From 1ea0dc920c2a82a4ad1ddb7f1035461361360026 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Thu, 30 Jul 2026 21:41:51 +1000
Subject: [PATCH] Point Gitea OIDC at canonical identity.unkin.net and trust
 the internal CA

identity.unkin.net is now the canonical Authentik host. Gitea reaches it for
OIDC discovery/JWKS over TLS served by the internal unkin.net CA, which the
rootless image doesn't trust.

- Flip the authentik login source autoDiscoverUrl to identity.unkin.net.
- Mount the reflected vault-ca-cert and add it to Gitea's Go trust pool via
  SSL_CERT_DIR (additive; public roots stay intact).

Claude-Session: https://claude.ai/code/session_015ur3i7D2azsMAWTSVABApv
Signed-off-by: Ben Vincent <ben@unkin.net>
---
 apps/overlays/au-syd1/gitea/values.yaml | 26 ++++++++++++++++++++++++-
 1 file changed, 25 insertions(+), 1 deletion(-)

diff --git a/apps/overlays/au-syd1/gitea/values.yaml b/apps/overlays/au-syd1/gitea/values.yaml
index 0157d8a..c035b5c 100644
--- a/apps/overlays/au-syd1/gitea/values.yaml
+++ b/apps/overlays/au-syd1/gitea/values.yaml
@@ -71,6 +71,30 @@ resources:
     cpu: "2"
     memory: 2Gi
 
+# Trust the internal unkin.net CA that signs identity.unkin.net's cert. Gitea is
+# Go, so SSL_CERT_DIR adds the mounted vault-ca-cert to the system trust pool
+# (additive — public roots stay via the default bundle). Needed for the OIDC
+# discovery/JWKS fetch at login.
+deployment:
+  env:
+    - name: SSL_CERT_DIR
+      value: /etc/gitea/tls-ca
+extraVolumes:
+  - name: vault-ca-cert
+    secret:
+      secretName: vault-ca-cert
+      items:
+        - key: ca.crt
+          path: ca.crt
+extraContainerVolumeMounts:
+  - name: vault-ca-cert
+    mountPath: /etc/gitea/tls-ca
+    readOnly: true
+extraInitVolumeMounts:
+  - name: vault-ca-cert
+    mountPath: /etc/gitea/tls-ca
+    readOnly: true
+
 gitea:
   # Local admin fallback (survives the OIDC cutover). Secret keys: username,
   # password. Seeded in Vault -> synced to the gitea-admin Secret by VSO.
@@ -105,7 +129,7 @@ gitea:
     - name: "authentik"
       provider: "openidConnect"
       existingSecret: oauth-credentials
-      autoDiscoverUrl: "https://identity.k8s.syd1.au.unkin.net/application/o/gitea/.well-known/openid-configuration"
+      autoDiscoverUrl: "https://identity.unkin.net/application/o/gitea/.well-known/openid-configuration"
 
   config:
     server: