# Apply: helm upgrade --install gitea gitea-charts/gitea -f values/gitea.yaml -n gitea --create-namespace
# Description: Helm values for Gitea git server and Docker registry

replicaCount: 1

image:
  tag: "1.23"

gitea:
  admin:
    existingSecret: gitea-admin-secret
    email: nik@nik4nao.com

  config:
    server:
      DOMAIN: gitea.nik4nao.com
      ROOT_URL: https://gitea.nik4nao.com
      SSH_DOMAIN: gitea.nik4nao.com
      SSH_PORT: 2222
    repository:
      DEFAULT_PRIVATE: true
    service:
      DISABLE_REGISTRATION: true
      ALLOW_ONLY_EXTERNAL_SELF_REGISTRATION: false
    auth:
      LOCAL_REGISTRATION_DISABLED: true

persistence:
  enabled: true
  storageClass: ""
  accessModes:
    - ReadWriteOnce
  size: 10Gi
  volumeName: ""
  existingClaim: ""
  annotations:
    helm.sh/resource-policy: keep

postgresql:
  enabled: true
  primary:
    persistence:
      annotations:
        helm.sh/resource-policy: keep
  global:
    postgresql:
      auth:
        # NOTE: this chart's own template (templates/gitea/config.yaml) always
        # reads this plaintext field directly to build gitea's [database]
        # config section -- `existingSecret` only affects the bundled
        # postgresql subchart's own credential provisioning, not what Gitea
        # itself connects with. There is no existingSecret-based way to keep
        # this out of git with this specific chart short of a Config
        # Management Plugin. Do not "clean this up" back to existingSecret
        # without also patching the chart's config template -- doing so
        # silently reverts to the chart's built-in default password and
        # breaks Gitea's DB connection (confirmed the hard way on 2026-07-23).
        username: gitea
        database: gitea
        password: ySelvqn2LjZ1fdJ4OFQs5ZlK6VLxHdny

service:
  ssh:
    type: LoadBalancer
    port: 2222
    loadBalancerIP: 192.168.7.77

postgresql-ha:
  enabled: false