apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: gitea
  namespace: git
spec:
  interval: 10m
  chartRef:
    kind: OCIRepository
    name: gitea
  driftDetection:
    mode: enabled
  values:
    controllers:
      app:
        replicas: 1
        containers:
          app:
            image:
              repository: gitea/gitea
              tag: "1.27.0"
            env:
              USER_UID: "1000"
              USER_GID: "1000"
              GITEA__server__DOMAIN: git.aggtaa.com
              GITEA__server__ROOT_URL: https://git.aggtaa.com/
              GITEA__server__SSH_DOMAIN: git.aggtaa.com
              GITEA__server__SSH_LISTEN_PORT: "2222"
              GITEA__server__LFS_START_SERVER: "true"
              GITEA__security__INSTALL_LOCK: "true"
              GITEA__security__PASSWORD_HASH_ALGO: pbkdf2
              GITEA__security__INTERNAL_TOKEN:
                valueFrom:
                  secretKeyRef:
                    name: gitea-secrets
                    key: INTERNAL_TOKEN
              GITEA__oauth2__JWT_SECRET:
                valueFrom:
                  secretKeyRef:
                    name: gitea-secrets
                    key: OAUTH2_JWT_SECRET
              GITEA__server__LFS_JWT_SECRET:
                valueFrom:
                  secretKeyRef:
                    name: gitea-secrets
                    key: LFS_JWT_SECRET
            probes:
              startup:
                enabled: true
                spec:
                  periodSeconds: 5
                  failureThreshold: 60
              liveness:
                enabled: true
              readiness:
                enabled: true
            resources:
              requests:
                cpu: 50m
                memory: 256Mi
              limits:
                memory: 1Gi

    service:
      app:
        controller: app
        ports:
          http:
            port: 3000
      ssh:
        controller: app
        type: LoadBalancer
        labels:
          loadBalancerPool: default
        ports:
          ssh:
            port: 22
            targetPort: 2222
            protocol: TCP

    ingress:
      app:
        className: traefik
        annotations:
          cert-manager.io/cluster-issuer: letsencrypt-prod
        hosts:
          - host: git.aggtaa.com
            paths:
              - path: /
                pathType: Prefix
                service:
                  identifier: app
                  port: http
        tls:
          - secretName: gitea-tls
            hosts:
              - git.aggtaa.com

    persistence:
      data:
        type: persistentVolumeClaim
        existingClaim: gitea-data
        globalMounts:
          - path: /data