initial commit
This commit is contained in:
commit
a648e9ba18
6 changed files with 422 additions and 0 deletions
45
forgejo-appset.yaml
Normal file
45
forgejo-appset.yaml
Normal file
|
|
@ -0,0 +1,45 @@
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: ApplicationSet
|
||||||
|
metadata:
|
||||||
|
name: forgejo
|
||||||
|
spec:
|
||||||
|
goTemplate: true
|
||||||
|
goTemplateOptions: ["missingkey=error"]
|
||||||
|
generators:
|
||||||
|
- list:
|
||||||
|
elements:
|
||||||
|
- cluster: edp-dev
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
name: '{{.cluster}}-guestbook'
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
selfHeal: true
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
retry:
|
||||||
|
limit: -1
|
||||||
|
destination:
|
||||||
|
name: in-cluster
|
||||||
|
namespace: gitea
|
||||||
|
sources:
|
||||||
|
- repoURL: https://edp.buildth.ing/DevFW-CICD/forgejo-helm.git
|
||||||
|
path: .
|
||||||
|
# first check out the desired version (example v9.0.0): https://code.forgejo.org/forgejo-helm/forgejo-helm/src/tag/v9.0.0/Chart.yaml
|
||||||
|
# (note that the chart version is not the same as the forgejo application version, which is specified in the above Chart.yaml file)
|
||||||
|
# then use the devops pipeline and select development, forgejo and the desired version (example v9.0.0):
|
||||||
|
# https://edp.buildth.ing/DevFW-CICD/devops-pipelines/actions?workflow=update-helm-depends.yaml&actor=0&status=0
|
||||||
|
# finally update the desired version here and include "-depends", it is created by the devops pipeline.
|
||||||
|
# why do we have an added "-depends" tag? it resolves rate limitings when downloading helm OCI dependencies
|
||||||
|
targetRevision: v12.0.0-depends
|
||||||
|
helm:
|
||||||
|
valueFiles:
|
||||||
|
- $values/forgejo/forgejo-server/values.yaml
|
||||||
|
- repoURL: https://edp.buildth.ing/DevFW/applicationset-poc.git
|
||||||
|
targetRevision: '{{.cluster}}'
|
||||||
|
ref: values
|
||||||
|
- repoURL: https://edp.buildth.ing/DevFW/applicationset-poc.git
|
||||||
|
targetRevision: '{{.cluster}}'
|
||||||
|
path: "forgejo/forgejo-server/manifests"
|
||||||
24
forgejo/forgejo-runner.yaml
Normal file
24
forgejo/forgejo-runner.yaml
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: forgejo-runner
|
||||||
|
namespace: argocd
|
||||||
|
labels:
|
||||||
|
env: dev
|
||||||
|
finalizers:
|
||||||
|
- resources-finalizer.argocd.argoproj.io
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
selfHeal: true
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
retry:
|
||||||
|
limit: -1
|
||||||
|
destination:
|
||||||
|
server: "https://kubernetes.default.svc"
|
||||||
|
source:
|
||||||
|
repoURL: https://edp.buildth.ing/DevFW/applicationset-poc.git
|
||||||
|
targetRevision: HEAD
|
||||||
|
path: "forgejo/forgejo-runner"
|
||||||
104
forgejo/forgejo-runner/dind-docker.yaml
Normal file
104
forgejo/forgejo-runner/dind-docker.yaml
Normal file
|
|
@ -0,0 +1,104 @@
|
||||||
|
apiVersion: apps/v1
|
||||||
|
kind: Deployment
|
||||||
|
metadata:
|
||||||
|
labels:
|
||||||
|
app: forgejo-runner
|
||||||
|
name: forgejo-runner
|
||||||
|
namespace: gitea
|
||||||
|
spec:
|
||||||
|
# Two replicas means that if one is busy, the other can pick up jobs.
|
||||||
|
replicas: 1
|
||||||
|
selector:
|
||||||
|
matchLabels:
|
||||||
|
app: forgejo-runner
|
||||||
|
strategy: {}
|
||||||
|
template:
|
||||||
|
metadata:
|
||||||
|
creationTimestamp: null
|
||||||
|
labels:
|
||||||
|
app: forgejo-runner
|
||||||
|
spec:
|
||||||
|
restartPolicy: Always
|
||||||
|
volumes:
|
||||||
|
- name: docker-certs
|
||||||
|
emptyDir: {}
|
||||||
|
- name: runner-data
|
||||||
|
emptyDir: {}
|
||||||
|
# Initialise our configuration file using offline registration
|
||||||
|
# https://forgejo.org/docs/v1.21/admin/actions/#offline-registration
|
||||||
|
initContainers:
|
||||||
|
- name: runner-register
|
||||||
|
image: code.forgejo.org/forgejo/runner:6.3.1
|
||||||
|
command:
|
||||||
|
- "sh"
|
||||||
|
- "-c"
|
||||||
|
- |
|
||||||
|
forgejo-runner \
|
||||||
|
register \
|
||||||
|
--no-interactive \
|
||||||
|
--token ${RUNNER_SECRET} \
|
||||||
|
--name ${RUNNER_NAME} \
|
||||||
|
--instance ${FORGEJO_INSTANCE_URL} \
|
||||||
|
--labels docker:docker://node:20-bookworm,ubuntu-22.04:docker://edp.buildth.ing/devfw-cicd/catthehackerubuntu:act-22.04,ubuntu-latest:docker://edp.buildth.ing/devfw-cicd/catthehackerubuntu:act-22.04
|
||||||
|
env:
|
||||||
|
- name: RUNNER_NAME
|
||||||
|
valueFrom:
|
||||||
|
fieldRef:
|
||||||
|
fieldPath: metadata.name
|
||||||
|
- name: RUNNER_SECRET
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: forgejo-runner-token
|
||||||
|
key: token
|
||||||
|
- name: FORGEJO_INSTANCE_URL
|
||||||
|
value: https://{{{ .Env.DOMAIN_GITEA }}}
|
||||||
|
volumeMounts:
|
||||||
|
- name: runner-data
|
||||||
|
mountPath: /data
|
||||||
|
containers:
|
||||||
|
- name: runner
|
||||||
|
image: code.forgejo.org/forgejo/runner:6.3.1
|
||||||
|
command:
|
||||||
|
- "sh"
|
||||||
|
- "-c"
|
||||||
|
- |
|
||||||
|
while ! nc -z 127.0.0.1 2376 </dev/null; do
|
||||||
|
echo 'waiting for docker daemon...';
|
||||||
|
sleep 5;
|
||||||
|
done
|
||||||
|
forgejo-runner generate-config > config.yml ;
|
||||||
|
sed -i -e "s|privileged: .*|privileged: true|" config.yml
|
||||||
|
sed -i -e "s|network: .*|network: host|" config.yml ;
|
||||||
|
sed -i -e "s|^ envs:$$| envs:\n DOCKER_HOST: tcp://127.0.0.1:2376\n DOCKER_TLS_VERIFY: 1\n DOCKER_CERT_PATH: /certs/client|" config.yml ;
|
||||||
|
sed -i -e "s|^ options:| options: -v /certs/client:/certs/client|" config.yml ;
|
||||||
|
sed -i -e "s| valid_volumes: \[\]$$| valid_volumes:\n - /certs/client|" config.yml ;
|
||||||
|
/bin/forgejo-runner --config config.yml daemon
|
||||||
|
securityContext:
|
||||||
|
allowPrivilegeEscalation: true
|
||||||
|
privileged: true
|
||||||
|
readOnlyRootFilesystem: false
|
||||||
|
runAsGroup: 0
|
||||||
|
runAsNonRoot: false
|
||||||
|
runAsUser: 0
|
||||||
|
env:
|
||||||
|
- name: DOCKER_HOST
|
||||||
|
value: tcp://localhost:2376
|
||||||
|
- name: DOCKER_CERT_PATH
|
||||||
|
value: /certs/client
|
||||||
|
- name: DOCKER_TLS_VERIFY
|
||||||
|
value: "1"
|
||||||
|
volumeMounts:
|
||||||
|
- name: docker-certs
|
||||||
|
mountPath: /certs
|
||||||
|
- name: runner-data
|
||||||
|
mountPath: /data
|
||||||
|
- name: daemon
|
||||||
|
image: docker:28.0.4-dind
|
||||||
|
env:
|
||||||
|
- name: DOCKER_TLS_CERTDIR
|
||||||
|
value: /certs
|
||||||
|
securityContext:
|
||||||
|
privileged: true
|
||||||
|
volumeMounts:
|
||||||
|
- name: docker-certs
|
||||||
|
mountPath: /certs
|
||||||
38
forgejo/forgejo-server.yaml
Normal file
38
forgejo/forgejo-server.yaml
Normal file
|
|
@ -0,0 +1,38 @@
|
||||||
|
apiVersion: argoproj.io/v1alpha1
|
||||||
|
kind: Application
|
||||||
|
metadata:
|
||||||
|
name: forgejo-server
|
||||||
|
namespace: argocd
|
||||||
|
labels:
|
||||||
|
env: dev
|
||||||
|
spec:
|
||||||
|
project: default
|
||||||
|
syncPolicy:
|
||||||
|
automated:
|
||||||
|
selfHeal: true
|
||||||
|
syncOptions:
|
||||||
|
- CreateNamespace=true
|
||||||
|
retry:
|
||||||
|
limit: -1
|
||||||
|
destination:
|
||||||
|
name: in-cluster
|
||||||
|
namespace: gitea
|
||||||
|
sources:
|
||||||
|
- repoURL: https://edp.buildth.ing/DevFW-CICD/forgejo-helm.git
|
||||||
|
path: .
|
||||||
|
# first check out the desired version (example v9.0.0): https://code.forgejo.org/forgejo-helm/forgejo-helm/src/tag/v9.0.0/Chart.yaml
|
||||||
|
# (note that the chart version is not the same as the forgejo application version, which is specified in the above Chart.yaml file)
|
||||||
|
# then use the devops pipeline and select development, forgejo and the desired version (example v9.0.0):
|
||||||
|
# https://edp.buildth.ing/DevFW-CICD/devops-pipelines/actions?workflow=update-helm-depends.yaml&actor=0&status=0
|
||||||
|
# finally update the desired version here and include "-depends", it is created by the devops pipeline.
|
||||||
|
# why do we have an added "-depends" tag? it resolves rate limitings when downloading helm OCI dependencies
|
||||||
|
targetRevision: v12.0.0-depends
|
||||||
|
helm:
|
||||||
|
valueFiles:
|
||||||
|
- $values/{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-server/values.yaml
|
||||||
|
- repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
|
||||||
|
targetRevision: HEAD
|
||||||
|
ref: values
|
||||||
|
- repoURL: https://{{{ .Env.CLIENT_REPO_DOMAIN }}}/{{{ .Env.CLIENT_REPO_ORG_NAME }}}
|
||||||
|
targetRevision: HEAD
|
||||||
|
path: "{{{ .Env.CLIENT_REPO_ID }}}/{{{ .Env.DOMAIN }}}/stacks/forgejo/forgejo-server/manifests"
|
||||||
31
forgejo/forgejo-server/manifests/forgejo-ingress.yaml
Normal file
31
forgejo/forgejo-server/manifests/forgejo-ingress.yaml
Normal file
|
|
@ -0,0 +1,31 @@
|
||||||
|
apiVersion: networking.k8s.io/v1
|
||||||
|
kind: Ingress
|
||||||
|
metadata:
|
||||||
|
annotations:
|
||||||
|
nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
|
||||||
|
nginx.ingress.kubernetes.io/proxy-body-size: 512m
|
||||||
|
cert-manager.io/cluster-issuer: main
|
||||||
|
{{{ if eq .Env.CLUSTER_TYPE "osc" }}}
|
||||||
|
dns.gardener.cloud/class: garden
|
||||||
|
dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN_GITEA }}}
|
||||||
|
dns.gardener.cloud/ttl: "600"
|
||||||
|
{{{ end }}}
|
||||||
|
name: forgejo-server
|
||||||
|
namespace: gitea
|
||||||
|
spec:
|
||||||
|
ingressClassName: nginx
|
||||||
|
rules:
|
||||||
|
- host: {{{ .Env.DOMAIN_GITEA }}}
|
||||||
|
http:
|
||||||
|
paths:
|
||||||
|
- backend:
|
||||||
|
service:
|
||||||
|
name: forgejo-server-http
|
||||||
|
port:
|
||||||
|
number: 3000
|
||||||
|
path: /
|
||||||
|
pathType: Prefix
|
||||||
|
tls:
|
||||||
|
- hosts:
|
||||||
|
- {{{ .Env.DOMAIN_GITEA }}}
|
||||||
|
secretName: forgejo-net-tls
|
||||||
180
forgejo/forgejo-server/values.yaml
Normal file
180
forgejo/forgejo-server/values.yaml
Normal file
|
|
@ -0,0 +1,180 @@
|
||||||
|
# We use recreate to make sure only one instance with one version is running, because Forgejo might break or data gets inconsistant.
|
||||||
|
strategy:
|
||||||
|
type: Recreate
|
||||||
|
|
||||||
|
redis-cluster:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
redis:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
postgresql:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
postgresql-ha:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
persistence:
|
||||||
|
enabled: true
|
||||||
|
size: 200Gi
|
||||||
|
annotations:
|
||||||
|
everest.io/crypt-key-id: {{{ .Env.PVC_KMS_KEY_ID }}}
|
||||||
|
|
||||||
|
test:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
deployment:
|
||||||
|
env:
|
||||||
|
- name: SSL_CERT_DIR
|
||||||
|
value: /etc/ssl/forgejo
|
||||||
|
|
||||||
|
extraVolumeMounts:
|
||||||
|
- mountPath: /etc/ssl/forgejo
|
||||||
|
name: custom-database-certs-volume
|
||||||
|
readOnly: true
|
||||||
|
|
||||||
|
extraVolumes:
|
||||||
|
- name: custom-database-certs-volume
|
||||||
|
secret:
|
||||||
|
secretName: custom-database-certs
|
||||||
|
|
||||||
|
gitea:
|
||||||
|
additionalConfigFromEnvs:
|
||||||
|
- name: FORGEJO__storage__MINIO_ACCESS_KEY_ID
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: forgejo-cloud-credentials
|
||||||
|
key: access-key
|
||||||
|
- name: FORGEJO__storage__MINIO_SECRET_ACCESS_KEY
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: forgejo-cloud-credentials
|
||||||
|
key: secret-key
|
||||||
|
- name: FORGEJO__queue__CONN_STR
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: redis-forgejo-cloud-credentials
|
||||||
|
key: connection-string
|
||||||
|
- name: FORGEJO__session__PROVIDER_CONFIG
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: redis-forgejo-cloud-credentials
|
||||||
|
key: connection-string
|
||||||
|
- name: FORGEJO__cache__HOST
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: redis-forgejo-cloud-credentials
|
||||||
|
key: connection-string
|
||||||
|
- name: FORGEJO__database__HOST
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: postgres-forgejo-cloud-credentials
|
||||||
|
key: host_port
|
||||||
|
- name: FORGEJO__database__NAME
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: postgres-forgejo-cloud-credentials
|
||||||
|
key: database
|
||||||
|
- name: FORGEJO__database__USER
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: postgres-forgejo-cloud-credentials
|
||||||
|
key: username
|
||||||
|
- name: FORGEJO__database__PASSWD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: postgres-forgejo-cloud-credentials
|
||||||
|
key: password
|
||||||
|
- name: FORGEJO__indexer__ISSUE_INDEXER_CONN_STR
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: elasticsearch-cloud-credentials
|
||||||
|
key: connection-string
|
||||||
|
- name: FORGEJO__mailer__PASSWD
|
||||||
|
valueFrom:
|
||||||
|
secretKeyRef:
|
||||||
|
name: email-user-credentials
|
||||||
|
key: connection-string
|
||||||
|
|
||||||
|
admin:
|
||||||
|
existingSecret: gitea-credential
|
||||||
|
|
||||||
|
config:
|
||||||
|
APP_NAME: 'EDP'
|
||||||
|
APP_SLOGAN: 'Build your thing in minutes'
|
||||||
|
indexer:
|
||||||
|
ISSUE_INDEXER_ENABLED: true
|
||||||
|
ISSUE_INDEXER_TYPE: elasticsearch
|
||||||
|
# TODO next
|
||||||
|
REPO_INDEXER_ENABLED: false
|
||||||
|
# REPO_INDEXER_TYPE: meilisearch # not yet working
|
||||||
|
|
||||||
|
storage:
|
||||||
|
MINIO_ENDPOINT: obs.eu-de.otc.t-systems.com:443
|
||||||
|
STORAGE_TYPE: minio
|
||||||
|
MINIO_LOCATION: eu-de
|
||||||
|
MINIO_BUCKET: edp-forgejo-{{{ .Env.CLUSTER_ENVIRONMENT }}}
|
||||||
|
MINIO_USE_SSL: true
|
||||||
|
|
||||||
|
queue:
|
||||||
|
TYPE: redis
|
||||||
|
|
||||||
|
session:
|
||||||
|
PROVIDER: redis
|
||||||
|
|
||||||
|
cache:
|
||||||
|
ENABLED: true
|
||||||
|
ADAPTER: redis
|
||||||
|
|
||||||
|
service:
|
||||||
|
DISABLE_REGISTRATION: true
|
||||||
|
|
||||||
|
other:
|
||||||
|
SHOW_FOOTER_VERSION: false
|
||||||
|
SHOW_FOOTER_TEMPLATE_LOAD_TIME: false
|
||||||
|
|
||||||
|
database:
|
||||||
|
DB_TYPE: postgres
|
||||||
|
SSL_MODE: verify-ca
|
||||||
|
|
||||||
|
server:
|
||||||
|
DOMAIN: '{{{ .Env.DOMAIN_GITEA }}}'
|
||||||
|
ROOT_URL: 'https://{{{ .Env.DOMAIN_GITEA }}}:443'
|
||||||
|
|
||||||
|
mailer:
|
||||||
|
ENABLED: true
|
||||||
|
USER: ipcei-cis-devfw@mms-support.de
|
||||||
|
PROTOCOL: smtps
|
||||||
|
FROM: '"IPCEI CIS DevFW" <ipcei-cis-devfw@mms-support.de>'
|
||||||
|
SMTP_ADDR: mail.mms-support.de
|
||||||
|
SMTP_PORT: 465
|
||||||
|
|
||||||
|
service:
|
||||||
|
ssh:
|
||||||
|
type: LoadBalancer
|
||||||
|
nodePort: 32222
|
||||||
|
externalTrafficPolicy: Cluster
|
||||||
|
annotations:
|
||||||
|
kubernetes.io/elb.id: {{{ .Env.LOADBALANCER_ID }}}
|
||||||
|
|
||||||
|
image:
|
||||||
|
pullPolicy: "IfNotPresent"
|
||||||
|
# Overrides the image tag whose default is the chart appVersion.
|
||||||
|
#tag: "8.0.3"
|
||||||
|
# Adds -rootless suffix to image name
|
||||||
|
# rootless: true
|
||||||
|
fullOverride: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/edp-forgejo:prerelease-v11-0-1-rootless
|
||||||
|
|
||||||
|
forgejo:
|
||||||
|
runner:
|
||||||
|
enabled: true
|
||||||
|
image:
|
||||||
|
tag: latest
|
||||||
|
# replicas: 3
|
||||||
|
config:
|
||||||
|
runner:
|
||||||
|
labels:
|
||||||
|
- docker:docker://node:16-bullseye
|
||||||
|
- self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04
|
||||||
|
- ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04
|
||||||
|
- ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04
|
||||||
Loading…
Add table
Add a link
Reference in a new issue