forgejo app.kubernetes.io/instance: forge-git gitea: oauth: - name: Zitadel provider: openidConnect existingSecret: forge-git-oidc-zitadel autoDiscoverUrl: https://auth.quorate.dev/.well-known/openid-configuration scopes: "openid profile email groups" requiredClaimName: "groups" requiredClaimValue: "forgejo_login" groupClaimName: "groups" adminGroup: "forgejo_admin" restrictedGroup: "forgejo_restricted" additionalConfigSources: - secret: secretName: forgejo-public-secrets - secret: secretName: forge-git-session config: server: DOMAIN: git.quorate.dev ROOT_URL: https://git.quorate.dev/ DISABLE_SSH: false START_SSH_SERVER: true SSH_DOMAIN: git-ssh.quorate.internal SSH_PORT: 22 SSH_LISTEN_PORT: 2222 admin: EXTERNAL_USER_DISABLE_FEATURES: deletion,manage_password oauth2_client: OPENID_CONNECT_SCOPES: "openid profile email groups" ENABLE_AUTO_REGISTRATION: true USERNAME: nickname ACCOUNT_LINKING: disabled UPDATE_AVATAR: false GROUP_CLAIM_NAME: groups ADMIN_GROUP: forgejo_admin ENABLE_OIDC_GROUP_CLAIM: true RE_MANAGE_GROUPS_ON_SIGNIN: true FETCH_USER_INFO_FROM_USERINFO_ENDPOINT: true session: COOKIE_SECURE: true COOKIE_NAME: forge_git_session DOMAIN: "" SAME_SITE: lax