---

# gitea-admin-secret: sealed with kubeseal. Encrypted, safe to commit.
# Rotate: recreate plaintext secret + re-seal, e.g.
#   kubectl -n ops create secret generic gitea-admin-secret \
#     --from-literal=username=ntr --from-literal=password="$NEWPW" \
#     --from-literal=email=ntr@strix.systems --dry-run=client -o yaml | \
#   kubeseal --controller-name sealed-secrets-controller \
#     --controller-namespace kube-system --format yaml
apiVersion: bitnami.com/v1alpha1
kind: SealedSecret
metadata:
  name: gitea-admin-secret
  namespace: ops
spec:
  encryptedData:
    email: AgCCwKb/cTRNKgtg7gPwId5rVYzf++0BDWA8miOcfAFciSWX1hSXFL7LGe52Ln2UpYD7BRZkkGq2Rz53XM+irSKFnD0K+F8/+S2wu4Nxk2GbwBEHbANd3ATnxxdBsqRrEYZFHy5X29sFIF1Kp+p7UwJhudZVMjuSlJ9awXri+XR3te/Fmpa/kT5SF7gc9DQPrNsH3UaTVBhxJ1nFNKShdSTVLC8/fD5RgxMPxwexx3ny7a9YJxQh97Te8ZrR24ZceccY+lmbxadsqqth8KjeqAdUkH/LSkIelRr9v4xbKnV5oGwOKjRDF4tZxgoLmkHvoP97tp9b0/aEEyRU78Zz5aMRwWNsY78O4/ufudUIyUctctgNZ4x6N1QSHHFFGcAB12e15jP+5TgZj9RUov2B6NSIab2XJU4pm4H65OGsX9osHIGou5lRMZvRi/SZlkbtkzx3OwMfc5TSw7aRQ6fSiYagsxWmKJWVs+OFjI/b9ee436/C63u1yilWFT7VHoJzRGck35DWk4xvatOb77inJBwLahruDXBGD2BB4hGVRB7cNJ+aAavEgBVvPstN9ssD3TNwVPQxL7CQiDrt9sj5Og4FDl1F+F2UNfP4RrNYHIQFZeFDQwrKXRkzeCA76sYE6ee8RvurHDiia2HoF9RL3cx0EqDiuqAKBpbzFSdSCcCWWvsvx0ICbialykyB8dTn/Mktzu0+3hf5FiV/seI=
    password: AgAytYm5H0dVZUrvE2Ag8WrkWVMeGHJ/I6g85kFUIxMXKDi2Hnz0MuyTizCUovJVT3ab9CAgUOlP2JbIrbO8PnXhdlVgHWcSxq+5K32dMuUjZL7582bRo9buC+7BBxrBDk8/L/CcvfvP4Dow1KFzxI7jFuOz8LzuGgtzGgl5bowxskcAibAMSXR3EN3UGLGIticjiuKNZJRFwt9AD/nn1ZOH/HLX/QiFY7Cv53/IIBFQvUSEtRzlzCKAn7WjMHx9hGgo050j97mNgs1uQp9vGeW8OAIaPidzOsPL2ISW6TGOpf6mSx1BsENkwbNsVJ2avFCi3yBGH26cOEWJBSnwBsmfcnSJbuQZFBBKARRaRMpXSm5qxMsjfbHUFHKtCnazb/xM/e52CFkbZl0M4jo2EHTlPFH8D+Oqo0b+Y43pMaFojaYx+mCnFImgl+3ArD+oMpazfzGlz6BQ2NetpNC8uy5AtP+8k75ZbUU+ZSiZPttyqQ/6PPCxC9H1UB0KEuWiTFQuiLoC1qeLR5+FDMgEsXPZCFu2hi/0WNXlQ+KHtlf5g3z3o0lz8YMHNAMDgArKRG3YPDQgT1iravTKlyduOu1GzIAGU+af30OO6NDSIFkdSu1PA9j4qTVNjdpgDu+OR5k5bOlJPqYVoVsZugkLAsILeIO6l9rygeJzTjG791RovaeeF7zaVGV/FsKtBD0hsa9Kg3WwI3+1IYnS3OPWPKxKiD5sHd9m
    username: AgBLWJhYYenlLJQyyOFjibScElVtwT006b6QLTde1TZlLjqrLdw1PsH7rWAWfsCHbZJzRo/nWxIxiYWMAMQNTxco1wghBbalxWQsyhcreEPRgQJxRDKRf/+7gRVophUgrJ6Ej3EwDNGnEtdtCw+QIedXvCQtlt5MNzch+S/mxylhZF9CswpPDOEnoqbM5RELu8LUuYiThD5NNKFah4j/c92CZFVbtZzprUOLphUVWzGDde6krmJZpDhDSl4VwVbjPU700C0qrsJhGZlwDlXTwDXMH552X6qCh+GHeh1Ig6ll7npQSMlwFWsYyz0dRMYXkaASdrh4arhukzkTmjHXDtgIoiXqEdhjayZ0oIcSVgyzX0dK62wxWtYITPhREJkKSrLPs0vrz480qNiZ69gXKZiBSernyvwZ0w5oxlkMfMRQyUHUcpzfG1z94w9gh5GDvHS6r1hHH3Hndtt7owGbCtOtySUsrdeEiNG95uvI44vqpFc8RAzspYZ9HsiQnTu0Xg3hM40YRiAyFr4n/He0SMf1FQE7F4dPEv5zPK4/swAfq/n2DzpQDr/vhCnL+2y7VVG/pp+1Ox6qm5nhS0xmnlwDqkgFfTbUPPyvwY+oOBo0EDAYEY9a1CitlSD176FJomL4BP3KWB1OqgWpH3YwWBnI3QMKXKWd44Mt4Wh3ihJLhpzfLJQeBIhH1tu8ca4/hvs+pNA=
  template:
    metadata:
      name: gitea-admin-secret
      namespace: ops

---

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: gitea-data
  namespace: ops
spec:
  storageClassName: fast
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 20Gi

---

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: gitea-redis
  namespace: ops
spec:
  storageClassName: fast
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 4Gi

---

kind: PersistentVolumeClaim
apiVersion: v1
metadata:
  name: gitea-pg
  namespace: ops
spec:
  storageClassName: fast
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 4Gi

---

apiVersion: helm.cattle.io/v1
kind: HelmChart
metadata:
  name: gitea
  namespace: ops
spec:
  repo: https://dl.gitea.com/charts/
  chart: gitea
  targetNamespace: ops
  valuesContent: |-

    ingress:
      enabled: true
      className: haproxy
      annotations:
        cert-manager.io/cluster-issuer: "letsencrypt-prod"
      tls:
      - secretName: git-tls
        hosts:
        - git.ntwl.xyz
        # - git.strix.systems
      hosts:
        - host: git.ntwl.xyz
          paths:
            - path: /
              pathType: Prefix
        - host: git.strix.systems
          paths:
            - path: /
              pathType: Prefix

    service:
      ssh:
        type: LoadBalancer
        port: 60022
        externalTrafficPolicy: Local

    redis-cluster:
      enabled: false

    redis:
      enabled: true
      persistence:
        enabled: true
        existingClaim: gitea-redis

    postgresql:
      enabled: true
      persistence:
        enabled: true
        existingClaim: gitea-pg

    postgresql-ha:
      enabled: false

    persistence:
      enabled: true
      existingClaim: gitea-data

    gitea:
      config:
        database:
          DB_TYPE: postgres
        indexer:
          ISSUE_INDEXER_TYPE: bleve
          REPO_INDEXER_ENABLED: true
        server:
          SSH_PORT: 60022
          # Git LFS over pure SSH (no HTTP). LFS_ALLOW_PURE_SSH needs Gitea >= 1.21.
          LFS_START_SERVER: true
          LFS_ALLOW_PURE_SSH: true
      admin:
        existingSecret: gitea-admin-secret