akadmin/Funk-lab
1
0
Fork 0
mirror of https://github.com/Alkatrazz24/Funk-lab.git synced 2026-07-08 05:44:43 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(forgejo): Git self-host en miroir de GitHub (git.funklab.online, SSO Authentik) (#96)

Browse source 
- k8s/apps/forgejo : deployment (image forgejo:11, config par env), service, PVC nfs,
  IngressRoute interne (git.lab.local) + publique (git.funklab.online + middlewares
  security-headers/ratelimit), Application ArgoCD (ns ai, recurse)
- base PostgreSQL `forgejo` sur storage-01 (rôle postgresql)
- vault : vault_pg_forgejo_password + vault_forgejo_oauth_client_secret
- doc admin/k8s/forgejo.md (archi, OIDC, création du miroir, pièges) + index + CLAUDE.md

GitHub reste la source de vérité (pull-mirror lecture seule) — ArgoCD inchangé.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
ALI YESILKAYA 2026-07-07 23:20:33 +02:00 • committed by GitHub
parent fe0aa89ffa
commit 224c06041e
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
12 changed files with 498 additions and 163 deletions
Download patch file Download diff file Expand all files Collapse all files

5
CLAUDE.md
View file

@ -127,6 +127,7 @@ Variables chiffrées dans `ansible/group_vars/all/vault.yml` :
- `vault_authentik_secret_key`, `vault_authentik_redis_password` — copies de sûreté des valeurs du secret k8s `auth/authentik-secret`
- `vault_wireguard_server_private_key`, `vault_wireguard_peer_private_keys` — clés WireGuard (serveur + dict par pair)
- `vault_grafana_oauth_client_secret`, `vault_openwebui_oauth_client_secret`, `vault_argocd_oidc_client_secret` — secrets clients OIDC des apps du hub (= secrets k8s `monitoring/grafana-oauth-secret`, `ai/open-webui-oauth`, `argocd/argocd-oidc`)
- `vault_pg_forgejo_password`, `vault_forgejo_oauth_client_secret` — Forgejo (Git self-host) : base PG `forgejo` (= `ai/forgejo-secret`) + client secret OIDC Authentik
---
@ -171,6 +172,7 @@ k8s/
│ ├── ghostfolio.yaml
│ ├── openalice.yaml
│ ├── finlab.yaml
│ ├── forgejo.yaml
│ ├── authentik.yaml
│ ├── guacamole.yaml
│ ├── monitoring.yaml
@ -183,6 +185,7 @@ k8s/
│ ├── ghostfolio/ # namespace: ai — suivi de portefeuille (ghostfolio.lab.local)
│ ├── openalice/ # namespace: ai — agent IA financier (openalice.lab.local, back-end finance d'Asa) — ⏸️ SUSPENDU
│ ├── finlab/ # namespace: ai — dashboard finance + console Claude Code (finance.lab.local, /console) + toolkit
│ ├── forgejo/ # namespace: ai — Git self-host, miroir GitHub (git.funklab.online, SSO)
│ ├── authentik/ # namespace: auth — annuaire/IdP OIDC (auth.lab.local)
│ ├── guacamole/ # namespace: auth — portail consoles SSH web s01/g01 (portail.lab.local)
│ └── {external-services}/ # ExternalName/Endpoints pointant vers storage-01 ou gpu-01
@ -202,7 +205,7 @@ k8s/
2. Créer `k8s/apps-of-apps/apps/<nom>.yaml` (ArgoCD Application CRD) — copier `n8n.yaml` comme modèle
3. `git commit` + `git push` → ArgoCD prend en charge automatiquement
Namespaces actifs : `argocd`, `infra` (Traefik, MetalLB, NFS-provisioner, registry in-cluster), `monitoring` (Prometheus/Grafana), `ai` (n8n, open-webui, stt, searxng, ghostfolio, openalice, finlab), `auth` (Authentik, Guacamole), `sacrifice` (jeu FPS — déployé hors de ce repo et hors ArgoCD, cf. `admin/ops/etat-cluster.md`).
Namespaces actifs : `argocd`, `infra` (Traefik, MetalLB, NFS-provisioner, registry in-cluster), `monitoring` (Prometheus/Grafana), `ai` (n8n, open-webui, stt, searxng, ghostfolio, openalice, finlab, forgejo), `auth` (Authentik, Guacamole), `sacrifice` (jeu FPS — déployé hors de ce repo et hors ArgoCD, cf. `admin/ops/etat-cluster.md`).
> Les services du namespace `ai` sont exposés via des **IngressRoute Traefik** (CRD), pas des `Ingress` standards.