Migrate from gitea to forgejo

apps/prod/forgejo/ingress.yaml

@@ -0,0 +1,15 @@
+# /apps/prod/forgejo/ingress.yaml
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: forgejo-web-ingress
+  namespace: forgejo
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`${FORGEJO_DOMAIN}`)
+    kind: Rule
+    services:
+    - name: forgejo-http
+      port: 3000

apps/prod/forgejo/kustomization.yaml

@@ -0,0 +1,19 @@
+# /apps/prod/forgejo/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: forgejo
+
+resources:
+  - ../../base/forgejo
+  - secret.enc.yaml
+  - release.yaml
+  - ingress.yaml
+
+configMapGenerator:
+  - name: forgejo-prod-values
+    namespace: forgejo
+    files:
+      - values.yaml
+
+configurations:
+  - kustomizeconfig.yaml

apps/prod/forgejo/kustomizeconfig.yaml

@@ -0,0 +1,7 @@
+# /apps/prod/authelia/kustomizeconfig.yaml
+nameReference:
+- kind: ConfigMap
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease

apps/prod/forgejo/release.yaml

@@ -0,0 +1,20 @@
+# /apps/prod/forgejo/release.yaml
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: forgejo
+  namespace: forgejo
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: forgejo
+      version: 11.0.1
+      sourceRef:
+        kind: HelmRepository
+        name: forgejo
+        namespace: forgejo
+      interval: 1h
+  valuesFrom:
+    - kind: ConfigMap
+      name: forgejo-prod-values

apps/prod/forgejo/secret.enc.yaml

@@ -0,0 +1,29 @@
+# /apps/prod/forgejo/secret.enc.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+    name: forgejo-admin-secret
+    namespace: forgejo
+stringData:
+    username: ENC[AES256_GCM,data:1K7hWGJC,iv:SRYfP1NLS633JKNORnsFkBFXo5sP4ejWNj6r4NXbrrQ=,tag:kOfUyxznR8p8VsiYy//Ytg==,type:str]
+    password: ENC[AES256_GCM,data:6GstZlME7jdHkwmyKCp+G72j6yk=,iv:sMunSzr6NZq5QVuibItDJq6n/KM5F9+Ulgc3XLdXuEg=,tag:+/2eBSEJMggo2X1Ft8RIlw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1jk99rtxq3ep2xj2w886cchddf7jypqpwkr3dszg5dzq93gn8cy9qyc786m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzQXVTa2hVaTAvbzU3aUxS
+            OHNUZm40RXlXa1dzRE5tMndKU015RVNYY1hjCjY5WDFYOFBrOXcyZm4vMkhWc0c4
+            UkhSYkhyVEJ2V1c1UytOZUxOTUJQWjgKLS0tIER2OFNsQUdHdkxTdEpObFFJcUxP
+            MVZUOGNJOC9QMU9WSWY2eTJjdEZsK2cKvdCXFw0LGc2Fqcnjla8SON0Oonsnrzfc
+            4GS1TFZ6bv4djodgn2wl43HmrrEvdHal2+HBDKv4McJv4x/jKBFbnw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-24T17:35:23Z"
+    mac: ENC[AES256_GCM,data:MCbFvTfxsp1jEQngBp1dVZBHBagfogq4kUgpvHUG7xmzvSipicxnPdJe1bLdR/Ei8VWvU6O+PYn2jGBKxof8aYvEKUbMngq2fT26lhi/910pDMyEnp+HV4wJIdnIOwR3p8DMzw386ejlOxk+Q57/JvDoDuu1p7vWv9g+/6fxu2g=,iv:t8WGOMajR88BbW1M7NOigYnSFhZs+yW00Plq4dq57b0=,tag:Pvg6MdWhGslRTFI7XAseHw==,type:str]
+    pgp: []
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    version: 3.9.0

apps/prod/forgejo/values.yaml

@@ -0,0 +1,71 @@
+# /apps/prod/forgejo/values.yaml
+redis-cluster:
+  enabled: false
+postgresql-ha:
+  enabled: false
+postgresql:
+  enabled: true
+  image:
+    registry: docker.io
+    repository: bitnami/postgresql
+    tag: 17.2.0-debian-12-r8
+    digest: sha256:fff6086d557d962422c6d751b6723877642170bbcc25d6f23e5c2c2f079987d5
+  primary:
+    persistence:
+      storageClass: retain-local-path
+
+persistence:
+  enabled: true
+  storageClass: retain-local-path
+
+image:
+  rootless: true
+
+forgejo:
+  admin:
+    existingSecret: forgejo-admin-secret
+    email: "${FORGEJO_ADMIN_EMAIL}"
+  config:
+    actions:
+      ENABLED: true
+    federation:
+      ENABLED: true
+    database:
+      DB_TYPE: postgres
+    session:
+      PROVIDER: db
+    cache:
+      ADAPTER: memory
+    queue:
+      TYPE: channel
+    server:
+      BUILTIN_SSH_SERVER_USER: git
+      ROOT_URL: https://${FORGEJO_DOMAIN}
+      DOMAIN: ${FORGEJO_DOMAIN}
+      SSH_CREATE_AUTHORIZED_KEYS_FILE: false
+      LANDING_PAGE: explore
+    service:
+      REGISTER_MANUAL_CONFIRM: true
+    indexer:
+      ISSUE_INDEXER_TYPE: bleve
+      REPO_INDEXER_ENABLED: true
+
+service:
+  http:
+    type: ClusterIP
+    port: 3000
+    clusterIP:
+  ssh:
+    type: ClusterIP
+    port: 22
+
+podSecurityContext:
+  fsGroup: 1001
+
+containerSecurityContext:
+  runAsGroup: 1001
+  runAsNonRoot: true
+  runAsUser: 1001
+
+test:
+  enabled: false