feat: Add Gitea

2026-01-22 12:31:52 +01:00
parent 0801c0c6c7
commit ad258bf3fe
11 changed files with 72 additions and 61 deletions
@@ -0,0 +1,3 @@
+gitea:
+  enabled: true
+  backup: true
@@ -0,0 +1,5 @@
+gitea:
+  enabled: false
+  backup: false
+  autosync: {{ if eq .Environment.Name "prod" }} false {{ else }} true {{ end }}
+  env: {{ .Environment.Name }}
@@ -0,0 +1,33 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: hel-store
+  namespace: gitea
+spec:
+  retentionPolicy: "7d"
+  configuration:
+    destinationPath: s3://obx-cnpg/hel1/gitea-db
+    endpointURL: https://hel1.your-objectstorage.com
+    s3Credentials:
+      accessKeyId:
+        name: cnpg-s3
+        key: access_key
+      secretAccessKey:
+        name: cnpg-s3
+        key: access_secret
+    wal:
+      compression: snappy
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: gitea-db
+  namespace: gitea
+spec:
+  schedule: "0 0 1 * * *"
+  backupOwnerReference: self
+  cluster:
+    name: gitea-db
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io
@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: gitea-db
+  namespace: gitea
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:18-system-trixie
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi
@@ -0,0 +1,25 @@
+apiVersion: dragonflydb.io/v1alpha1
+kind: Dragonfly
+metadata:
+  name: dragonfly-gitea
+  namespace: gitea
+spec:
+  replicas: 1
+  resources:
+    requests:
+      cpu: 150m
+      memory: 256Mi
+    limits:
+      memory: 256Mi
+  args:
+    - --dbfilename=dump           # Static filename prevents disk exhaustion
+    - --maxmemory=$(MAX_MEMORY)Mi # Graceful memory management (90% of limit)
+    - --proactor_threads=1 # Auto-detect CPU cores (optimal threading)
+    - --cluster_mode=emulated
+    - --logtostderr
+  env:
+    - name: MAX_MEMORY
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+          divisor: 1Mi
@@ -0,0 +1,42 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gitea
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: gitea
+    server: https://kubernetes.default.svc
+  project: sys
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfile.d
+    plugin:
+      name: helmfile-cmp
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: {{ .Values.gitea.env }}
+      - name: HELMFILE_FILE_PATH
+        value: gitea.yaml.gotmpl
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      # - ServerSideApply=true
+    {{- if .Values.gitea.autosync }}
+    automated:
+      prune: true
+      # selfHeal: false
+    {{- end }}
+{{- end }}
@@ -0,0 +1,11 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: gitea-db-monitor
+  namespace: gitea
+spec:
+  selector:
+    matchLabels:
+      cnpg.io/cluster: gitea-db
+  podMetricsEndpoints:
+    - port: metrics
@@ -0,0 +1,147 @@
+replicaCount: 1
+image:
+  registry: "docker.gitea.com"
+  repository: gitea
+
+resources:
+  requests:
+    cpu: 200m
+    memory: 512Mi
+
+strategy:
+  type: Recreate
+  rollingUpdate:
+    maxSurge: "100%"
+    maxUnavailable: 0
+
+gitea:
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+  config:
+    APP_NAME: 'Gitea: With a cup of tea.'
+    cache:
+      ENABLED: true
+      ADAPTER: redis
+      HOST: redis://dragonfly-gitea.gitea.svc:6379/0
+      ITEM_TTL: "72h" # increased from default 16h
+    session:
+      PROVIDER: redis
+      PROVIDER_CONFIG: redis://dragonfly-gitea.gitea.svc:6379/1
+    queue:
+      TYPE: redis
+      CONN_STR: redis://dragonfly-gitea.gitea.svc:6379/2
+    storage:
+      STORAGE_TYPE: minio
+      MINIO_ENDPOINT: hel1.your-objectstorage.com
+      MINIO_USE_SSL: true
+      MINIO_LOCATION: hel1
+      MINIO_BUCKET: obx-gitea
+    security:
+      INSTALL_LOCK: true
+    service:
+      DISABLE_REGISTRATION: false
+    server:
+      APP_DATA_PATH: "/data/gitea"
+      DOMAIN: git.svc.hel1.obx
+      ROOT_URL: https://git.svc.hel1.obx
+      SSH_DOMAIN: git.svc.hel1.obx
+      SSH_PORT: 22
+      SSH_SERVER_USE_PROXY_PROTOCOL: true
+      LANDING_PAGE: "explore"
+    oauth2_client:
+      REGISTER_EMAIL_CONFIRM: false;
+      ENABLE_AUTO_REGISTRATION: true
+      UPDATE_AVATAR: true
+      ACCOUNT_LINKING: auto
+    database:
+      DB_TYPE: postgres
+      MAX_OPEN_CONNS: 90
+    openid:
+      ENABLE_OPENID_SIGNIN: false
+      ENABLE_OPENID_SIGNUP: false
+  oauth:
+    - name: 'Oceanbox'
+      provider: 'openidConnect'
+      existingSecret: gitea-oauth-oceanbox
+      autoDiscoverUrl: 'https://login.microsoftonline.com/3f737008-e9a0-4485-9d27-40329d288089/.well-known/openid-configuration'
+      scopes: 'openid profile email groups'
+      groupClaimName: 'groups'
+      adminGroup: '/oceanbox/devel'
+      restrictedGroup: ''
+  additionalConfigFromEnvs:
+    - name: GITEA__STORAGE__MINIO_ACCESS_KEY_ID
+      valueFrom:
+        secretKeyRef:
+          name: gitea-s3
+          key: access_key
+    - name: GITEA__STORAGE__MINIO_SECRET_ACCESS_KEY
+      valueFrom:
+        secretKeyRef:
+          name: gitea-s3
+          key: secret_key
+    - name: GITEA__DATABASE__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: gitea-db-app
+          key: password
+    - name: GITEA__DATABASE__NAME
+      valueFrom:
+        secretKeyRef:
+          name: gitea-db-app
+          key: dbname
+    - name: GITEA__DATABASE__USER
+      valueFrom:
+        secretKeyRef:
+          name: gitea-db-app
+          key: user
+    - name: GITEA__DATABASE__HOST
+      valueFrom:
+        secretKeyRef:
+          name: gitea-db-app
+          key: host
+    - name: GITEA__DATABASE__DB_TYPE
+      value: postgres
+
+ingress:
+  enabled: true
+  className: nginx
+  annotations:
+    cert-manager.io/cluster-issuer: ca-issuer
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: "0"
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/whitelist-source-range: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12
+  hosts:
+    - host: git.svc.hel1.obx
+      paths:
+      - backend:
+          service:
+            name: gitea-http
+            port:
+              number: 3000
+        path: /
+        pathType: ImplementationSpecific
+  tls:
+    - secretName: gitea-tls
+      hosts:
+        - git.svc.hel1.obx
+
+# service:
+  # ssh:
+    # type: LoadBalancer
+    # port: 22
+    # annotations:
+      # load-balancer.hetzner.cloud/location: hel1
+      # load-balancer.hetzner.cloud/uses-proxyprotocol: 'false'
+
+postgresql-ha:
+  enabled: false
+valkey-cluster:
+  enabled: false
+
+persistence:
+  enabled: true
+  size: 1Gi