apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: forgejo
  namespace: forgejo
spec:
  interval: 15m
  releaseName: forgejo
  targetNamespace: forgejo
  chart:
    spec:
      chart: forgejo
      version: 17.3.2
      sourceRef:
        kind: HelmRepository
        name: forgejo
        namespace: flux-system
  install:
    remediation:
      retries: 3
  upgrade:
    remediation:
      retries: 3
  # Chart merges deployment.labels into spec.selector (immutable). Pod-only label.
  postRenderers:
    - kustomize:
        patches:
          - target:
              kind: Deployment
              name: forgejo
            patch: |-
              - op: add
                path: /spec/template/metadata/labels/gateway.quorate.internal~1allow-gateway-client
                value: "true"
              - op: add
                path: /spec/template/metadata/labels/quorate.dev~1zitadel-relay
                value: "true"
  values:
    image:
      registry: code.forgejo.org
      repository: forgejo/forgejo
      tag: 17.0.1
      digest: sha256:5ef02fbcf22beef56b8c844952ffad58cfe177b6f98e46e6abb5df90b88dc8d3
      rootless: true
    replicaCount: 2
    strategy:
      type: RollingUpdate
      rollingUpdate:
        maxUnavailable: 0
        maxSurge: 1
    minReadySeconds: 5
    topologySpreadConstraints:
      - maxSkew: 1
        topologyKey: kubernetes.io/hostname
        whenUnsatisfiable: DoNotSchedule
        labelSelector:
          matchLabels:
            app.kubernetes.io/name: forgejo
            app.kubernetes.io/instance: forgejo
    initPreScript: |
      mkdir -p /data/gitea/log
      chmod ug+rwx /data/gitea/log
    serviceAccount:
      create: false
      name: forgejo
    podSecurityContext:
      fsGroup: 1000
    containerSecurityContext:
      allowPrivilegeEscalation: false
      privileged: false
      readOnlyRootFilesystem: true
      runAsNonRoot: true
      runAsUser: 1000
      runAsGroup: 1000
      capabilities:
        drop:
          - ALL
        add:
          - SYS_CHROOT
    deployment:
      env:
        # Forgejo MinIO uses Go http.Transport; SSL_CERT_DIR is reliable for custom CAs.
        - name: SSL_CERT_DIR
          value: /usr/local/share/ca-certificates
    extraVolumes:
      - name: internal-ca
        secret:
          secretName: forgejo-internal-ca
    extraContainerVolumeMounts:
      - name: internal-ca
        mountPath: /usr/local/share/ca-certificates
        readOnly: true
    service:
      http:
        type: ClusterIP
        port: 3000
      ssh:
        type: LoadBalancer
        port: 22
        externalTrafficPolicy: Local
        annotations:
          lbipam.cilium.io/ips: "10.190.165.53"
        labels:
          io.cilium/bgp-announce: "true"
    persistence:
      enabled: true
      create: false
      claimName: forgejo-shared-storage-rwx
      size: 20Gi
      accessModes:
        - ReadWriteMany
      storageClass: longhorn-rwx
    resources:
      requests:
        cpu: 250m
        memory: 512Mi
      limits:
        memory: 2Gi
    gitea:
      admin:
        existingSecret: ""
        username: ""
      oauth:
        - name: Zitadel
          provider: openidConnect
          existingSecret: forgejo-oidc-zitadel
          autoDiscoverUrl: https://auth.quorate.dev/.well-known/openid-configuration
          scopes: "openid profile email groups"
          requiredClaimName: "groups"
          requiredClaimValue: "forgejo_login"
          groupClaimName: "groups"
          adminGroup: "forgejo_admin"
          restrictedGroup: "forgejo_restricted"
      additionalConfigSources:
        - secret:
            secretName: forgejo-secrets
      additionalConfigFromEnvs:
        - name: FORGEJO__DATABASE__PASSWD
          valueFrom:
            secretKeyRef:
              name: forgejo-db
              key: password
      config:
        APP_NAME: "Quorate Forge"
        log:
          LEVEL: info
          LOGGER_ROUTER_MODE: console
          ROOT_PATH: /data/gitea/log
        server:
          DOMAIN: forge.quorate.internal
          ROOT_URL: https://forge.quorate.internal/
          PROTOCOL: http
          HTTP_PORT: 3000
          SSH_DOMAIN: forge-ssh.quorate.internal
          SSH_PORT: 22
          SSH_LISTEN_PORT: 2222
          LFS_START_SERVER: false
        database:
          DB_TYPE: postgres
          HOST: main-rw.postgres.svc.cluster.local:5432
          NAME: forgejo
          USER: forgejo
          SSL_MODE: require
        openid:
          ENABLE_OPENID_SIGNIN: false
          ENABLE_OPENID_SIGNUP: false
        oauth2_client:
          OPENID_CONNECT_SCOPES: "openid profile email groups"
          ENABLE_AUTO_REGISTRATION: true
          USERNAME: nickname
          ACCOUNT_LINKING: disabled
          UPDATE_AVATAR: true
          GROUP_CLAIM_NAME: "groups"
          ADMIN_GROUP: "forgejo_admin"
          ENABLE_OIDC_GROUP_CLAIM: true
          RE_MANAGE_GROUPS_ON_SIGNIN: true
          FETCH_USER_INFO_FROM_USERINFO_ENDPOINT: true
        service:
          DISABLE_REGISTRATION: false
          ALLOW_ONLY_EXTERNAL_REGISTRATION: true
          REQUIRE_SIGNIN_VIEW: true
          SHOW_REGISTRATION_BUTTON: false
          ENABLE_INTERNAL_SIGNIN: false
        repository:
          ROOT: /data/git/repositories
          DISABLED_REPO_UNITS: "repo.issues,repo.pulls,repo.wiki,repo.projects,repo.packages,repo.actions,repo.ext_issues,repo.ext_wiki"
          DEFAULT_REPO_UNITS: "repo.code,repo.releases"
          DISABLE_MIGRATIONS: true
        indexer:
          REPO_INDEXER_ENABLED: false
        cron:
          ENABLED: false
        mirror:
          ENABLED: false
        actions:
          ENABLED: false
        metrics:
          ENABLED: false
    test:
      enabled: false