Nik Afiq
7fbab2561a
Some checks failed
validate / lint (push) Failing after 1s
Root-causes today's Gitea outage. The official Gitea Helm chart
(dl.gitea.com/charts, gitea/helm-gitea) always builds Gitea's own [database]
config directly from the plaintext postgresql.global.postgresql.auth.password
value, confirmed from templates/gitea/config.yaml:
{{- $_ := set .Values.gitea.config.database "PASSWD" .Values.postgresql.global.postgresql.auth.password -}}
`existingSecret` only affects the bundled postgresql subchart's own credential
provisioning -- it has no effect on what Gitea itself connects with. Removing
the plaintext field in the earlier Stage 1 "secret hygiene" commit made this
silently fall back to the chart's built-in default password ("gitea", 5
chars), which got re-baked into the persisted app.ini on every pod restart
regardless of what the live Postgres role's real password was -- hence the
repeating CrashLoopBackOff no amount of Postgres-side fixing could resolve.
Restores a plaintext password (the value already live on Postgres from this
incident's recovery), with a comment explaining why, so this doesn't get
"cleaned up" back into the same breakage later. Removes the now-nonfunctional
manifests/gitea/gitea-postgres-secret.sh and its .env.example entry. Getting
this fully off plaintext would need a Config Management Plugin or similar --
not attempted here.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
70 lines
1.9 KiB
YAML
70 lines
1.9 KiB
YAML
# Apply: helm upgrade --install gitea gitea-charts/gitea -f values/gitea.yaml -n gitea --create-namespace
|
|
# Description: Helm values for Gitea git server and Docker registry
|
|
|
|
replicaCount: 1
|
|
|
|
image:
|
|
tag: "1.23"
|
|
|
|
gitea:
|
|
admin:
|
|
existingSecret: gitea-admin-secret
|
|
email: nik@nik4nao.com
|
|
|
|
config:
|
|
server:
|
|
DOMAIN: gitea.nik4nao.com
|
|
ROOT_URL: https://gitea.nik4nao.com
|
|
SSH_DOMAIN: gitea.nik4nao.com
|
|
SSH_PORT: 2222
|
|
repository:
|
|
DEFAULT_PRIVATE: true
|
|
service:
|
|
DISABLE_REGISTRATION: true
|
|
ALLOW_ONLY_EXTERNAL_SELF_REGISTRATION: false
|
|
auth:
|
|
LOCAL_REGISTRATION_DISABLED: true
|
|
|
|
persistence:
|
|
enabled: true
|
|
storageClass: ""
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
size: 10Gi
|
|
volumeName: ""
|
|
existingClaim: ""
|
|
annotations:
|
|
helm.sh/resource-policy: keep
|
|
|
|
postgresql:
|
|
enabled: true
|
|
primary:
|
|
persistence:
|
|
annotations:
|
|
helm.sh/resource-policy: keep
|
|
global:
|
|
postgresql:
|
|
auth:
|
|
# NOTE: this chart's own template (templates/gitea/config.yaml) always
|
|
# reads this plaintext field directly to build gitea's [database]
|
|
# config section -- `existingSecret` only affects the bundled
|
|
# postgresql subchart's own credential provisioning, not what Gitea
|
|
# itself connects with. There is no existingSecret-based way to keep
|
|
# this out of git with this specific chart short of a Config
|
|
# Management Plugin. Do not "clean this up" back to existingSecret
|
|
# without also patching the chart's config template -- doing so
|
|
# silently reverts to the chart's built-in default password and
|
|
# breaks Gitea's DB connection (confirmed the hard way on 2026-07-23).
|
|
username: gitea
|
|
database: gitea
|
|
password: ySelvqn2LjZ1fdJ4OFQs5ZlK6VLxHdny
|
|
|
|
service:
|
|
ssh:
|
|
type: LoadBalancer
|
|
port: 2222
|
|
loadBalancerIP: 192.168.7.77
|
|
|
|
postgresql-ha:
|
|
enabled: false
|