Remove unused gitea MCP deployment

It was never included from main.yml, used an invalid apiVersion for the
Deployment and exposed mcp.gitea.eom.dev publicly. The MCP servers now
live in ansible-role-mcp-servers, cluster-internal only.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tasks/gitea.yaml

@@ -17,6 +17,19 @@
     release_namespace: gitea
     create_namespace: true
     values:
+      # Keep heavy apps off the 1-CPU node that hosts ingress-nginx; sharing it
+      # starved Nextcloud and risks the ingress / MetalLB announcement.
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - topologyKey: kubernetes.io/hostname
+              namespaceSelector:
+                matchLabels:
+                  kubernetes.io/metadata.name: ingress-nginx
+              labelSelector:
+                matchLabels:
+                  app.kubernetes.io/component: controller
+                  app.kubernetes.io/name: ingress-nginx
       image:
         pullPolicy: Always
       service:
@@ -61,6 +74,19 @@
             bindPassword: "{{ openldap_readonly_password }}"
             usernameAttribute: uid
             publicSSHKeyAttribute: sshPublicKey
+        # Sign-in through Dex; only members of Gitea Users (sent in the groups
+        # claim) may log in. The name "Dex" fixes the callback URL
+        # /user/oauth2/Dex/callback registered in Dex.
+        oauth:
+          - name: Dex
+            provider: openidConnect
+            key: gitea
+            secret: "{{ gitea_dex_client_secret }}"
+            autoDiscoverUrl: https://dex.eom.dev/.well-known/openid-configuration
+            scopes: "openid profile email groups"
+            requiredClaimName: groups
+            requiredClaimValue: Gitea Users
+            groupClaimName: groups
         config:
           APP_NAME: "Gitea"
           service:

tasks/mcp.yaml

@@ -1,78 +0,0 @@
-- name: deploy mcp
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Deployment
-      metadata:
-        name: mcp
-        namespace: gitea
-      spec:
-        replicas: 1
-        selector:
-          matchLabels:
-            app: mcp
-        template:
-          metadata:
-            labels:
-              app: mcp
-          spec:
-            containers:
-              - name: mcp
-                image: gitea/gitea-mcp-server
-                env:
-                  - name: GITEA_HOST
-                    value: https://gitea.eom.dev
-                  - name: GITEA_INSECURE
-                    value: "false"
-                  - name: GITEA_ACCESS_TOKEN
-                    value: "{{ localai_gitea_access_token }}"
-                  - name: MCP_MODE
-                    value: http
-                ports:
-                  - containerPort: 8080
-
-- name: service for mcp
-  k8s:
-    definition:
-      apiVersion: v1
-      kind: Service
-      metadata:
-        name: mcp
-        namespace: gitea
-      spec:
-        selector:
-          app: mcp
-        ports:
-          - port: 80
-            name: http
-            targetPort: 8080
-        type: ClusterIP
-
-- name: ingress
-  k8s:
-    state: present
-    definition:
-      apiVersion: networking.k8s.io/v1
-      kind: Ingress
-      metadata:
-        annotations:
-          cert-manager.io/cluster-issuer: ca-issuer
-        name: mcp
-        namespace: gitea
-      spec:
-        ingressClassName: nginx
-        rules:
-          - host: mcp.gitea.eom.dev
-            http:
-              paths:
-                - pathType: Prefix
-                  path: /
-                  backend:
-                    service:
-                      name: mcp
-                      port:
-                        number: 80
-        tls:
-          - hosts:
-            - mcp.gitea.eom.dev
-            secretName: mcp