apiVersion: v1
kind: Service
metadata:
  name: forgejo-tailscale
  namespace: forgejo
  annotations:
    tailscale.com/expose: "true"
    tailscale.com/hostname: "git"
    tailscale.com/tags: "tag:k8s"
    # Enable HTTPS with serve
    tailscale.com/serve-config: |
      {
        "TCP": {
          "443": {
            "HTTPS": true
          }
        },
        "Web": {
          "${TS_CERT_DOMAIN}:443": {
            "Handlers": {
              "/": {
                "Proxy": "http://forgejo.forgejo.svc.cluster.local:80"
              }
            }
          }
        }
      }
spec:
  type: LoadBalancer
  loadBalancerClass: tailscale
  selector:
    app: forgejo
  ports:
  - port: 443
    targetPort: 3000
    protocol: TCP
    name: https
  - port: 22
    targetPort: 2222
    protocol: TCP
    name: ssh