From 2942a2c21bb6f0b07c83802f2bb33e0d37b9f8d2 Mon Sep 17 00:00:00 2001
From: Nathan Rashleigh <ntr@ntwl.xyz>
Date: Sat, 3 Oct 2026 13:32:31 +1000
Subject: [PATCH] gitea 28

---
 ops/git.yaml | 88 ++++++++++++++--------------------------------------
 1 file changed, 23 insertions(+), 65 deletions(-)

diff --git a/ops/git.yaml b/ops/git.yaml
index c0aa77f..f8959d5 100644
--- a/ops/git.yaml
+++ b/ops/git.yaml
@@ -1,29 +1,5 @@
 ---
 
-# gitea-admin-secret: sealed with kubeseal. Encrypted, safe to commit.
-# Rotate: recreate plaintext secret + re-seal, e.g.
-#   kubectl -n ops create secret generic gitea-admin-secret \
-#     --from-literal=username=ntr --from-literal=password="$NEWPW" \
-#     --from-literal=email=ntr@strix.systems --dry-run=client -o yaml | \
-#   kubeseal --controller-name sealed-secrets-controller \
-#     --controller-namespace kube-system --format yaml
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: gitea-admin-secret
-  namespace: ops
-spec:
-  encryptedData:
-    email: AgCCwKb/cTRNKgtg7gPwId5rVYzf++0BDWA8miOcfAFciSWX1hSXFL7LGe52Ln2UpYD7BRZkkGq2Rz53XM+irSKFnD0K+F8/+S2wu4Nxk2GbwBEHbANd3ATnxxdBsqRrEYZFHy5X29sFIF1Kp+p7UwJhudZVMjuSlJ9awXri+XR3te/Fmpa/kT5SF7gc9DQPrNsH3UaTVBhxJ1nFNKShdSTVLC8/fD5RgxMPxwexx3ny7a9YJxQh97Te8ZrR24ZceccY+lmbxadsqqth8KjeqAdUkH/LSkIelRr9v4xbKnV5oGwOKjRDF4tZxgoLmkHvoP97tp9b0/aEEyRU78Zz5aMRwWNsY78O4/ufudUIyUctctgNZ4x6N1QSHHFFGcAB12e15jP+5TgZj9RUov2B6NSIab2XJU4pm4H65OGsX9osHIGou5lRMZvRi/SZlkbtkzx3OwMfc5TSw7aRQ6fSiYagsxWmKJWVs+OFjI/b9ee436/C63u1yilWFT7VHoJzRGck35DWk4xvatOb77inJBwLahruDXBGD2BB4hGVRB7cNJ+aAavEgBVvPstN9ssD3TNwVPQxL7CQiDrt9sj5Og4FDl1F+F2UNfP4RrNYHIQFZeFDQwrKXRkzeCA76sYE6ee8RvurHDiia2HoF9RL3cx0EqDiuqAKBpbzFSdSCcCWWvsvx0ICbialykyB8dTn/Mktzu0+3hf5FiV/seI=
-    password: AgAytYm5H0dVZUrvE2Ag8WrkWVMeGHJ/I6g85kFUIxMXKDi2Hnz0MuyTizCUovJVT3ab9CAgUOlP2JbIrbO8PnXhdlVgHWcSxq+5K32dMuUjZL7582bRo9buC+7BBxrBDk8/L/CcvfvP4Dow1KFzxI7jFuOz8LzuGgtzGgl5bowxskcAibAMSXR3EN3UGLGIticjiuKNZJRFwt9AD/nn1ZOH/HLX/QiFY7Cv53/IIBFQvUSEtRzlzCKAn7WjMHx9hGgo050j97mNgs1uQp9vGeW8OAIaPidzOsPL2ISW6TGOpf6mSx1BsENkwbNsVJ2avFCi3yBGH26cOEWJBSnwBsmfcnSJbuQZFBBKARRaRMpXSm5qxMsjfbHUFHKtCnazb/xM/e52CFkbZl0M4jo2EHTlPFH8D+Oqo0b+Y43pMaFojaYx+mCnFImgl+3ArD+oMpazfzGlz6BQ2NetpNC8uy5AtP+8k75ZbUU+ZSiZPttyqQ/6PPCxC9H1UB0KEuWiTFQuiLoC1qeLR5+FDMgEsXPZCFu2hi/0WNXlQ+KHtlf5g3z3o0lz8YMHNAMDgArKRG3YPDQgT1iravTKlyduOu1GzIAGU+af30OO6NDSIFkdSu1PA9j4qTVNjdpgDu+OR5k5bOlJPqYVoVsZugkLAsILeIO6l9rygeJzTjG791RovaeeF7zaVGV/FsKtBD0hsa9Kg3WwI3+1IYnS3OPWPKxKiD5sHd9m
-    username: AgBLWJhYYenlLJQyyOFjibScElVtwT006b6QLTde1TZlLjqrLdw1PsH7rWAWfsCHbZJzRo/nWxIxiYWMAMQNTxco1wghBbalxWQsyhcreEPRgQJxRDKRf/+7gRVophUgrJ6Ej3EwDNGnEtdtCw+QIedXvCQtlt5MNzch+S/mxylhZF9CswpPDOEnoqbM5RELu8LUuYiThD5NNKFah4j/c92CZFVbtZzprUOLphUVWzGDde6krmJZpDhDSl4VwVbjPU700C0qrsJhGZlwDlXTwDXMH552X6qCh+GHeh1Ig6ll7npQSMlwFWsYyz0dRMYXkaASdrh4arhukzkTmjHXDtgIoiXqEdhjayZ0oIcSVgyzX0dK62wxWtYITPhREJkKSrLPs0vrz480qNiZ69gXKZiBSernyvwZ0w5oxlkMfMRQyUHUcpzfG1z94w9gh5GDvHS6r1hHH3Hndtt7owGbCtOtySUsrdeEiNG95uvI44vqpFc8RAzspYZ9HsiQnTu0Xg3hM40YRiAyFr4n/He0SMf1FQE7F4dPEv5zPK4/swAfq/n2DzpQDr/vhCnL+2y7VVG/pp+1Ox6qm5nhS0xmnlwDqkgFfTbUPPyvwY+oOBo0EDAYEY9a1CitlSD176FJomL4BP3KWB1OqgWpH3YwWBnI3QMKXKWd44Mt4Wh3ihJLhpzfLJQeBIhH1tu8ca4/hvs+pNA=
-  template:
-    metadata:
-      name: gitea-admin-secret
-      namespace: ops
-
----
-
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
@@ -39,36 +15,6 @@ spec:
 
 ---
 
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: gitea-redis
-  namespace: ops
-spec:
-  storageClassName: fast
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 4Gi
-
----
-
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: gitea-pg
-  namespace: ops
-spec:
-  storageClassName: fast
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 4Gi
-
----
-
 apiVersion: helm.cattle.io/v1
 kind: HelmChart
 metadata:
@@ -77,9 +23,13 @@ metadata:
 spec:
   repo: https://dl.gitea.com/charts/
   chart: gitea
+  version: 12.7.0
   targetNamespace: ops
   valuesContent: |-
 
+    image:
+      tag: "28.0.0"
+
     ingress:
       enabled: true
       className: haproxy
@@ -106,27 +56,33 @@ spec:
         port: 60022
         externalTrafficPolicy: Local
 
-    redis-cluster:
+    valkey-cluster:
       enabled: false
 
-    redis:
+    valkey:
       enabled: true
-      persistence:
-        enabled: true
-        existingClaim: gitea-redis
+      architecture: standalone
+      primary:
+        persistence:
+          enabled: true
+          storageClass: zfs-fast
+          size: 8Gi
 
     postgresql:
       enabled: true
-      persistence:
-        enabled: true
-        existingClaim: gitea-pg
+      primary:
+        persistence:
+          enabled: true
+          storageClass: zfs-fast
+          size: 10Gi
 
     postgresql-ha:
       enabled: false
 
     persistence:
       enabled: true
-      existingClaim: gitea-data
+      create: false
+      claimName: gitea-data
 
     gitea:
       config:
@@ -135,10 +91,12 @@ spec:
         indexer:
           ISSUE_INDEXER_TYPE: bleve
           REPO_INDEXER_ENABLED: true
+        audit:
+          RECORD_OUTPUT: database
+          RETENTION_DAYS: 120
         server:
           SSH_PORT: 60022
-          # Git LFS over pure SSH (no HTTP). LFS_ALLOW_PURE_SSH needs Gitea >= 1.21.
           LFS_START_SERVER: true
           LFS_ALLOW_PURE_SSH: true
       admin:
-        existingSecret: gitea-admin-secret
\ No newline at end of file
+        existingSecret: gitea-admin-secret