ClaudeandClaude Opus 5.5
0f1ed99dfc
Demo / hello (push) Successful in 18s
- Trust X-Forwarded-For from the pod network (10.244.0.0/16) via security.REVERSE_PROXY_TRUSTED_PROXIES / REVERSE_PROXY_LIMIT so Gitea logs the external client address instead of the ingress-nginx pod IP. - Set actions.ENABLED explicitly and deploy an instance-wide runner via the gitea/actions chart (release "gitea-actions", pinned to 0.1.2). The registration token is generated in-cluster and stored in a Secret on first run, so no token lives in git or the vault. - Fix the old actions.yaml, which reused the "gitea" release name and would have clobbered the main Gitea release. - Add a demo workflow (.gitea/workflows/demo.yaml). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
128 lines
5.2 KiB
YAML
128 lines
5.2 KiB
YAML
---
|
|
# tasks file for gitea
|
|
- name: add gitea repo
|
|
kubernetes.core.helm_repository:
|
|
name: gitea
|
|
repo_url: https://dl.gitea.com/charts/
|
|
register: repo_update
|
|
|
|
- name: update repos
|
|
command: helm repo update
|
|
when: repo_update.changed
|
|
|
|
- name: deploy gitea
|
|
kubernetes.core.helm:
|
|
name: gitea
|
|
chart_ref: gitea/gitea
|
|
release_namespace: gitea
|
|
create_namespace: true
|
|
values:
|
|
image:
|
|
pullPolicy: Always
|
|
service:
|
|
ssh:
|
|
type: LoadBalancer
|
|
ingress:
|
|
enabled: true
|
|
className: nginx
|
|
annotations:
|
|
cert-manager.io/cluster-issuer: ca-issuer
|
|
nginx.ingress.kubernetes.io/enable-cors: "true"
|
|
nginx.ingress.kubernetes.io/cors-allow-headers: "X-Forwarded-For"
|
|
nginx.ingress.kubernetes.io/proxy-body-size: 8m
|
|
hosts:
|
|
- host: gitea.eom.dev
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- hosts:
|
|
- gitea.eom.dev
|
|
secretName: gitea-tls
|
|
persistence:
|
|
size: 2Ti
|
|
gitea:
|
|
metrics:
|
|
enabled: true
|
|
admin:
|
|
username: gitea_admin
|
|
password: "{{ gitea_admin_password }}"
|
|
email: gitea@postfix.eom.dev
|
|
ldap:
|
|
- name: OpenLDAP
|
|
securityProtocol: unencrypted
|
|
host: openldap.openldap.svc.cluster.local
|
|
port: 389
|
|
userSearchBase: dc=eom,dc=dev
|
|
userFilter: (&(objectClass=posixAccount)(uid=%s)(memberOf=cn=Gitea Users,ou=Gitea,ou=Services,dc=eom,dc=dev))
|
|
adminFilter: (memberOf=cn=Gitea Administrators,ou=Gitea,ou=Services,dc=eom,dc=dev)
|
|
emailAttribute: mail
|
|
bindDn: cn=readonly,dc=eom,dc=dev
|
|
bindPassword: "{{ openldap_readonly_password }}"
|
|
usernameAttribute: uid
|
|
publicSSHKeyAttribute: sshPublicKey
|
|
config:
|
|
APP_NAME: "Gitea"
|
|
service:
|
|
DISABLE_REGISTRATION: false
|
|
SHOW_REGISTRATION_BUTTON: true
|
|
DEFAULT_ALLOW_CREATE_ORGANIZATION: false
|
|
ALLOW_ONLY_EXTERNAL_REGISTRATION: true
|
|
ENABLE_NOTIFY_MAIL: true
|
|
EMAIL_DOMAIN_BLOCKLIST: "spammer.com,mailinator.com,tempmail.com,10minutemail.com,guerrillamail.com,dispostable.com,fakemail.com,maildrop.cc,trashmail.com,yopmail.com,techstrategylab.com,timminsgoldminetour.com,claxyn.org,sise.claxyn.org,blyxen.com,seti.blyxen.com,tute.blyxen.com,tula.blyxen.com,sise.blyxen.org,ivolix.com,seti.lyvix.org,tute.lyvix.org,seti.ivolix.org,semo.ivolix.com,elyquin.org,simu.elyquin.org,semo.claxyn.com,sise.oxilv.com,simu.glinxy.org,simu.hivoltz.org,semo.elyquin.com,prisite.online,sise.dravix.org,dravix.org,semo.glinxy.com,glinxy.com,dark-webmarket.com,seti.juxal.org,juxal.org,9e5d.getir.space,getir.space,topcompanygroup.com,6d43.getir.space,9e2d.mikrowellen-tests.com,verifiedlinklist.com,xylzen.com,tapi.xylzen.com,ylixo.com,tapi.ylixo.com,tute.ylixo.com,estrella.glinxy.com,nestmailbox.com,theweifamily.icu,1mail.x24hr.com,8.dnsabr.com,23.8.dnsabr.com,2712.bubbles-swimming.co.uk,anonmails.de,spambog.ru,anonmails.de,virginvoyages.click,travellersrest.click,mailus.virginvoyages.com,tula.hivoltz.org,theblueholiday.click,mailius.virginvoyages.com,travellersrest.click,twitch.work,backlinks.monster,onlinecmail.com,gsasearchenginerankervps.com,seoautomationpro.online"
|
|
ENABLE_CAPTCHA: true
|
|
REGISTER_EMAIL_CONFIRM: true
|
|
security:
|
|
# Trust X-Forwarded-For from ingress-nginx (pod network) so Gitea
|
|
# logs the real client address instead of the ingress pod IP.
|
|
REVERSE_PROXY_LIMIT: 1
|
|
REVERSE_PROXY_TRUSTED_PROXIES: "{{ gitea_trusted_proxies }}"
|
|
actions:
|
|
ENABLED: true
|
|
oauth2_client:
|
|
ENABLE_AUTO_REGISTRATION: true
|
|
UPDATE_AVATAR: true
|
|
ACCOUNT_LINKING: auto
|
|
mailer:
|
|
ENABLED: true
|
|
SMTP_ADDR: postfix.eom.dev
|
|
SMTP_PORT: 587
|
|
USER: gitea
|
|
PASSWD: "{{ gitea_admin_password }}"
|
|
FROM: Gitea <gitea@eom.dev>
|
|
ENVELOPE_FROM: gitea@eom.dev
|
|
ui:
|
|
THEMES: catppuccin-rosewater-auto,catppuccin-flamingo-auto,catppuccin-pink-auto,catppuccin-mauve-auto,catppuccin-red-auto,catppuccin-maroon-auto,catppuccin-peach-auto,catppuccin-yellow-auto,catppuccin-green-auto,catppuccin-teal-auto,catppuccin-sky-auto,catppuccin-sapphire-auto,catppuccin-blue-auto,catppuccin-lavender-auto
|
|
DEFAULT_THEME: catppuccin-blue-auto
|
|
valkey:
|
|
enabled: true
|
|
valkey-cluster:
|
|
enabled: false
|
|
replica:
|
|
replicas: 1
|
|
redis:
|
|
enabled: true
|
|
global:
|
|
redis:
|
|
password: "{{ gitea_admin_password }}"
|
|
persistence:
|
|
enabled: true
|
|
redis-cluster:
|
|
enabled: false
|
|
postgresql:
|
|
enabled: true
|
|
image:
|
|
pullPolicy: Always
|
|
global:
|
|
postgresql:
|
|
auth:
|
|
username: gitea
|
|
password: "{{ gitea_admin_password }}"
|
|
database: gitea
|
|
primary:
|
|
persistence:
|
|
enabled: true
|
|
size: 2Ti
|
|
postgresql-ha:
|
|
enabled: false
|