mirror of
https://github.com/Alkatrazz24/Funk-lab.git
synced 2026-07-08 21:44:42 +02:00
ALI YESILKAYA
224c06041e
- k8s/apps/forgejo : deployment (image forgejo:11, config par env), service, PVC nfs, IngressRoute interne (git.lab.local) + publique (git.funklab.online + middlewares security-headers/ratelimit), Application ArgoCD (ns ai, recurse) - base PostgreSQL `forgejo` sur storage-01 (rôle postgresql) - vault : vault_pg_forgejo_password + vault_forgejo_oauth_client_secret - doc admin/k8s/forgejo.md (archi, OIDC, création du miroir, pièges) + index + CLAUDE.md GitHub reste la source de vérité (pull-mirror lecture seule) — ArgoCD inchangé. Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
99 lines
3.4 KiB
YAML
99 lines
3.4 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
name: forgejo
|
|
namespace: ai
|
|
spec:
|
|
replicas: 1
|
|
strategy:
|
|
type: Recreate # PVC RWO : pas de deux pods qui montent /data en parallèle
|
|
selector:
|
|
matchLabels:
|
|
app: forgejo
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: forgejo
|
|
spec:
|
|
containers:
|
|
- name: forgejo
|
|
image: codeberg.org/forgejo/forgejo:11
|
|
ports:
|
|
- containerPort: 3000
|
|
name: http
|
|
env:
|
|
# --- Base PostgreSQL sur storage-01 (hors cluster), pattern Ghostfolio/n8n ---
|
|
- name: FORGEJO__database__DB_TYPE
|
|
value: "postgres"
|
|
- name: FORGEJO__database__HOST
|
|
value: "192.168.10.1:5432"
|
|
- name: FORGEJO__database__NAME
|
|
value: "forgejo"
|
|
- name: FORGEJO__database__USER
|
|
value: "forgejo"
|
|
- name: FORGEJO__database__PASSWD
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: forgejo-secret
|
|
key: pg-password
|
|
# --- Serveur : URL canonique = domaine HTTPS (split-horizon dnsmasq en LAN) ---
|
|
- name: FORGEJO__server__DOMAIN
|
|
value: "git.funklab.online"
|
|
- name: FORGEJO__server__ROOT_URL
|
|
value: "https://git.funklab.online/"
|
|
- name: FORGEJO__server__HTTP_PORT
|
|
value: "3000"
|
|
# Pas de git-over-SSH : miroir + consultation en HTTPS uniquement (aucun
|
|
# port 22 supplémentaire exposé). Le clone/pull passe par HTTPS.
|
|
- name: FORGEJO__server__DISABLE_SSH
|
|
value: "true"
|
|
# --- Service : inscription fermée → connexion via SSO Authentik uniquement ---
|
|
- name: FORGEJO__service__DISABLE_REGISTRATION
|
|
value: "true"
|
|
# Autorise la création de compte au 1er login OIDC (source externe)
|
|
- name: FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION
|
|
value: "true"
|
|
- name: FORGEJO__service__ENABLE_BASIC_AUTHENTICATION
|
|
value: "true" # clone HTTPS avec token perso
|
|
# --- Sécurité : install déjà verrouillée (config par env), clé stable ---
|
|
- name: FORGEJO__security__INSTALL_LOCK
|
|
value: "true"
|
|
- name: FORGEJO__security__SECRET_KEY
|
|
valueFrom:
|
|
secretKeyRef:
|
|
name: forgejo-secret
|
|
key: secret-key
|
|
- name: FORGEJO__migrations__ALLOWED_DOMAINS
|
|
value: "github.com" # miroir : ne tire que depuis GitHub
|
|
- name: USER_UID
|
|
value: "1000"
|
|
- name: USER_GID
|
|
value: "1000"
|
|
- name: TZ
|
|
value: "Europe/Paris"
|
|
volumeMounts:
|
|
- name: data
|
|
mountPath: /data
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
limits:
|
|
cpu: "1000m"
|
|
memory: 768Mi
|
|
readinessProbe:
|
|
httpGet:
|
|
path: /api/healthz
|
|
port: 3000
|
|
initialDelaySeconds: 20
|
|
periodSeconds: 15
|
|
livenessProbe:
|
|
httpGet:
|
|
path: /api/healthz
|
|
port: 3000
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 30
|
|
volumes:
|
|
- name: data
|
|
persistentVolumeClaim:
|
|
claimName: forgejo-data
|