Add platform infrastructure configuration

2026-08-28 17:35:41 +09:00
parent fa76531e5b
commit 16c337bcc9
302 changed files with 83259 additions and 1 deletions
@@ -0,0 +1,189 @@
+namespace: gitea
+
+replicaCount: 1
+
+image:
+  registry: docker.gitea.com
+  repository: gitea
+  tag: "1.27.0"
+  pullPolicy: IfNotPresent
+  rootless: true
+
+# The official chart applies this context to its built-in init containers,
+# configure-gitea, and the main container.
+containerSecurityContext:
+  allowPrivilegeEscalation: false
+  capabilities:
+    drop:
+      - ALL
+  runAsNonRoot: true
+  seccompProfile:
+    type: RuntimeDefault
+
+# A Local RWO volume cannot be attached to an old and a replacement Pod at the
+# same time. Terminate the old Pod before creating its replacement.
+strategy:
+  type: RollingUpdate
+  rollingUpdate:
+    maxSurge: 0
+    maxUnavailable: 1
+
+service:
+  http:
+    type: ClusterIP
+    port: 3000
+    clusterIP: ""
+    nodePort: null
+  ssh:
+    type: ClusterIP
+    port: 22
+    clusterIP: ""
+    nodePort: null
+    hostPort: null
+
+# Routing is owned by ../../base/ingress.yaml. Host Nginx terminates TLS before
+# forwarding requests to Traefik's HTTP entrypoint.
+ingress:
+  enabled: false
+
+route:
+  enabled: false
+
+gatewayAPI:
+  enabled: false
+
+persistence:
+  enabled: true
+  create: false
+  mount: true
+  claimName: gitea-data
+
+gitea:
+  admin:
+    existingSecret: gitea-admin
+    email: admin@hyeonworks.com
+    passwordMode: initialOnlyRequireReset
+
+  config:
+    server:
+      PROTOCOL: http
+      DOMAIN: git.learn.hyeonworks.com
+      ROOT_URL: https://git.learn.hyeonworks.com/
+      HTTP_PORT: 3000
+      DISABLE_SSH: true
+      START_SSH_SERVER: false
+      LFS_START_SERVER: false
+
+    # Baseline allows only the pre-provisioned local emergency administrator.
+    # The guarded OIDC profile overrides the first two settings.
+    service:
+      DISABLE_REGISTRATION: true
+      ALLOW_ONLY_EXTERNAL_REGISTRATION: false
+      SHOW_REGISTRATION_BUTTON: false
+      ENABLE_PASSWORD_SIGNIN_FORM: true
+
+    database:
+      DB_TYPE: postgres
+      HOST: platform-postgres-rw.platform-data.svc.cluster.local:5432
+      NAME: gitea
+      SSL_MODE: disable
+
+    session:
+      PROVIDER: db
+    cache:
+      ADAPTER: memory
+    queue:
+      TYPE: level
+
+    actions:
+      ENABLED: false
+    packages:
+      ENABLED: false
+    repository:
+      DISABLED_REPO_UNITS: "repo.packages,repo.actions"
+
+  additionalConfigFromEnvs:
+    - name: GITEA__DATABASE__USER
+      valueFrom:
+        secretKeyRef:
+          name: gitea-db-credentials
+          key: username
+    - name: GITEA__DATABASE__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: gitea-db-credentials
+          key: password
+
+  metrics:
+    enabled: true
+    serviceMonitor:
+      enabled: true
+      additionalLabels:
+        observability.hyeonworks.com/instance: home
+      interval: 30s
+      scrapeTimeout: 10s
+
+  livenessProbe:
+    enabled: true
+    httpGet:
+      path: /api/healthz
+      port: http
+    initialDelaySeconds: 200
+    timeoutSeconds: 5
+    periodSeconds: 10
+    successThreshold: 1
+    failureThreshold: 10
+
+  readinessProbe:
+    enabled: true
+    httpGet:
+      path: /api/healthz
+      port: http
+    initialDelaySeconds: 5
+    timeoutSeconds: 5
+    periodSeconds: 10
+    successThreshold: 1
+    failureThreshold: 3
+
+  startupProbe:
+    enabled: true
+    httpGet:
+      path: /api/healthz
+      port: http
+    initialDelaySeconds: 10
+    timeoutSeconds: 5
+    periodSeconds: 10
+    successThreshold: 1
+    failureThreshold: 60
+
+postgresql:
+  enabled: false
+
+postgresql-ha:
+  enabled: false
+
+valkey:
+  enabled: false
+
+valkey-cluster:
+  enabled: false
+
+resources:
+  requests:
+    cpu: 250m
+    memory: 512Mi
+  limits:
+    cpu: "2"
+    memory: 2Gi
+
+initContainers:
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 500m
+      memory: 512Mi
+
+test:
+  enabled: false
@@ -0,0 +1,49 @@
+extraVolumes:
+  - name: branding-assets
+    configMap:
+      name: gitea-branding-assets
+      defaultMode: 292
+      items:
+        - key: hyeonworks.css
+          path: css/hyeonworks.css
+        - key: logo.svg
+          path: img/logo.svg
+        - key: favicon.svg
+          path: img/favicon.svg
+  - name: branding-templates
+    configMap:
+      name: gitea-branding-templates
+      defaultMode: 292
+      items:
+        - key: header.tmpl
+          path: header.tmpl
+        - key: extra_links.tmpl
+          path: extra_links.tmpl
+
+extraContainerVolumeMounts:
+  - name: branding-assets
+    mountPath: /data/gitea/public/assets
+    readOnly: true
+  - name: branding-templates
+    mountPath: /data/gitea/templates/custom
+    readOnly: true
+
+gitea:
+  oauth:
+    - name: keycloak
+      provider: openidConnect
+      existingSecret: gitea-keycloak-oidc
+      autoDiscoverUrl: https://id.learn.hyeonworks.com/realms/hyeonworks/.well-known/openid-configuration
+
+  config:
+    APP_NAME: Hyeonworks Git
+
+    service:
+      DISABLE_REGISTRATION: false
+      ALLOW_ONLY_EXTERNAL_REGISTRATION: true
+
+    oauth2_client:
+      ENABLE_AUTO_REGISTRATION: true
+      USERNAME: preferred_username
+      ACCOUNT_LINKING: login
+      OPENID_CONNECT_SCOPES: "profile email"