argocd-apps/apps/overlays/au-syd1/gitea/values.yaml

# Gitea helm-gitea chart 12.6.0 (appVersion 1.26.1), app pinned to 1.26.2 to
# match the VM being replaced. HA-shaped: 2 replicas on shared RWX CephFS, with
# Postgres (CNPG), cache/session/queue (Valkey), and OIDC all externalised —
# exactly the shape the chart's docs/ha-setup.md requires for replicaCount > 1.
replicaCount: 2

image:
  registry: docker.io
  repository: gitea/gitea
  tag: "1.26.2"       # chart appends "-rootless" because rootless: true below
  rootless: true
  pullPolicy: IfNotPresent

# All bundled stateful subcharts OFF — we run CNPG Postgres + standalone Valkey.
postgresql-ha:
  enabled: false
postgresql:
  enabled: false
valkey-cluster:
  enabled: false
valkey:
  enabled: false

# Shared repo/LFS/attachment storage. RWX is mandatory for >1 replica so every
# pod sees the same /data (repos, lfs, avatars, attachments).
persistence:
  enabled: true
  create: true
  mount: true
  accessModes:
    - ReadWriteMany
  storageClass: cephfs-raid6-delete
  size: 20Gi

service:
  http:
    type: ClusterIP
    port: 3000
  # git-over-ssh is disabled — HTTPS clones only (the estate norm). DISABLE_SSH
  # below stops the in-pod SSH server; the chart still renders a gitea-ssh
  # Service, which the overlay kustomization $patch-deletes.
  ssh:
    type: ClusterIP
    port: 22

# Gateway API (HTTPRoute in the base) fronts HTTP; the chart Ingress is unused.
ingress:
  enabled: false

# Rolling replicas on slow shared storage: keep one old pod up and give new pods
# generous startup headroom so migrations on boot don't trip the probes.
strategy:
  type: RollingUpdate
  rollingUpdate:
    maxSurge: "100%"
    maxUnavailable: 0

resources:
  requests:
    cpu: "500m"
    memory: 512Mi
  limits:
    cpu: "2"
    memory: 2Gi

# Trust the internal unkin.net CA that signs identity.unkin.net's cert. Gitea is
# Go, so SSL_CERT_DIR adds the mounted vault-ca-cert to the system trust pool
# (additive — public roots stay via the default bundle). Needed for the OIDC
# discovery/JWKS fetch at login.
deployment:
  env:
    - name: SSL_CERT_DIR
      value: /etc/gitea/tls-ca
extraVolumes:
  - name: vault-ca-cert
    secret:
      secretName: vault-ca-cert
      items:
        - key: ca.crt
          path: ca.crt
extraContainerVolumeMounts:
  - name: vault-ca-cert
    mountPath: /etc/gitea/tls-ca
    readOnly: true
extraInitVolumeMounts:
  - name: vault-ca-cert
    mountPath: /etc/gitea/tls-ca
    readOnly: true

gitea:
  # Local admin fallback (survives the OIDC cutover). Secret keys: username,
  # password. Seeded in Vault -> synced to the gitea-admin Secret by VSO.
  admin:
    existingSecret: gitea-admin
    email: "benvin@unkin.net"
    passwordMode: keepUpdated

  # DB password (and Gitea internal secrets) injected as env from VSO Secrets,
  # never rendered into app.ini in git. GITEA__<section>__<KEY> maps to app.ini.
  additionalConfigFromEnvs:
    - name: GITEA__database__PASSWD
      valueFrom:
        secretKeyRef:
          name: postgres-credentials
          key: password
    - name: GITEA__security__SECRET_KEY
      valueFrom:
        secretKeyRef:
          name: gitea-inner
          key: SECRET_KEY
    - name: GITEA__security__INTERNAL_TOKEN
      valueFrom:
        secretKeyRef:
          name: gitea-inner
          key: INTERNAL_TOKEN

  # Authentik OIDC login source, registered declaratively on boot. existingSecret
  # must carry keys `key` (client id) and `secret` (client secret) — seeded at the
  # same Vault path terraform-authentik reads client_secret from.
  oauth:
    - name: "authentik"
      provider: "openidConnect"
      existingSecret: oauth-credentials
      autoDiscoverUrl: "https://identity.unkin.net/application/o/gitea/.well-known/openid-configuration"

  config:
    server:
      DOMAIN: git.k8s.syd1.au.unkin.net
      ROOT_URL: https://git.k8s.syd1.au.unkin.net/
      SSH_DOMAIN: git.k8s.syd1.au.unkin.net
      DISABLE_SSH: true
      START_SSH_SERVER: false
      LFS_START_SERVER: true

    database:
      DB_TYPE: postgres
      HOST: gitea-postgres-pooler-rw:5432
      NAME: gitea
      USER: gitea
      SSL_MODE: disable

    # Standalone Valkey: session on db 0, cache on db 1, queue on db 2.
    session:
      PROVIDER: redis
      PROVIDER_CONFIG: "redis://gitea-valkey:6379/0"
    cache:
      ENABLED: true
      ADAPTER: redis
      HOST: "redis://gitea-valkey:6379/1"
    queue:
      TYPE: redis
      CONN_STR: "redis://gitea-valkey:6379/2"

    # DB-backed issue indexer is replica-safe on shared storage (matches the VM);
    # avoids the on-disk bleve indexer that HA can't share.
    indexer:
      ISSUE_INDEXER_TYPE: db
      REPO_INDEXER_ENABLED: false

    # CI stays on Woodpecker — Gitea Actions disabled.
    actions:
      ENABLED: false

    # Router + NCSA access logs to stdout so the Tier-2 vector gitea pipeline can
    # parse method/path/status/latency/user (subject logs.k8s.gitea.*).
    log:
      LEVEL: Info
      MODE: console
      ROUTER: console
      ENABLE_ACCESS_LOG: true
      ACCESS: console

    repository:
      DEFAULT_BRANCH: main
      DEFAULT_PRIVATE: last

    # OIDC auto-registration + account linking so existing local users (benvin,
    # bots) link to their Authentik identity by matching username on first login.
    service:
      ENABLE_AUTO_REGISTRATION: true
    oauth2_client:
      ENABLE_AUTO_REGISTRATION: true
      ACCOUNT_LINKING: auto
      USERNAME: preferred_username
      UPDATE_AVATAR: true

  # Startup headroom for migrations on RWX storage across a rolling update.
  startupProbe:
    enabled: true
  livenessProbe:
    enabled: true
  readinessProbe:
    enabled: true