Add Gitea to my infra

manifests/databases/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
   - postgres-matrix.yaml
   - immich.yaml
   - ingress.yaml
+  - postgres-gitea.yaml

manifests/databases/postgres-cluster.yaml

@@ -32,6 +32,13 @@ spec:
         superuser: false
         passwordSecret:
           name: postgres-user-matrix
+      - name: gitea
+        ensure: present
+        comment: Gitea DB user
+        login: true
+        superuser: false
+        passwordSecret:
+          name: postgres-user-gitea
 
   plugins:
     - name: barman-cloud.cloudnative-pg.io

manifests/databases/postgres-gitea.yaml

@@ -0,0 +1,9 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Database
+metadata:
+  name: database-gitea
+spec:
+  name: gitea
+  owner: gitea
+  cluster:
+    name: postgres

manifests/databases/secrets.yaml

@@ -167,3 +167,31 @@ spec:
       remoteRef:
         key: 5ce63e26-dd7f-46d4-b7ed-b310002ef93f
         property: password
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: postgres-user-gitea
+spec:
+  target:
+    name: postgres-user-gitea
+    deletionPolicy: Delete
+    template:
+      type: kukbernetes.io/basic-auth
+      data:
+        username: |-
+          {{ .dbuser }}
+        password: |-
+          {{ .dbpass }}
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  data:
+    - secretKey: dbuser
+      remoteRef:
+        key: df47ed61-61d7-4273-b81c-b3a9000de00e
+        property: username
+    - secretKey: dbpass
+      remoteRef:
+        key: df47ed61-61d7-4273-b81c-b3a9000de00e
+        property: password

manifests/gitea/chart.yaml

@@ -0,0 +1,103 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: gitea-repository
+spec:
+  interval: "24h"
+  url: https://dl.gitea.com/charts/
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea-release
+spec:
+  interval: "24h"
+  chart:
+    spec:
+      chart: gitea
+      sourceRef:
+        kind: HelmRepository
+        name: gitea-repository
+      interval: "1h"
+  values:
+    # Gitea Helm Chart Values
+    global:
+      storageClass: longhorn-default
+
+    replicaCount: 1
+
+    service:
+      http:
+        type: LoadBalancer
+        port: 3000
+      ssh:
+        type: LoadBalancer
+        port: 22
+        nodePort: 32222
+
+    gitea:
+      admin:
+        # If I ever need or want to reset the password, I can use this
+        # existingSecret: gitea-admin-secret
+        # passwordMode: keepUpdated
+        username: greg
+        password: changeMe1
+        passwordMode: initialOnlyRequireReset
+
+      # Reference: https://docs.gitea.com/administration/config-cheat-sheet
+      additionalConfigSources:
+        - secret:
+            secretName: gitea-config
+      config:
+        DEFAULT:
+          APP_NAME: "Gitea: Greg's Cup of Git"
+          RUN_MODE: dev
+        database:
+          DB_TYPE: postgres
+          HOST: "postgres-rw.db.svc.cluster.local:5432"
+          NAME: gitea
+          # USER: ""
+          # PASSWD: ""
+        session:
+          PROVIDER: db
+        queue:
+          TYPE: level
+        storage:
+          STORAGE_TYPE: minio
+          MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:9000"
+          MINIO_BUCKET: gitea
+          MINIO_LOCATION: us-east-1
+          # MINIO_ACCESS_KEY_ID: ""
+          # MINIO_SECRET_ACCESS_KEY: ""
+          MINIO_USE_SSL: "false"
+          MINIO_INSECURE_SKIP_VERIFY: "true"
+
+      metrics:
+        enabled: false
+        serviceMonitor:
+          enabled: false
+
+    persistence:
+      enabled: true
+      storageClass: longhorn-default
+      size: "50Gi"
+
+    # I will manage my Postgres externally
+    postgresql:
+      enabled: false
+    postgresql-ha:
+      enabled: false
+
+    resources:
+      limits:
+        cpu: "1000m"
+        memory: "6Gi"
+      requests:
+        cpu: "100m"
+        memory: "2Gi"
+
+    strategy:
+      type: RollingUpdate
+      rollingUpdate:
+        maxSurge: 1
+        maxUnavailable: 0

manifests/gitea/ingress.yaml

@@ -0,0 +1,14 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea
+spec:
+  ingressClassName: tailscale
+  defaultBackend:
+    service:
+      name: gitea-release-http
+      port:
+        name: http
+  tls:
+    - hosts:
+        - gitea

manifests/gitea/kustomization.yaml

@@ -0,0 +1,7 @@
+namespace: gitea
+
+resources:
+  - namespace.yaml
+  - chart.yaml
+  - ingress.yaml
+  - secrets.yaml

manifests/gitea/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea

manifests/gitea/secrets.yaml

@@ -0,0 +1,39 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-config
+spec:
+  target:
+    name: gitea-config
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        database: |-
+          USER={{ .dbuser }}
+          PASSWD="""{{ .dbpass }}"""
+        storage: |-
+          MINIO_ACCESS_KEY_ID={{ .minio_key }}
+          MINIO_SECRET_ACCESS_KEY={{ .minio_secret }}
+  secretStoreRef:
+    name: bitwarden-login
+    kind: ClusterSecretStore
+  data:
+    # MinIO credentials
+    - secretKey: minio_key
+      remoteRef:
+        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
+        property: username
+    - secretKey: minio_secret
+      remoteRef:
+        key: dcbcf704-7dce-48d7-bbd1-b3a801875b3d
+        property: password
+    # Postgres credentials
+    - secretKey: dbuser
+      remoteRef:
+        key: df47ed61-61d7-4273-b81c-b3a9000de00e
+        property: username
+    - secretKey: dbpass
+      remoteRef:
+        key: df47ed61-61d7-4273-b81c-b3a9000de00e
+        property: password

manifests/kustomization.yaml

@@ -14,3 +14,4 @@ resources:
   - smokeping
   - uptimekuma
   - donetick
+  - gitea

modules/hm/gui/bookmarks.nix

@@ -241,10 +241,6 @@
                 name = "Grafana";
                 url = "http://hosea.shire-zebra.ts.net:3000/";
               }
-              {
-                name = "Pinchflat";
-                url = "http://nas1.shire-zebra.ts.net:8945";
-              }
               {
                 name = "Prometheus";
                 url = "http://prometheus.shire-zebra.ts.net/";
@@ -272,6 +268,27 @@
               }
             ];
           }
+          {
+            name = "Infra";
+            bookmarks = [
+              {
+                name = "NAS1 Minio Console";
+                url = "http://nas1.shire-zebra.ts.net:30212/";
+              }
+              {
+                name = "NAS1 Minio Direct";
+                url = "http://nas1.shire-zebra.ts.net:9002/";
+              }
+              {
+                name = "Chronicles Minio";
+                url = "http://chronicles.shire-zebra.ts.net:9001";
+              }
+              {
+                name = "Pinchflat";
+                url = "https://pinchflat.shire-zebra.ts.net/";
+              }
+            ];
+          }
           {
             name = "Password Hash";
             url = "https://unix4lyfe.org/crypt/";