189 lines
4.3 KiB
YAML
189 lines
4.3 KiB
YAML
apiVersion: v1
|
|
kind: Namespace
|
|
metadata:
|
|
name: gitea
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: gitea-postgres-pvc
|
|
namespace: gitea
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
storageClassName: longhorn
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
name: gitea-app-pvc
|
|
namespace: gitea
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 20Gi
|
|
storageClassName: longhorn
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea-postgres-service
|
|
namespace: gitea
|
|
spec:
|
|
ports:
|
|
- port: 5432
|
|
targetPort: 5432
|
|
selector:
|
|
app: gitea-postgres
|
|
type: ClusterIP
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea-service
|
|
namespace: gitea
|
|
spec:
|
|
ports:
|
|
- name: http
|
|
port: 80
|
|
targetPort: 3000
|
|
- name: ssh
|
|
port: 2222
|
|
targetPort: 2222
|
|
selector:
|
|
app: gitea-app
|
|
type: ClusterIP
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gitea-postgres
|
|
namespace: gitea
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: gitea-postgres
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gitea-postgres
|
|
spec:
|
|
dnsConfig:
|
|
nameservers:
|
|
- 1.1.1.1
|
|
- 8.8.8.8
|
|
dnsPolicy: None
|
|
containers:
|
|
- name: postgres
|
|
image: postgres:15-alpine
|
|
env:
|
|
- name: PGDATA
|
|
value: /var/lib/postgresql/data/pgdata
|
|
- name: POSTGRES_USER
|
|
value: gitea_admin
|
|
- name: POSTGRES_PASSWORD
|
|
value: NeedlestackCodeVault2026
|
|
- name: POSTGRES_DB
|
|
value: giteadb
|
|
ports:
|
|
- containerPort: 5432
|
|
name: dbport
|
|
volumeMounts:
|
|
- mountPath: /var/lib/postgresql/data
|
|
name: db-data
|
|
volumes:
|
|
- name: db-data
|
|
persistentVolumeClaim:
|
|
claimName: gitea-postgres-pvc
|
|
---
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: gitea-app
|
|
namespace: gitea
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: gitea-app
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gitea-app
|
|
spec:
|
|
securityContext: # <-- ADD THIS SECTION
|
|
fsGroup: 1000 # <-- FORCES STORAGE VOLUMES TO BE OWNED BY USER 1000
|
|
containers:
|
|
- name: gitea
|
|
image: gitea/gitea:1.21-rootless
|
|
env:
|
|
# Core Database Settings
|
|
- name: GITEA__database__DB_TYPE
|
|
value: postgres
|
|
- name: GITEA__database__HOST
|
|
value: gitea-postgres-service:5432
|
|
- name: GITEA__database__NAME
|
|
value: giteadb
|
|
- name: GITEA__database__USER
|
|
value: gitea_admin
|
|
- name: GITEA__database__PASSWD
|
|
value: NeedlestackCodeVault2026
|
|
|
|
# Rootless Paths Fixes (Maps configuration to persistent /data)
|
|
- name: GITEA_APP_INI
|
|
value: /data/gitea/conf/app.ini
|
|
- name: GITEA_CUSTOM
|
|
value: /data/gitea
|
|
- name: GITEA_WORK_DIR
|
|
value: /data/gitea
|
|
|
|
# The Security Fixes (Bypasses installer & disables public sign-ups)
|
|
- name: GITEA__security__INSTALL_LOCK
|
|
value: "true"
|
|
- name: GITEA__service__DISABLE_REGISTRATION
|
|
value: "true"
|
|
ports:
|
|
- containerPort: 3000
|
|
name: http
|
|
- containerPort: 2222
|
|
name: ssh
|
|
volumeMounts:
|
|
- mountPath: /data
|
|
name: gitea-data
|
|
volumes:
|
|
- name: gitea-data
|
|
persistentVolumeClaim:
|
|
claimName: gitea-app-pvc
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: gitea-local-ingress
|
|
namespace: gitea
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: "letsencrypt-production"
|
|
nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
|
|
spec:
|
|
ingressClassName: nginx
|
|
tls:
|
|
- secretName: gitea-tls-secret
|
|
hosts:
|
|
- git.needlestack.boo
|
|
rules:
|
|
- host: git.needlestack.boo
|
|
http:
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
backend:
|
|
service:
|
|
name: gitea-service
|
|
port:
|
|
number: 80
|