144 lines
4.9 KiB
YAML
144 lines
4.9 KiB
YAML
---
|
|
|
|
# gitea-admin-secret: sealed with kubeseal. Encrypted, safe to commit.
|
|
# Rotate: recreate plaintext secret + re-seal, e.g.
|
|
# kubectl -n ops create secret generic gitea-admin-secret \
|
|
# --from-literal=username=ntr --from-literal=password="$NEWPW" \
|
|
# --from-literal=email=ntr@strix.systems --dry-run=client -o yaml | \
|
|
# kubeseal --controller-name sealed-secrets-controller \
|
|
# --controller-namespace kube-system --format yaml
|
|
apiVersion: bitnami.com/v1alpha1
|
|
kind: SealedSecret
|
|
metadata:
|
|
name: gitea-admin-secret
|
|
namespace: ops
|
|
spec:
|
|
encryptedData:
|
|
email: AgCCwKb/cTRNKgtg7gPwId5rVYzf++0BDWA8miOcfAFciSWX1hSXFL7LGe52Ln2UpYD7BRZkkGq2Rz53XM+irSKFnD0K+F8/+S2wu4Nxk2GbwBEHbANd3ATnxxdBsqRrEYZFHy5X29sFIF1Kp+p7UwJhudZVMjuSlJ9awXri+XR3te/Fmpa/kT5SF7gc9DQPrNsH3UaTVBhxJ1nFNKShdSTVLC8/fD5RgxMPxwexx3ny7a9YJxQh97Te8ZrR24ZceccY+lmbxadsqqth8KjeqAdUkH/LSkIelRr9v4xbKnV5oGwOKjRDF4tZxgoLmkHvoP97tp9b0/aEEyRU78Zz5aMRwWNsY78O4/ufudUIyUctctgNZ4x6N1QSHHFFGcAB12e15jP+5TgZj9RUov2B6NSIab2XJU4pm4H65OGsX9osHIGou5lRMZvRi/SZlkbtkzx3OwMfc5TSw7aRQ6fSiYagsxWmKJWVs+OFjI/b9ee436/C63u1yilWFT7VHoJzRGck35DWk4xvatOb77inJBwLahruDXBGD2BB4hGVRB7cNJ+aAavEgBVvPstN9ssD3TNwVPQxL7CQiDrt9sj5Og4FDl1F+F2UNfP4RrNYHIQFZeFDQwrKXRkzeCA76sYE6ee8RvurHDiia2HoF9RL3cx0EqDiuqAKBpbzFSdSCcCWWvsvx0ICbialykyB8dTn/Mktzu0+3hf5FiV/seI=
|
|
password: AgAytYm5H0dVZUrvE2Ag8WrkWVMeGHJ/I6g85kFUIxMXKDi2Hnz0MuyTizCUovJVT3ab9CAgUOlP2JbIrbO8PnXhdlVgHWcSxq+5K32dMuUjZL7582bRo9buC+7BBxrBDk8/L/CcvfvP4Dow1KFzxI7jFuOz8LzuGgtzGgl5bowxskcAibAMSXR3EN3UGLGIticjiuKNZJRFwt9AD/nn1ZOH/HLX/QiFY7Cv53/IIBFQvUSEtRzlzCKAn7WjMHx9hGgo050j97mNgs1uQp9vGeW8OAIaPidzOsPL2ISW6TGOpf6mSx1BsENkwbNsVJ2avFCi3yBGH26cOEWJBSnwBsmfcnSJbuQZFBBKARRaRMpXSm5qxMsjfbHUFHKtCnazb/xM/e52CFkbZl0M4jo2EHTlPFH8D+Oqo0b+Y43pMaFojaYx+mCnFImgl+3ArD+oMpazfzGlz6BQ2NetpNC8uy5AtP+8k75ZbUU+ZSiZPttyqQ/6PPCxC9H1UB0KEuWiTFQuiLoC1qeLR5+FDMgEsXPZCFu2hi/0WNXlQ+KHtlf5g3z3o0lz8YMHNAMDgArKRG3YPDQgT1iravTKlyduOu1GzIAGU+af30OO6NDSIFkdSu1PA9j4qTVNjdpgDu+OR5k5bOlJPqYVoVsZugkLAsILeIO6l9rygeJzTjG791RovaeeF7zaVGV/FsKtBD0hsa9Kg3WwI3+1IYnS3OPWPKxKiD5sHd9m
|
|
username: AgBLWJhYYenlLJQyyOFjibScElVtwT006b6QLTde1TZlLjqrLdw1PsH7rWAWfsCHbZJzRo/nWxIxiYWMAMQNTxco1wghBbalxWQsyhcreEPRgQJxRDKRf/+7gRVophUgrJ6Ej3EwDNGnEtdtCw+QIedXvCQtlt5MNzch+S/mxylhZF9CswpPDOEnoqbM5RELu8LUuYiThD5NNKFah4j/c92CZFVbtZzprUOLphUVWzGDde6krmJZpDhDSl4VwVbjPU700C0qrsJhGZlwDlXTwDXMH552X6qCh+GHeh1Ig6ll7npQSMlwFWsYyz0dRMYXkaASdrh4arhukzkTmjHXDtgIoiXqEdhjayZ0oIcSVgyzX0dK62wxWtYITPhREJkKSrLPs0vrz480qNiZ69gXKZiBSernyvwZ0w5oxlkMfMRQyUHUcpzfG1z94w9gh5GDvHS6r1hHH3Hndtt7owGbCtOtySUsrdeEiNG95uvI44vqpFc8RAzspYZ9HsiQnTu0Xg3hM40YRiAyFr4n/He0SMf1FQE7F4dPEv5zPK4/swAfq/n2DzpQDr/vhCnL+2y7VVG/pp+1Ox6qm5nhS0xmnlwDqkgFfTbUPPyvwY+oOBo0EDAYEY9a1CitlSD176FJomL4BP3KWB1OqgWpH3YwWBnI3QMKXKWd44Mt4Wh3ihJLhpzfLJQeBIhH1tu8ca4/hvs+pNA=
|
|
template:
|
|
metadata:
|
|
name: gitea-admin-secret
|
|
namespace: ops
|
|
|
|
---
|
|
|
|
kind: PersistentVolumeClaim
|
|
apiVersion: v1
|
|
metadata:
|
|
name: gitea-data
|
|
namespace: ops
|
|
spec:
|
|
storageClassName: fast
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 20Gi
|
|
|
|
---
|
|
|
|
kind: PersistentVolumeClaim
|
|
apiVersion: v1
|
|
metadata:
|
|
name: gitea-redis
|
|
namespace: ops
|
|
spec:
|
|
storageClassName: fast
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 4Gi
|
|
|
|
---
|
|
|
|
kind: PersistentVolumeClaim
|
|
apiVersion: v1
|
|
metadata:
|
|
name: gitea-pg
|
|
namespace: ops
|
|
spec:
|
|
storageClassName: fast
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 4Gi
|
|
|
|
---
|
|
|
|
apiVersion: helm.cattle.io/v1
|
|
kind: HelmChart
|
|
metadata:
|
|
name: gitea
|
|
namespace: ops
|
|
spec:
|
|
repo: https://dl.gitea.com/charts/
|
|
chart: gitea
|
|
targetNamespace: ops
|
|
valuesContent: |-
|
|
|
|
ingress:
|
|
enabled: true
|
|
className: haproxy
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: "letsencrypt-prod"
|
|
tls:
|
|
- secretName: git-tls
|
|
hosts:
|
|
- git.ntwl.xyz
|
|
# - git.strix.systems
|
|
hosts:
|
|
- host: git.ntwl.xyz
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
- host: git.strix.systems
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
|
|
service:
|
|
ssh:
|
|
type: LoadBalancer
|
|
port: 60022
|
|
externalTrafficPolicy: Local
|
|
|
|
redis-cluster:
|
|
enabled: false
|
|
|
|
redis:
|
|
enabled: true
|
|
persistence:
|
|
enabled: true
|
|
existingClaim: gitea-redis
|
|
|
|
postgresql:
|
|
enabled: true
|
|
persistence:
|
|
enabled: true
|
|
existingClaim: gitea-pg
|
|
|
|
postgresql-ha:
|
|
enabled: false
|
|
|
|
persistence:
|
|
enabled: true
|
|
existingClaim: gitea-data
|
|
|
|
gitea:
|
|
config:
|
|
database:
|
|
DB_TYPE: postgres
|
|
indexer:
|
|
ISSUE_INDEXER_TYPE: bleve
|
|
REPO_INDEXER_ENABLED: true
|
|
server:
|
|
SSH_PORT: 60022
|
|
# Git LFS over pure SSH (no HTTP). LFS_ALLOW_PURE_SSH needs Gitea >= 1.21.
|
|
LFS_START_SERVER: true
|
|
LFS_ALLOW_PURE_SSH: true
|
|
admin:
|
|
existingSecret: gitea-admin-secret |