greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

Add Gitea to my infra

Browse Source
This commit is contained in:
Greg Hellings
2025-12-04 00:45:46 -06:00
parent b2b4162715
commit 4f9a2732bc
11 changed files with 234 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
manifests/databases/kustomization.yaml
+1
View File
@@ -9,3 +9,4 @@ resources:
- postgres-matrix.yaml
- immich.yaml
- ingress.yaml
- postgres-gitea.yaml
manifests/databases/postgres-cluster.yaml
+7
View File
@@ -32,6 +32,13 @@ spec:
superuser: false
passwordSecret:
name: postgres-user-matrix
- name: gitea
ensure: present
comment: Gitea DB user
login: true
superuser: false
passwordSecret:
name: postgres-user-gitea
plugins:
- name: barman-cloud.cloudnative-pg.io
manifests/databases/postgres-gitea.yaml
+9
View File
@@ -0,0 +1,9 @@
apiVersion: postgresql.cnpg.io/v1
kind: Database
metadata:
name: database-gitea
spec:
name: gitea
owner: gitea
cluster:
name: postgres
manifests/databases/secrets.yaml
+28
View File
@@ -167,3 +167,31 @@ spec:
remoteRef:
key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
property: password
---
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: postgres-user-gitea
spec:
target:
name: postgres-user-gitea
deletionPolicy: Delete
template:
type: kukbernetes.io/basic-auth
data:
username: |-
{{ .dbuser }}
password: |-
{{ .dbpass }}
secretStoreRef:
name: bitwarden-login
kind: ClusterSecretStore
data:
- secretKey: dbuser
remoteRef:
key: df47ed61-61d7-4273-b81c-b3a9000de00e
property: username
- secretKey: dbpass
remoteRef:
key: df47ed61-61d7-4273-b81c-b3a9000de00e
property: password
manifests/gitea/chart.yaml
+103
View File
@@ -0,0 +1,103 @@
apiVersion: source.toolkit.fluxcd.io/v1
kind: HelmRepository
metadata:
name: gitea-repository
spec:
interval: "24h"
url: https://dl.gitea.com/charts/
---
apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
name: gitea-release
spec:
interval: "24h"
chart:
spec:
chart: gitea
sourceRef:
kind: HelmRepository
name: gitea-repository
interval: "1h"
values:
# Gitea Helm Chart Values
global:
storageClass: longhorn-default
replicaCount: 1
service:
http:
type: LoadBalancer
port: 3000
ssh:
type: LoadBalancer
port: 22
nodePort: 32222
gitea:
admin:
# If I ever need or want to reset the password, I can use this
# existingSecret: gitea-admin-secret
# passwordMode: keepUpdated
username: greg
password: changeMe1
passwordMode: initialOnlyRequireReset
# Reference: https://docs.gitea.com/administration/config-cheat-sheet
additionalConfigSources:
- secret:
secretName: gitea-config
config:
DEFAULT:
APP_NAME: "Gitea: Greg's Cup of Git"
RUN_MODE: dev
database:
DB_TYPE: postgres
HOST: "postgres-rw.db.svc.cluster.local:5432"
NAME: gitea
# USER: ""
# PASSWD: ""
session:
PROVIDER: db
queue:
TYPE: level
storage:
STORAGE_TYPE: minio
MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:9000"
MINIO_BUCKET: gitea
MINIO_LOCATION: us-east-1
# MINIO_ACCESS_KEY_ID: ""
# MINIO_SECRET_ACCESS_KEY: ""
MINIO_USE_SSL: "false"
MINIO_INSECURE_SKIP_VERIFY: "true"
metrics:
enabled: false
serviceMonitor:
enabled: false
persistence:
enabled: true
storageClass: longhorn-default
size: "50Gi"
# I will manage my Postgres externally
postgresql:
enabled: false
postgresql-ha:
enabled: false
resources:
limits:
cpu: "1000m"
memory: "6Gi"
requests:
cpu: "100m"
memory: "2Gi"
strategy:
type: RollingUpdate
rollingUpdate:
maxSurge: 1
maxUnavailable: 0
manifests/gitea/ingress.yaml
+14
View File
@@ -0,0 +1,14 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: gitea
spec:
ingressClassName: tailscale
defaultBackend:
service:
name: gitea-release-http
port:
name: http
tls:
- hosts:
- gitea
manifests/gitea/kustomization.yaml
+7
View File
@@ -0,0 +1,7 @@
namespace: gitea
resources:
- namespace.yaml
- chart.yaml
- ingress.yaml
- secrets.yaml
manifests/gitea/namespace.yaml
+4
View File
@@ -0,0 +1,4 @@
apiVersion: v1
kind: Namespace
metadata:
name: gitea
manifests/gitea/secrets.yaml
+39
View File
@@ -0,0 +1,39 @@
apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
name: gitea-config
spec:
target:
name: gitea-config
deletionPolicy: Delete
template:
type: Opaque
data:
database: |-
USER={{ .dbuser }}
PASSWD="""{{ .dbpass }}"""
storage: |-
MINIO_ACCESS_KEY_ID={{ .minio_key }}
MINIO_SECRET_ACCESS_KEY={{ .minio_secret }}
secretStoreRef:
name: bitwarden-login
kind: ClusterSecretStore
data:
# MinIO credentials
- secretKey: minio_key
remoteRef:
key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
property: username
- secretKey: minio_secret
remoteRef:
key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
property: password
# Postgres credentials
- secretKey: dbuser
remoteRef:
key: df47ed61-61d7-4273-b81c-b3a9000de00e
property: username
- secretKey: dbpass
remoteRef:
key: df47ed61-61d7-4273-b81c-b3a9000de00e
property: password
manifests/kustomization.yaml
+1
View File
@@ -14,3 +14,4 @@ resources:
- smokeping
- uptimekuma
- donetick
- gitea
modules/hm/gui/bookmarks.nix
+21 -4
View File
@@ -241,10 +241,6 @@
name = "Grafana";
url = "http://hosea.shire-zebra.ts.net:3000/";
}
{
name = "Pinchflat";
url = "http://nas1.shire-zebra.ts.net:8945";
}
{
name = "Prometheus";
url = "http://prometheus.shire-zebra.ts.net/";
@@ -272,6 +268,27 @@
}
];
}
{
name = "Infra";
bookmarks = [
{
name = "NAS1 Minio Console";
url = "http://nas1.shire-zebra.ts.net:30212/";
}
{
name = "NAS1 Minio Direct";
url = "http://nas1.shire-zebra.ts.net:9002/";
}
{
name = "Chronicles Minio";
url = "http://chronicles.shire-zebra.ts.net:9001";
}
{
name = "Pinchflat";
url = "https://pinchflat.shire-zebra.ts.net/";
}
];
}
{
name = "Password Hash";
url = "https://unix4lyfe.org/crypt/";