Records the source that was configured live with gitea admin auth:
OIDC discovery from Dex, groups scope, and login restricted to members
of Gitea Users via the groups claim. Needs gitea_dex_client_secret in
Vault (the same secret as Dex's gitea client).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Disable the password sign-in form so /user/login redirects to Dex,
keep registration enabled for Dex auto-registration, and redirect
/user/sign_up to www.eom.dev/members at the ingress.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
`kubectl rollout status` fails immediately once a rollout has exceeded
its progress deadline, even if the new pod is about to become ready.
Poll the deployment until replicas, updated and available counts agree.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
With a 150m CPU limit, pg_isready routinely exceeds the 5s probe timeout
under load (e.g. Gitea's startup migration check), so the kubelet kills
postgres mid-query. This is the cause of the long-running restart loop on
gitea-postgresql-0. Raise the limit to one core (request 250m).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The live valkey and postgresql StatefulSets had memory limits raised by
hand (8Gi and 2Gi). A helm upgrade reverts those to the bitnami 192Mi
preset, and valkey then OOMs loading its ~3.3GB dataset. Move the limits
into role defaults so upgrades keep them.
Generate the runner token with kubectl exec against the deployment after
waiting for its rollout, with retries, instead of kubernetes.core.k8s_exec
(the control plane's kubernetes python client is too old for it).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Trust X-Forwarded-For from the pod network (10.244.0.0/16) via
security.REVERSE_PROXY_TRUSTED_PROXIES / REVERSE_PROXY_LIMIT so Gitea
logs the external client address instead of the ingress-nginx pod IP.
- Set actions.ENABLED explicitly and deploy an instance-wide runner via
the gitea/actions chart (release "gitea-actions", pinned to 0.1.2).
The registration token is generated in-cluster and stored in a Secret
on first run, so no token lives in git or the vault.
- Fix the old actions.yaml, which reused the "gitea" release name and
would have clobbered the main Gitea release.
- Add a demo workflow (.gitea/workflows/demo.yaml).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
