ansible-role-gitea/tasks/gitea.yaml

---
# tasks file for gitea
- name: add gitea repo
  kubernetes.core.helm_repository:
    name: gitea
    repo_url: https://dl.gitea.com/charts/
  register: repo_update

- name: update repos
  command: helm repo update
  when: repo_update.changed

- name: deploy gitea
  kubernetes.core.helm:
    name: gitea
    chart_ref: gitea/gitea
    release_namespace: gitea
    create_namespace: true
    values:
      # Keep heavy apps off the 1-CPU node that hosts ingress-nginx; sharing it
      # starved Nextcloud and risks the ingress / MetalLB announcement.
      affinity:
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - topologyKey: kubernetes.io/hostname
              namespaceSelector:
                matchLabels:
                  kubernetes.io/metadata.name: ingress-nginx
              labelSelector:
                matchLabels:
                  app.kubernetes.io/component: controller
                  app.kubernetes.io/name: ingress-nginx
      image:
        pullPolicy: Always
      service:
        ssh:
          type: LoadBalancer
      ingress:
        enabled: true
        className: nginx
        annotations:
          cert-manager.io/cluster-issuer: ca-issuer
          nginx.ingress.kubernetes.io/enable-cors: "true"
          nginx.ingress.kubernetes.io/cors-allow-headers: "X-Forwarded-For"
          nginx.ingress.kubernetes.io/proxy-body-size: 8m
        hosts:
          - host: gitea.eom.dev
            paths:
              - path: /
                pathType: Prefix
        tls:
          - hosts:
            - gitea.eom.dev
            secretName: gitea-tls
      persistence:
        size: 2Ti
      gitea:
        metrics:
          enabled: true
        admin:
          username: gitea_admin
          password: "{{ gitea_admin_password }}"
          email: gitea@postfix.eom.dev
        ldap:
          - name: OpenLDAP
            securityProtocol: unencrypted
            host: openldap.openldap.svc.cluster.local
            port: 389
            userSearchBase: dc=eom,dc=dev
            userFilter: (&(objectClass=posixAccount)(uid=%s)(memberOf=cn=Gitea Users,ou=Gitea,ou=Services,dc=eom,dc=dev))
            adminFilter: (memberOf=cn=Gitea Administrators,ou=Gitea,ou=Services,dc=eom,dc=dev)
            emailAttribute: mail
            bindDn: cn=readonly,dc=eom,dc=dev
            bindPassword: "{{ openldap_readonly_password }}"
            usernameAttribute: uid
            publicSSHKeyAttribute: sshPublicKey
        # Sign-in through Dex; only members of Gitea Users (sent in the groups
        # claim) may log in. The name "Dex" fixes the callback URL
        # /user/oauth2/Dex/callback registered in Dex.
        oauth:
          - name: Dex
            provider: openidConnect
            key: gitea
            secret: "{{ gitea_dex_client_secret }}"
            autoDiscoverUrl: https://dex.eom.dev/.well-known/openid-configuration
            scopes: "openid profile email groups"
            requiredClaimName: groups
            requiredClaimValue: Gitea Users
            groupClaimName: groups
        config:
          APP_NAME: "Gitea"
          service:
            # Keep false: true would also block Dex auto-registration of members.
            # The sign-up button is redirected to www.eom.dev/members at ingress.
            DISABLE_REGISTRATION: false
            SHOW_REGISTRATION_BUTTON: true
            # Sign-in goes through Dex only (admin fallback: gitea admin CLI).
            ENABLE_PASSWORD_SIGNIN_FORM: false
            ENABLE_PASSKEY_AUTHENTICATION: false
            DEFAULT_ALLOW_CREATE_ORGANIZATION: false
            ALLOW_ONLY_EXTERNAL_REGISTRATION: true
            ENABLE_NOTIFY_MAIL: true
            EMAIL_DOMAIN_BLOCKLIST: "spammer.com,mailinator.com,tempmail.com,10minutemail.com,guerrillamail.com,dispostable.com,fakemail.com,maildrop.cc,trashmail.com,yopmail.com,techstrategylab.com,timminsgoldminetour.com,claxyn.org,sise.claxyn.org,blyxen.com,seti.blyxen.com,tute.blyxen.com,tula.blyxen.com,sise.blyxen.org,ivolix.com,seti.lyvix.org,tute.lyvix.org,seti.ivolix.org,semo.ivolix.com,elyquin.org,simu.elyquin.org,semo.claxyn.com,sise.oxilv.com,simu.glinxy.org,simu.hivoltz.org,semo.elyquin.com,prisite.online,sise.dravix.org,dravix.org,semo.glinxy.com,glinxy.com,dark-webmarket.com,seti.juxal.org,juxal.org,9e5d.getir.space,getir.space,topcompanygroup.com,6d43.getir.space,9e2d.mikrowellen-tests.com,verifiedlinklist.com,xylzen.com,tapi.xylzen.com,ylixo.com,tapi.ylixo.com,tute.ylixo.com,estrella.glinxy.com,nestmailbox.com,theweifamily.icu,1mail.x24hr.com,8.dnsabr.com,23.8.dnsabr.com,2712.bubbles-swimming.co.uk,anonmails.de,spambog.ru,anonmails.de,virginvoyages.click,travellersrest.click,mailus.virginvoyages.com,tula.hivoltz.org,theblueholiday.click,mailius.virginvoyages.com,travellersrest.click,twitch.work,backlinks.monster,onlinecmail.com,gsasearchenginerankervps.com,seoautomationpro.online"
            ENABLE_CAPTCHA: true
            REGISTER_EMAIL_CONFIRM: true
          security:
            # Trust X-Forwarded-For from ingress-nginx (pod network) so Gitea
            # logs the real client address instead of the ingress pod IP.
            REVERSE_PROXY_LIMIT: 1
            REVERSE_PROXY_TRUSTED_PROXIES: "{{ gitea_trusted_proxies }}"
          actions:
            ENABLED: true
          oauth2_client:
            ENABLE_AUTO_REGISTRATION: true
            UPDATE_AVATAR: true
            ACCOUNT_LINKING: auto
          mailer:
            ENABLED: true
            SMTP_ADDR: postfix.eom.dev
            SMTP_PORT: 587
            USER: gitea
            PASSWD: "{{ gitea_admin_password }}"
            FROM: Gitea <gitea@eom.dev>
            ENVELOPE_FROM: gitea@eom.dev
          ui:
            THEMES: catppuccin-rosewater-auto,catppuccin-flamingo-auto,catppuccin-pink-auto,catppuccin-mauve-auto,catppuccin-red-auto,catppuccin-maroon-auto,catppuccin-peach-auto,catppuccin-yellow-auto,catppuccin-green-auto,catppuccin-teal-auto,catppuccin-sky-auto,catppuccin-sapphire-auto,catppuccin-blue-auto,catppuccin-lavender-auto
            DEFAULT_THEME: catppuccin-blue-auto
      valkey:
        enabled: true
        primary:
          # The chart's default preset (192Mi) cannot load the existing dataset.
          resources: "{{ gitea_valkey_resources }}"
      valkey-cluster:
        enabled: false
        replica:
          replicas: 1
      redis:
        enabled: true
        global:
          redis:
            password: "{{ gitea_admin_password }}"
        persistence:
          enabled: true
      redis-cluster:
        enabled: false
      postgresql:
        enabled: true
        image:
          pullPolicy: Always
        global:
          postgresql:
            auth:
              username: gitea
              password: "{{ gitea_admin_password }}"
              database: gitea
        primary:
          resources: "{{ gitea_postgresql_resources }}"
          persistence:
            enabled: true
            size: 2Ti
      postgresql-ha:
        enabled: false

- name: Send Gitea's sign-up button to the eom.dev membership site
  kubernetes.core.k8s:
    state: present
    definition:
      apiVersion: networking.k8s.io/v1
      kind: Ingress
      metadata:
        name: gitea-signup-redirect
        namespace: gitea
        annotations:
          nginx.ingress.kubernetes.io/temporal-redirect: https://www.eom.dev/members
      spec:
        ingressClassName: nginx
        tls:
          - hosts: [gitea.eom.dev]
            secretName: gitea-tls
        rules:
          - host: gitea.eom.dev
            http:
              paths:
                - path: /user/sign_up
                  pathType: Exact
                  backend:
                    service:
                      name: gitea-http
                      port:
                        number: 3000