Nik Afiq
e6550d0e39
Stage 1 of REFACTOR_PLAN.md. values/gitea.yaml and config/dashy/conf.yaml now reference secrets injected at apply-time (gitea-postgres-secret.sh, .env) instead of hardcoding a live DB password and weather API key in git. Both values must be treated as compromised and rotated by the operator (see .env.example). Also fixes authentik-ingress.yaml and traefik-dashboard-ingress.yaml, which pointed at the internal-ca root ClusterIssuer instead of internal-ca-issuer, the chained issuer every other internal Certificate uses -- causing untrusted-cert warnings on the SSO login and Traefik dashboard. Extends .gitignore for *.retry, .vault_pass*, kubeconfig patterns, and editor swap files. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
63 lines
1.3 KiB
YAML
63 lines
1.3 KiB
YAML
# Apply: helm upgrade --install gitea gitea-charts/gitea -f values/gitea.yaml -n gitea --create-namespace
|
|
# Description: Helm values for Gitea git server and Docker registry
|
|
|
|
replicaCount: 1
|
|
|
|
image:
|
|
tag: "1.23"
|
|
|
|
gitea:
|
|
admin:
|
|
existingSecret: gitea-admin-secret
|
|
email: nik@nik4nao.com
|
|
|
|
config:
|
|
server:
|
|
DOMAIN: gitea.nik4nao.com
|
|
ROOT_URL: https://gitea.nik4nao.com
|
|
SSH_DOMAIN: gitea.nik4nao.com
|
|
SSH_PORT: 2222
|
|
repository:
|
|
DEFAULT_PRIVATE: true
|
|
service:
|
|
DISABLE_REGISTRATION: true
|
|
ALLOW_ONLY_EXTERNAL_SELF_REGISTRATION: false
|
|
auth:
|
|
LOCAL_REGISTRATION_DISABLED: true
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: ""
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 10Gi
|
|
volumeName: ""
|
|
existingClaim: ""
|
|
annotations:
|
|
helm.sh/resource-policy: keep
|
|
|
|
postgresql:
|
|
enabled: true
|
|
primary:
|
|
persistence:
|
|
annotations:
|
|
helm.sh/resource-policy: keep
|
|
global:
|
|
postgresql:
|
|
auth:
|
|
username: gitea
|
|
database: gitea
|
|
existingSecret: gitea-postgres-secret
|
|
secretKeys:
|
|
adminPasswordKey: postgresql-password
|
|
userPasswordKey: postgresql-password
|
|
|
|
service:
|
|
ssh:
|
|
type: LoadBalancer
|
|
port: 2222
|
|
loadBalancerIP: 192.168.7.77
|
|
|
|
postgresql-ha:
|
|
enabled: false
|