From 891727b487dc12594a76ad20041c56dda5765592 Mon Sep 17 00:00:00 2001 From: "azykov@mail.ru" Date: Sat, 5 Sep 2026 14:40:02 +0300 Subject: [PATCH] gitea --- .gitignore | 3 +- .sops.yaml | 3 + clusters/base/apps/gitea/helmrelease.yaml | 103 +++++++++++++++++++ clusters/base/apps/gitea/helmrepository.yaml | 10 ++ clusters/base/apps/gitea/kustomization.yaml | 7 ++ clusters/base/apps/gitea/pvc.yaml | 12 +++ clusters/base/apps/gitea/secret.enc.yaml | 24 +++++ clusters/base/namespaces/git.yaml | 4 + clusters/home/apps/gitea.yaml | 21 ++++ clusters/home/apps/kustomization.yaml | 3 +- clusters/home/namespaces/kustomization.yaml | 1 + 11 files changed, 189 insertions(+), 2 deletions(-) create mode 100644 clusters/base/apps/gitea/helmrelease.yaml create mode 100644 clusters/base/apps/gitea/helmrepository.yaml create mode 100644 clusters/base/apps/gitea/kustomization.yaml create mode 100644 clusters/base/apps/gitea/pvc.yaml create mode 100644 clusters/base/apps/gitea/secret.enc.yaml create mode 100644 clusters/base/namespaces/git.yaml create mode 100644 clusters/home/apps/gitea.yaml diff --git a/.gitignore b/.gitignore index b74b3d0..0b2f056 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,4 @@ migration-from-old-files/ migration-from-docker/ -.decrypted~secret.enc.yaml \ No newline at end of file +.decrypted~secret.enc.yaml +gitea-backup/ \ No newline at end of file diff --git a/.sops.yaml b/.sops.yaml index 1059dcd..9b0fdfb 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -32,3 +32,6 @@ creation_rules: - path_regex: joplin.*\.enc\.yaml$ encrypted_regex: ^(data|stringData)$ age: age1dertyl956fjsmh00cw468gdnl7lf3frasg4n4c82z0chm6qm2cks6w8gha + - path_regex: gitea.*\.enc\.yaml$ + encrypted_regex: ^(data|stringData)$ + age: age1ktlxm0hukw6jxm62txqy5x2nl8hpdnal8nv00kfhrf3pw33574aqa6j5cj diff --git a/clusters/base/apps/gitea/helmrelease.yaml b/clusters/base/apps/gitea/helmrelease.yaml new file mode 100644 index 0000000..b26c125 --- /dev/null +++ b/clusters/base/apps/gitea/helmrelease.yaml @@ -0,0 +1,103 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: gitea + namespace: git +spec: + interval: 10m + chartRef: + kind: OCIRepository + name: gitea + driftDetection: + mode: enabled + values: + controllers: + app: + # kept at 0 until the migrated data is copied into the gitea-data + # PVC (see migration notes) so the container never gets a chance + # to initialize a fresh, empty instance first. + replicas: 0 + containers: + app: + image: + repository: gitea/gitea + tag: "1.27.0" + env: + USER_UID: "1000" + USER_GID: "1000" + GITEA_APP_INI: /data/conf/app.ini + GITEA__server__DOMAIN: git.aggtaa.com + GITEA__server__ROOT_URL: https://git.aggtaa.com/ + GITEA__security__INTERNAL_TOKEN: + valueFrom: + secretKeyRef: + name: gitea-secrets + key: INTERNAL_TOKEN + GITEA__oauth2__JWT_SECRET: + valueFrom: + secretKeyRef: + name: gitea-secrets + key: OAUTH2_JWT_SECRET + GITEA__server__LFS_JWT_SECRET: + valueFrom: + secretKeyRef: + name: gitea-secrets + key: LFS_JWT_SECRET + probes: + startup: + enabled: true + spec: + periodSeconds: 5 + failureThreshold: 60 + liveness: + enabled: true + readiness: + enabled: true + resources: + requests: + cpu: 50m + memory: 256Mi + limits: + memory: 1Gi + + service: + app: + controller: app + ports: + http: + port: 3000 + ssh: + controller: app + type: LoadBalancer + labels: + loadBalancerPool: default + ports: + ssh: + port: 22 + targetPort: 2222 + protocol: TCP + + ingress: + app: + className: traefik + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + hosts: + - host: git.aggtaa.com + paths: + - path: / + pathType: Prefix + service: + identifier: app + port: http + tls: + - secretName: gitea-tls + hosts: + - git.aggtaa.com + + persistence: + data: + type: persistentVolumeClaim + existingClaim: gitea-data + globalMounts: + - path: /data diff --git a/clusters/base/apps/gitea/helmrepository.yaml b/clusters/base/apps/gitea/helmrepository.yaml new file mode 100644 index 0000000..b2a32fe --- /dev/null +++ b/clusters/base/apps/gitea/helmrepository.yaml @@ -0,0 +1,10 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: OCIRepository +metadata: + name: gitea + namespace: git +spec: + interval: 10m + url: oci://ghcr.io/bjw-s-labs/helm/app-template + ref: + tag: "5.0.1" diff --git a/clusters/base/apps/gitea/kustomization.yaml b/clusters/base/apps/gitea/kustomization.yaml new file mode 100644 index 0000000..4708e8f --- /dev/null +++ b/clusters/base/apps/gitea/kustomization.yaml @@ -0,0 +1,7 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helmrepository.yaml + - secret.enc.yaml + - pvc.yaml + - helmrelease.yaml diff --git a/clusters/base/apps/gitea/pvc.yaml b/clusters/base/apps/gitea/pvc.yaml new file mode 100644 index 0000000..88c101d --- /dev/null +++ b/clusters/base/apps/gitea/pvc.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: gitea-data + namespace: git +spec: + accessModes: + - ReadWriteOnce + storageClassName: longhorn + resources: + requests: + storage: 3Gi diff --git a/clusters/base/apps/gitea/secret.enc.yaml b/clusters/base/apps/gitea/secret.enc.yaml new file mode 100644 index 0000000..f359b51 --- /dev/null +++ b/clusters/base/apps/gitea/secret.enc.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Secret +metadata: + name: gitea-secrets + namespace: git +stringData: + INTERNAL_TOKEN: ENC[AES256_GCM,data:+eS1bjyL/NKvOpkXa1Kiyk9dBPemWvfRplJJCXG+cLXipbMlyHBDQLEMeFEnz9VdnwN/MFRWYL5ink3Lh6yNGf0vmVNR+OLMlvlaKDNaCA28HuUBxJbWLAqhITsRImH6rKcy/EfqEEcK,iv:ModTSwxLMj4Gx0e/bVKY8GVWzBjgNxATKnkWYfvKiIs=,tag:6gFkA/0toCBJ7QKL16654A==,type:str] + OAUTH2_JWT_SECRET: ENC[AES256_GCM,data:9626EzmbEmyAsTqfbRhASqLkzS+4xnJxpSEgJDSLzkjfuNfAq7uMfc/HsA==,iv:lMCRwHt4gT31hYZ5Ywt4GU/DJNj7Fya2GOUkyr/l6ro=,tag:aQ8UlVwpaVNDoOHju1oiMQ==,type:str] + LFS_JWT_SECRET: ENC[AES256_GCM,data:gZ37cb9uqSF1MkdoUFbVM3VhqBxEIyUv3IxiV4c3gbIVTk7FMHncZekM7Q==,iv:m7JxF7S1OnHy86s5s1tJHQ8kqhRJq5kFRoArLL/ab0o=,tag:GZuE7f9pNq15T+R+PlSZdA==,type:str] +sops: + age: + - recipient: age1ktlxm0hukw6jxm62txqy5x2nl8hpdnal8nv00kfhrf3pw33574aqa6j5cj + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRVpZRTVLWU80RjEvZnRs + TU5YVko4V1M5Q0d5SXZGT1h2NStCYk5UZWpRCmNxVXVtR3VCZXJqNHYyaDUyZmdr + WXJKZHhJaFJhZll0VVBld0QrSGhtbncKLS0tIGZZREFXRUMvTi8rRHIyaXBUOE45 + d2JBTG5oT2kvZzdLejMzdEpRbm03QmcKItsS4nKJRu3pRC8xLTf9kYpqFiD9S1tx + BFnJf3IsbGpl1RM8RmkN9O5QsZSq1hbw5pFhlx0XKeH5KgoJInbnog== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-09-05T11:29:22Z" + mac: ENC[AES256_GCM,data:906TL61C7WcxxTAfH3zpXLTLQn2WSIg2RPm0y/6LeVA6pvI6fMbFA32Usvg+EkpWVRGqcm8JPgHy63WQDhq1Ap3imJXpgVDgTgfo64TxJLmdUtCAdm0/CaGxtGeU2J3gm653wl75hOGoCyfBR3iOt0Vo1kUdUxS9B5h3u5L6P6o=,iv:C+CZe31F/AWk0ZqM6lgV248ys/L3mG6S8Tz44b5o628=,tag:C9LdYCtsiHWiHSZWaYCGWA==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.11.0 diff --git a/clusters/base/namespaces/git.yaml b/clusters/base/namespaces/git.yaml new file mode 100644 index 0000000..bc3c829 --- /dev/null +++ b/clusters/base/namespaces/git.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: git diff --git a/clusters/home/apps/gitea.yaml b/clusters/home/apps/gitea.yaml new file mode 100644 index 0000000..281bb4b --- /dev/null +++ b/clusters/home/apps/gitea.yaml @@ -0,0 +1,21 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: gitea + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: flux-system + path: ./clusters/base/apps/gitea + prune: true + wait: true + dependsOn: + - name: namespaces + - name: infra + retryInterval: 5s + decryption: + provider: sops + secretRef: + name: sops-age-gitea diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml index 70a9449..2cb8e53 100644 --- a/clusters/home/apps/kustomization.yaml +++ b/clusters/home/apps/kustomization.yaml @@ -14,4 +14,5 @@ resources: - infcloud.yaml - syncthing.yaml - immich.yaml - - joplin.yaml \ No newline at end of file + - joplin.yaml + - gitea.yaml \ No newline at end of file diff --git a/clusters/home/namespaces/kustomization.yaml b/clusters/home/namespaces/kustomization.yaml index e3bf2ee..159f7b5 100644 --- a/clusters/home/namespaces/kustomization.yaml +++ b/clusters/home/namespaces/kustomization.yaml @@ -16,3 +16,4 @@ resources: - ../../base/namespaces/nfs.yaml - ../../base/namespaces/syncthing.yaml - ../../base/namespaces/photo.yaml + - ../../base/namespaces/git.yaml