graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

remove forgejo

Browse source
This commit is contained in:
Graham McIntire 2025-10-18 10:31:45 -05:00
parent 8c3257ecdf
commit 153f43ab61
No known key found for this signature in database
19 changed files with 0 additions and 631 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

104
home/cluster/forgejo/README.md
View file

@ -1,104 +0,0 @@
# Forgejo Deployment on Home K3s Cluster
This deploys Forgejo (Git server) on the home k3s cluster using the existing MariaDB instance.
## Prerequisites
1. MariaDB is already running in the `data` namespace
2. Longhorn storage class is available
3. MetalLB is configured for LoadBalancer services
## Setup Steps
### 1. Create Database
First, create the database and user in MariaDB:
```bash
# Run the setup script to see the commands
./setup-database.sh
# Connect to MariaDB
kubectl exec -it -n data deployment/mariadb -- mysql -u root -p
# Create database and user (update password!)
CREATE DATABASE IF NOT EXISTS forgejo CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS 'forgejo'@'%' IDENTIFIED BY 'your-secure-password';
GRANT ALL PRIVILEGES ON forgejo.* TO 'forgejo'@'%';
FLUSH PRIVILEGES;
EXIT;
```
### 2. Update Secrets
Edit `secret.yaml` and update:
- `database-password`: Use the same password you set in MariaDB
- `secret-key`: Generate a random 64-character string
- `internal-token`: Generate a random 106-character string
You can generate random strings with:
```bash
# 64 characters
openssl rand -hex 32
# 106 characters
openssl rand -hex 53
```
### 3. Deploy Forgejo
```bash
# Deploy all resources
kubectl apply -k .
# Check deployment status
kubectl get all -n git
# Watch the logs
kubectl logs -n git deployment/forgejo -f
```
### 4. Access Forgejo
Once the LoadBalancer gets an IP:
```bash
kubectl get svc -n git forgejo
```
Access Forgejo at:
- Web UI: http://<EXTERNAL-IP>
- Git SSH: ssh://git@<EXTERNAL-IP>:22/
### 5. Initial Setup
On first access:
1. The initial setup page should show
2. Database settings should be pre-filled
3. Create your admin account
4. Complete the setup
## Configuration
The configuration is managed via ConfigMap. Key settings:
- Domain: git.w5isp.com
- SSH enabled on port 22
- LFS (Large File Storage) enabled
- Using MariaDB in the data namespace
## Troubleshooting
Check logs:
```bash
kubectl logs -n git deployment/forgejo
```
Check database connection:
```bash
kubectl exec -n git deployment/forgejo -- nc -zv mariadb.data.svc.cluster.local 3306
```
## Backup
Remember to backup:
- The Longhorn PVC (forgejo-data)
- The MariaDB forgejo database

64
home/cluster/forgejo/configmap-app.yaml
View file

@ -1,64 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: forgejo-app-config
namespace: forgejo
data:
app.ini: |
; Forgejo configuration
[database]
DB_TYPE = postgres
HOST = 10.0.19.5:5432
NAME = forgejo
USER = forgejo
PASSWD = fj8K3n2Qp9Lx5mW7
SSL_MODE = disable
[server]
DOMAIN = 10.0.19.3
ROOT_URL = http://10.0.19.3/
HTTP_PORT = 3000
SSH_DOMAIN = 10.0.19.3
SSH_PORT = 2222
START_SSH_SERVER = true
OFFLINE_MODE = true
[service]
DISABLE_REGISTRATION = false
REQUIRE_SIGNIN_VIEW = false
DEFAULT_KEEP_EMAIL_PRIVATE = true
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
[security]
INSTALL_LOCK = true
SECRET_KEY = changemechangemechangemechangeme
INTERNAL_TOKEN = changemetoochangemetoochangemetoo
[log]
LEVEL = Info
ROOT_PATH = /data/gitea/log
[repository]
ROOT = /data/git/repositories
[repository.local]
LOCAL_COPY_PATH = /data/gitea/tmp/local-repo
[repository.upload]
TEMP_PATH = /data/gitea/uploads
[session]
PROVIDER = file
[picture]
AVATAR_UPLOAD_PATH = /data/gitea/avatars
[attachment]
PATH = /data/gitea/attachments
[indexer]
ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
[DEFAULT]
APP_NAME = w5isp's code

76
home/cluster/forgejo/configmap.yaml
View file

@ -1,76 +0,0 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: forgejo-config
namespace: git
data:
app.ini: |
APP_NAME = Forgejo
RUN_MODE = prod
RUN_USER = git
[server]
DOMAIN = git.w5isp.com
ROOT_URL = https://git.w5isp.com/
HTTP_PORT = 3000
SSH_DOMAIN = 10.0.101.31
SSH_PORT = 22
START_SSH_SERVER = true
SSH_LISTEN_PORT = 22
LFS_START_SERVER = true
OFFLINE_MODE = false
[database]
DB_TYPE = mysql
HOST = mariadb.data.svc.cluster.local:3306
NAME = forgejo
USER = forgejo
[repository]
ROOT = /data/gitea-repositories
[lfs]
PATH = /data/lfs
[attachment]
PATH = /data/attachments
[picture]
AVATAR_UPLOAD_PATH = /data/avatars
REPOSITORY_AVATAR_UPLOAD_PATH = /data/repo-avatars
[log]
ROOT_PATH = /data/log
MODE = console
LEVEL = Info
[security]
INSTALL_LOCK = true
SECRET_KEY = ${FORGEJO_SECRET_KEY}
INTERNAL_TOKEN = ${FORGEJO_INTERNAL_TOKEN}
[service]
DISABLE_REGISTRATION = true
REQUIRE_SIGNIN_VIEW = false
ENABLE_NOTIFY_MAIL = false
DEFAULT_KEEP_EMAIL_PRIVATE = true
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
[mailer]
ENABLED = false
[session]
PROVIDER = file
PROVIDER_CONFIG = /data/sessions
COOKIE_NAME = i_like_gitea
COOKIE_SECURE = false
[cache]
ENABLED = true
ADAPTER = memory
[ui]
DEFAULT_THEME = auto
[webhook]
ALLOWED_HOST_LIST = *

89
home/cluster/forgejo/deployment.yaml
View file

@ -1,89 +0,0 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: forgejo
namespace: git
spec:
replicas: 1
selector:
matchLabels:
app: forgejo
template:
metadata:
labels:
app: forgejo
spec:
containers:
- name: forgejo
image: codeberg.org/forgejo/forgejo:9
ports:
- containerPort: 3000
name: http
- containerPort: 22
name: ssh
env:
- name: USER_UID
value: "1000"
- name: USER_GID
value: "1000"
- name: FORGEJO_CUSTOM
value: /data/gitea
- name: FORGEJO_APP_INI
value: /etc/forgejo/app.ini
- name: FORGEJO__database__PASSWD
valueFrom:
secretKeyRef:
name: forgejo-secret
key: database-password
- name: FORGEJO__security__SECRET_KEY
valueFrom:
secretKeyRef:
name: forgejo-secret
key: secret-key
- name: FORGEJO__security__INTERNAL_TOKEN
valueFrom:
secretKeyRef:
name: forgejo-secret
key: internal-token
- name: FORGEJO_SECRET_KEY
valueFrom:
secretKeyRef:
name: forgejo-secret
key: secret-key
- name: FORGEJO_INTERNAL_TOKEN
valueFrom:
secretKeyRef:
name: forgejo-secret
key: internal-token
volumeMounts:
- name: data
mountPath: /data
- name: config
mountPath: /etc/forgejo/app.ini
subPath: app.ini
resources:
requests:
cpu: 100m
memory: 256Mi
limits:
cpu: 1000m
memory: 1Gi
livenessProbe:
httpGet:
path: /
port: 3000
initialDelaySeconds: 30
periodSeconds: 10
readinessProbe:
httpGet:
path: /
port: 3000
initialDelaySeconds: 5
periodSeconds: 5
volumes:
- name: data
persistentVolumeClaim:
claimName: forgejo-data
- name: config
configMap:
name: forgejo-config

15
home/cluster/forgejo/ingress-tailscale-fixed.yaml
View file

@ -1,15 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: forgejo
namespace: forgejo
spec:
defaultBackend:
service:
name: forgejo
port:
number: 80
ingressClassName: tailscale
tls:
- hosts:
- git

18
home/cluster/forgejo/ingress-tailscale.yaml
View file

@ -1,18 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: forgejo-tailscale
namespace: forgejo
annotations:
tailscale.com/hostname: "git"
tailscale.com/tags: "tag:k8s"
spec:
ingressClassName: tailscale
defaultBackend:
service:
name: forgejo
port:
number: 80
tls:
- hosts:
- git

25
home/cluster/forgejo/ingress.yaml
View file

@ -1,25 +0,0 @@
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: forgejo-ingress
namespace: git
annotations:
cert-manager.io/cluster-issuer: "letsencrypt-prod"
traefik.ingress.kubernetes.io/router.entrypoints: "websecure"
spec:
ingressClassName: traefik
tls:
- hosts:
- git.w5isp.com
secretName: forgejo-tls
rules:
- host: git.w5isp.com
http:
paths:
- path: /
pathType: Prefix
backend:
service:
name: forgejo
port:
number: 80

14
home/cluster/forgejo/kustomization.yaml
View file

@ -1,14 +0,0 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: git
resources:
- namespace.yaml
- secret.yaml
- configmap.yaml
- pvc.yaml
- deployment.yaml
- service.yaml
- service-tailscale.yaml
- ingress.yaml

4
home/cluster/forgejo/namespace.yaml
View file

@ -1,4 +0,0 @@
apiVersion: v1
kind: Namespace
metadata:
name: git

45
home/cluster/forgejo/pv-rbd.yaml
View file

@ -1,45 +0,0 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: forgejo-rbd-pv
spec:
capacity:
storage: 50Gi
accessModes:
- ReadWriteOnce
persistentVolumeReclaimPolicy: Retain
storageClassName: ceph-rbd-static
rbd:
monitors:
- 10.0.16.231:6789
- 10.0.16.232:6789
- 10.0.16.233:6789
pool: kubernetes
image: forgejo-data
user: kubernetes
secretRef:
name: ceph-secret
namespace: forgejo
---
apiVersion: v1
kind: Secret
metadata:
name: ceph-secret
namespace: forgejo
type: kubernetes.io/rbd
data:
key: QVFBcTE0Sm8vZzRaT1JBQXd4cFBPbXFqMVBZZ21paDZzNmI0dkE9PQ== # Base64 encoded: AQAq14Jo/g4ZORAAwxpPOmqj1PYgmih6s6b4vA==
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: forgejo-data-rbd
namespace: forgejo
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 50Gi
storageClassName: ceph-rbd-static
volumeName: forgejo-rbd-pv

14
home/cluster/forgejo/pv.yaml
View file

@ -1,14 +0,0 @@
apiVersion: v1
kind: PersistentVolume
metadata:
name: nfs-forgejo
spec:
capacity:
storage: 50Gi
accessModes:
- ReadWriteMany
nfs:
server: 10.0.16.231
path: /mnt/cephfs-kubernetes/volumes/forgejo
persistentVolumeReclaimPolicy: Retain
storageClassName: nfs-forgejo

14
home/cluster/forgejo/pvc-rbd.yaml
View file

@ -1,14 +0,0 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: forgejo-data-rbd-dynamic
namespace: forgejo
annotations:
volume.beta.kubernetes.io/mount-options: "discard"
spec:
accessModes:
- ReadWriteOnce
storageClassName: ceph-rbd
resources:
requests:
storage: 50Gi

12
home/cluster/forgejo/pvc.yaml
View file

@ -1,12 +0,0 @@
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
name: forgejo-data
namespace: git
spec:
accessModes:
- ReadWriteOnce
storageClassName: longhorn
resources:
requests:
storage: 10Gi

10
home/cluster/forgejo/secret.yaml
View file

@ -1,10 +0,0 @@
apiVersion: v1
kind: Secret
metadata:
name: forgejo-secret
namespace: git
type: Opaque
stringData:
database-password: "nJWD2Iv44Y2j4eQSFupjq9fBKX3rI6pg"
secret-key: "a3995159a70c868e5815d6f5b097d4e347ab12b5d16621ec0075694e99cf8751"
internal-token: "07715ac60541b6de1f1933a53e518614fc18a07666706c47875d7a8d98015266c1ea8cf3c38719a77842d1bc7b73749006c8079e9e"

41
home/cluster/forgejo/service-tailscale-https.yaml
View file

@ -1,41 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: forgejo-tailscale
namespace: forgejo
annotations:
tailscale.com/expose: "true"
tailscale.com/hostname: "git"
tailscale.com/tags: "tag:k8s"
# Enable HTTPS with serve
tailscale.com/serve-config: |
{
"TCP": {
"443": {
"HTTPS": true
}
},
"Web": {
"${TS_CERT_DOMAIN}:443": {
"Handlers": {
"/": {
"Proxy": "http://forgejo.forgejo.svc.cluster.local:80"
}
}
}
}
}
spec:
type: LoadBalancer
loadBalancerClass: tailscale
selector:
app: forgejo
ports:
- port: 443
targetPort: 3000
protocol: TCP
name: https
- port: 22
targetPort: 2222
protocol: TCP
name: ssh

21
home/cluster/forgejo/service-tailscale.yaml
View file

@ -1,21 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: forgejo-tailscale
namespace: git
annotations:
tailscale.com/expose: "true"
tailscale.com/hostname: "git"
spec:
type: ClusterIP
selector:
app: forgejo
ports:
- name: http
port: 80
targetPort: 3000
protocol: TCP
- name: ssh
port: 22
targetPort: 22
protocol: TCP

18
home/cluster/forgejo/service.yaml
View file

@ -1,18 +0,0 @@
apiVersion: v1
kind: Service
metadata:
name: forgejo
namespace: git
spec:
type: LoadBalancer
selector:
app: forgejo
ports:
- name: http
port: 80
targetPort: 3000
protocol: TCP
- name: ssh
port: 22
targetPort: 22
protocol: TCP

23
home/cluster/forgejo/setup-database-auto.sh
View file

@ -1,23 +0,0 @@
#!/bin/bash
# Script to automatically set up Forgejo database in MariaDB
echo "Setting up Forgejo database in MariaDB..."
echo ""
# Create SQL commands file
cat > /tmp/forgejo-db-setup.sql << 'EOF'
CREATE DATABASE IF NOT EXISTS forgejo CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS 'forgejo'@'%' IDENTIFIED BY 'd3hqtvHKzvcovdXtF7t8bq35Ancya90x';
GRANT ALL PRIVILEGES ON forgejo.* TO 'forgejo'@'%';
FLUSH PRIVILEGES;
EOF
echo "Run this command on the k3s cluster (you'll need the MariaDB root password):"
echo ""
echo "kubectl exec -n data deployment/mariadb -- mysql -u root -p < /tmp/forgejo-db-setup.sql"
echo ""
echo "Or manually run these commands after connecting to MariaDB:"
echo ""
cat /tmp/forgejo-db-setup.sql
echo ""
echo "Database password for Forgejo: d3hqtvHKzvcovdXtF7t8bq35Ancya90x"

24
home/cluster/forgejo/setup-database.sh
View file

@ -1,24 +0,0 @@
#!/bin/bash
# Script to create Forgejo database and user in MariaDB
echo "This script will help you set up the Forgejo database in MariaDB."
echo "You'll need the MariaDB root password."
echo ""
echo "Run these commands on the k3s cluster:"
echo ""
echo "# Connect to MariaDB pod"
echo "kubectl exec -it -n data deployment/mariadb -- mysql -u root -p"
echo ""
echo "# Then run these SQL commands:"
cat << 'EOF'
CREATE DATABASE IF NOT EXISTS forgejo CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
CREATE USER IF NOT EXISTS 'forgejo'@'%' IDENTIFIED BY 'changeme';
GRANT ALL PRIVILEGES ON forgejo.* TO 'forgejo'@'%';
FLUSH PRIVILEGES;
EXIT;
EOF
echo ""
echo "Remember to:"
echo "1. Update the password in the SQL command above"
echo "2. Update the same password in secret.yaml"
echo "3. Generate random strings for secret-key and internal-token in secret.yaml"