- Trust X-Forwarded-For from the pod network (10.244.0.0/16) via
security.REVERSE_PROXY_TRUSTED_PROXIES / REVERSE_PROXY_LIMIT so Gitea
logs the external client address instead of the ingress-nginx pod IP.
- Set actions.ENABLED explicitly and deploy an instance-wide runner via
the gitea/actions chart (release "gitea-actions", pinned to 0.1.2).
The registration token is generated in-cluster and stored in a Secret
on first run, so no token lives in git or the vault.
- Fix the old actions.yaml, which reused the "gitea" release name and
would have clobbered the main Gitea release.
- Add a demo workflow (.gitea/workflows/demo.yaml).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
