apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: woodpecker
  namespace: ci
spec:
  interval: 10m
  chartRef:
    kind: OCIRepository
    name: woodpecker
  driftDetection:
    mode: enabled
  values:
    defaultPodOptions:
      securityContext:
        fsGroup: 1000 # non-root image, fresh longhorn volume is root-owned
        fsGroupChangePolicy: OnRootMismatch

    controllers:
      server:
        replicas: 1
        strategy: Recreate # sqlite on RWO volume
        containers:
          app:
            image:
              repository: woodpeckerci/woodpecker-server
              tag: v3.8.0
            env:
              WOODPECKER_HOST: https://ci.aggtaa.com
              WOODPECKER_OPEN: "false"
              WOODPECKER_ADMIN: anton
              WOODPECKER_GITEA: "true"
              WOODPECKER_GITEA_URL: https://git.aggtaa.com
              WOODPECKER_DATABASE_DRIVER: sqlite3
              WOODPECKER_DATABASE_DATASOURCE: /var/lib/woodpecker/woodpecker.sqlite
            envFrom:
              - secretRef:
                  name: woodpecker-secrets
            resources:
              requests:
                cpu: 50m
                memory: 128Mi
              limits:
                memory: 512Mi
      agent:
        replicas: 1
        serviceAccount:
          name: woodpecker-agent # created in rbac.yaml
        containers:
          app:
            image:
              repository: woodpeckerci/woodpecker-agent
              tag: v3.8.0
            env:
              WOODPECKER_SERVER: woodpecker:9000
              WOODPECKER_BACKEND: kubernetes
              WOODPECKER_BACKEND_K8S_NAMESPACE: ci
              WOODPECKER_BACKEND_K8S_STORAGE_CLASS: longhorn-no-retain
              WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 5G
              WOODPECKER_MAX_WORKFLOWS: "2"
            envFrom:
              - secretRef:
                  name: woodpecker-secrets
            resources:
              requests:
                cpu: 20m
                memory: 64Mi
              limits:
                memory: 256Mi

    service:
      server:
        controller: server
        ports:
          http:
            port: 8000
          grpc:
            port: 9000

    ingress:
      server:
        className: traefik
        annotations:
          cert-manager.io/cluster-issuer: letsencrypt-prod
        hosts:
          - host: ci.aggtaa.com
            paths:
              - path: /
                pathType: Prefix
                service:
                  identifier: server
                  port: http
        tls:
          - secretName: woodpecker-tls
            hosts:
              - ci.aggtaa.com

    persistence:
      data:
        type: persistentVolumeClaim
        existingClaim: woodpecker-data
        advancedMounts:
          server:
            app:
              - path: /var/lib/woodpecker