rootandGreg Hellings
e6217401f9
Anubis (https://anubis.techaro.lol) is a lightweight proof-of-work challenge that protects web services from AI crawlers and scrapers.
174 lines
4.2 KiB
YAML
174 lines
4.2 KiB
YAML
apiVersion: source.toolkit.fluxcd.io/v1
|
|
kind: HelmRepository
|
|
metadata:
|
|
name: gitea-repository
|
|
spec:
|
|
interval: "24h"
|
|
url: https://dl.gitea.com/charts/
|
|
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: gitea-release
|
|
spec:
|
|
interval: "24h"
|
|
chart:
|
|
spec:
|
|
chart: gitea
|
|
version: "12.5.3"
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: gitea-repository
|
|
interval: "1h"
|
|
dependsOn:
|
|
- name: cnpg
|
|
namespace: cnpg-system
|
|
- name: external-secrets
|
|
namespace: external-secrets
|
|
- name: longhorn
|
|
namespace: longhorn-system
|
|
- name: tailscale
|
|
namespace: tailscale
|
|
values:
|
|
# Gitea Helm Chart Values https://gitea.com/gitea/helm-gitea
|
|
global:
|
|
storageClass: longhorn-default
|
|
|
|
image:
|
|
tag: "1.25.5"
|
|
|
|
replicaCount: 1
|
|
|
|
service:
|
|
http:
|
|
type: LoadBalancer
|
|
port: 3000
|
|
ssh:
|
|
type: LoadBalancer
|
|
port: 32222
|
|
nodePort: 32222
|
|
|
|
gitea:
|
|
admin:
|
|
# If I ever need or want to reset the password, I can use this
|
|
# existingSecret: gitea-admin-secret
|
|
# passwordMode: keepUpdated
|
|
username: greg
|
|
password: changeMe1
|
|
passwordMode: initialOnlyRequireReset
|
|
|
|
# Reference: https://docs.gitea.com/administration/config-cheat-sheet
|
|
additionalConfigSources:
|
|
- secret:
|
|
secretName: gitea-config
|
|
config:
|
|
DEFAULT:
|
|
APP_NAME: "Gitea: Greg's Cup of Git"
|
|
RUN_MODE: dev
|
|
server:
|
|
DOMAIN: "thehellings.com"
|
|
ROOT_URL: "https://src.thehellings.com"
|
|
SSH_PORT: "2222"
|
|
database:
|
|
DB_TYPE: postgres
|
|
HOST: "postgres-rw:5432"
|
|
NAME: gitea
|
|
# USER: ""
|
|
# PASSWD: ""
|
|
session:
|
|
PROVIDER: db
|
|
queue:
|
|
TYPE: level
|
|
repository:
|
|
ENABLE_PUSH_CREATE_USER: "true"
|
|
service:
|
|
DISABLE_REGISTRATION: "true"
|
|
storage:
|
|
STORAGE_TYPE: minio
|
|
MINIO_ENDPOINT: "nas1.shire-zebra.ts.net:9000"
|
|
MINIO_BUCKET: gitea
|
|
MINIO_LOCATION: us-east-1
|
|
# MINIO_ACCESS_KEY_ID: ""
|
|
# MINIO_SECRET_ACCESS_KEY: ""
|
|
MINIO_USE_SSL: "false"
|
|
MINIO_INSECURE_SKIP_VERIFY: "true"
|
|
webhook:
|
|
ALLOWED_HOST_LIST: loopback,private,*.shire-zebra.ts.net
|
|
|
|
metrics:
|
|
enabled: false
|
|
serviceMonitor:
|
|
enabled: false
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: longhorn-default
|
|
size: "50Gi"
|
|
|
|
# I will manage my Postgres externally
|
|
postgresql:
|
|
enabled: false
|
|
postgresql-ha:
|
|
enabled: false
|
|
|
|
resources:
|
|
limits:
|
|
cpu: "1000m"
|
|
memory: "6Gi"
|
|
requests:
|
|
cpu: "100m"
|
|
memory: "2Gi"
|
|
|
|
# Anubis anti-crawler sidecar
|
|
# Anubis listens on :8080 and proxies to Gitea at http://localhost:3000
|
|
# Ingress is updated to route to the anubis port instead of http
|
|
extraContainers:
|
|
- name: anubis
|
|
image: ghcr.io/techarohq/anubis:latest
|
|
imagePullPolicy: Always
|
|
env:
|
|
- name: BIND
|
|
value: ":8080"
|
|
- name: DIFFICULTY
|
|
value: "4"
|
|
- name: METRICS_BIND
|
|
value: ":9090"
|
|
- name: POLICY_FNAME
|
|
value: "/etc/anubis/policy.yaml"
|
|
- name: SERVE_ROBOTS_TXT
|
|
value: "true"
|
|
- name: TARGET
|
|
value: "http://localhost:3000"
|
|
volumeMounts:
|
|
- name: anubis-policy
|
|
mountPath: /etc/anubis
|
|
readOnly: true
|
|
resources:
|
|
limits:
|
|
cpu: "750m"
|
|
memory: "256Mi"
|
|
requests:
|
|
cpu: "250m"
|
|
memory: "256Mi"
|
|
securityContext:
|
|
runAsUser: 1000
|
|
runAsGroup: 1000
|
|
runAsNonRoot: true
|
|
allowPrivilegeEscalation: false
|
|
capabilities:
|
|
drop:
|
|
- ALL
|
|
seccompProfile:
|
|
type: RuntimeDefault
|
|
|
|
extraVolumes:
|
|
- name: anubis-policy
|
|
configMap:
|
|
name: anubis-policy
|
|
|
|
strategy:
|
|
type: RollingUpdate
|
|
rollingUpdate:
|
|
maxSurge: 1
|
|
maxUnavailable: 0
|