Combating spam

tasks/gitea.yaml

@@ -18,7 +18,7 @@
     create_namespace: true
     values:
       image:
-        pullPolicy: IfNotPresent
+        pullPolicy: Always
       service:
         ssh:
           type: LoadBalancer
@@ -27,6 +27,9 @@
         className: nginx
         annotations:
           cert-manager.io/cluster-issuer: ca-issuer
+          nginx.ingress.kubernetes.io/enable-cors: "true"
+          nginx.ingress.kubernetes.io/cors-allow-headers: "X-Forwarded-For"
+          nginx.ingress.kubernetes.io/server-snippet: "{{ lookup('file', 'server-snippet') }}"
         hosts:
           - host: gitea.eom.dev
             paths:
@@ -66,6 +69,9 @@
             DEFAULT_ALLOW_CREATE_ORGANIZATION: false
             ALLOW_ONLY_EXTERNAL_REGISTRATION: false
             ENABLE_NOTIFY_MAIL: true
+            EMAIL_DOMAIN_BLOCKLIST: "spammer.com,mailinator.com,tempmail.com,10minutemail.com,guerrillamail.com,dispostable.com,fakemail.com,maildrop.cc,trashmail.com,yopmail.com,techstrategylab.com,timminsgoldminetour.com,claxyn.org,sise.claxyn.org,blyxen.com,seti.blyxen.com,tute.blyxen.com,tula.blyxen.com,sise.blyxen.org,ivolix.com,seti.lyvix.org,tute.lyvix.org,seti.ivolix.org,semo.ivolix.com,elyquin.org,simu.elyquin.org,semo.claxyn.com,sise.oxilv.com,simu.glinxy.org,simu.hivoltz.org,semo.elyquin.com,prisite.online,sise.dravix.org,dravix.org,semo.glinxy.com,glinxy.com,dark-webmarket.com,seti.juxal.org,juxal.org,9e5d.getir.space,getir.space,topcompanygroup.com,6d43.getir.space,9e2d.mikrowellen-tests.com,verifiedlinklist.com,xylzen.com,tapi.xylzen.com,ylixo.com,tapi.ylixo.com,tute.ylixo.com"
+            ENABLE_CAPTCHA: true
+            REGISTER_EMAIL_CONFIRM: true
           oauth2_client:
             ENABLE_AUTO_REGISTRATION: true
             UPDATE_AVATAR: true
@@ -90,7 +96,7 @@
       postgresql:
         enabled: true
         image:
-          tag: 16.4.0-debian-12-r9
+          pullPolicy: Always
         global:
           postgresql:
             auth:

tasks/main.yml

@@ -5,4 +5,3 @@
   include_tasks: "{{ item }}"
   loop:
     - gitea.yaml
-    - actions.yaml

tasks/mcp.yaml

@@ -23,7 +23,7 @@
                   - name: GITEA_HOST
                     value: https://gitea.eom.dev
                   - name: GITEA_INSECURE
-                    value: false
+                    value: "false"
                   - name: GITEA_ACCESS_TOKEN
                     value: "{{ localai_gitea_access_token }}"
                   - name: MCP_MODE