Revert forgejo migration

apps/prod/gitea/ingress.yaml

@@ -0,0 +1,15 @@
+# /apps/prod/gitea/ingress.yaml
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: gitea-web-ingress
+  namespace: gitea
+spec:
+  entryPoints:
+    - websecure
+  routes:
+  - match: Host(`${GITEA_DOMAIN}`)
+    kind: Rule
+    services:
+    - name: gitea-http
+      port: 3000

apps/prod/gitea/kustomization.yaml

@@ -0,0 +1,19 @@
+# /apps/prod/gitea/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: gitea
+
+resources:
+  - ../../base/gitea
+  - secret.enc.yaml
+  - release.yaml
+  - ingress.yaml
+
+configMapGenerator:
+  - name: gitea-prod-values
+    namespace: gitea
+    files:
+      - values.yaml
+
+configurations:
+  - kustomizeconfig.yaml

apps/prod/gitea/kustomizeconfig.yaml

@@ -0,0 +1,7 @@
+# /apps/prod/gitea/kustomizeconfig.yaml
+nameReference:
+- kind: ConfigMap
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease

apps/prod/gitea/release.yaml

@@ -0,0 +1,20 @@
+# /apps/prod/gitea/release.yaml
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea
+  namespace: gitea
+spec:
+  interval: 1h
+  chart:
+    spec:
+      chart: gitea
+      version: 10.6.0
+      sourceRef:
+        kind: HelmRepository
+        name: gitea
+        namespace: gitea
+      interval: 1h
+  valuesFrom:
+    - kind: ConfigMap
+      name: gitea-prod-values

apps/prod/gitea/secret.enc.yaml

@@ -0,0 +1,29 @@
+#ENC[AES256_GCM,data:qc0a9pEqZy+CSiZBSRDdqQIuvIZvI9xQwKtM2J1a6P2s,iv:TVeB+seBchMpuor8l1hxnj3Kv9FfADgL5G927Jtvk+0=,tag:PwNysdB1TlyIvVqtJW+ntw==,type:comment]
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-admin-secret
+    namespace: gitea
+stringData:
+    username: ENC[AES256_GCM,data:ZjFHZbQX,iv:ZeUFu0OpXuooA6ZoRCO4yUNi1PCB6H0FAI7+1c9YLGk=,tag:+QFpdQ/7MjxEuFkfkAHqBQ==,type:str]
+    password: ENC[AES256_GCM,data:lChzETDJOvaB97g2BCeLAW0+eWs=,iv:Pc20LS84UpQzz68bjauDAGmpPH2+pSfIUE/NXmmwlqI=,tag:ojI8smGTNp+GyaZMEB3UIA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1jk99rtxq3ep2xj2w886cchddf7jypqpwkr3dszg5dzq93gn8cy9qyc786m
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMT1h2S1UyTlZDaHJTUFZU
+            MitnbEV4UHF0Q3B1QmhFMzZIQjBvUG90TTBjCkcrZ2ZISmdWK1JzMEVrOEVhdFlZ
+            SXJ0OGhMUG0rc1U2NHFaQkZxNnJMM2MKLS0tIEFRVDNNcVBjYnJYOFY3M1hlSXV3
+            aTF0R0RZUHZWNDNWU1dZb3IyVnBEcncKATaL5sPeFTk0lqjENM4y1xBp+h/uN8hH
+            pQLQkOAwytW5xcQQOLAiNW54KK6TyeUMDzYLP+4Eq6wnQM+gymFY9A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-16T12:44:22Z"
+    mac: ENC[AES256_GCM,data:0gytbbuY/8FyHPKmLLSKPbEIfmrQXy/KtdvMVdun6VcHK+8csjOdPPYpoTo3FfbTbdl9LMbJ3Hs4L0hY8RZ9bV0xCcnE8MOIOyErfoS2MGQ3BdiBSbwBPN362VlQZCYqYri+8NMtbneGESSCM5yWNmd+68MZMr06pfU4m+bDxuo=,iv:9nboSOtS3/AMJT9xqgoqELpNyjS2S8FG/NLmt1Y74eI=,tag:1EyAZJ1Y4cuqCKBlaY8Msg==,type:str]
+    pgp: []
+    unencrypted_regex: ^(apiVersion|metadata|kind|type)$
+    version: 3.9.1

apps/prod/gitea/values.yaml

@@ -0,0 +1,71 @@
+# /apps/prod/gitea/values.yaml
+redis-cluster:
+  enabled: false
+postgresql-ha:
+  enabled: false
+postgresql:
+  enabled: true
+  image:
+    registry: docker.io
+    repository: bitnami/postgresql
+    tag: 17.2.0-debian-12-r10
+    digest: sha256:fff6086d557d962422c6d751b6723877642170bbcc25d6f23e5c2c2f079987d5
+  primary:
+    persistence:
+      storageClass: retain-local-path
+
+persistence:
+  enabled: true
+  storageClass: retain-local-path
+
+image:
+  rootless: true
+
+gitea:
+  admin:
+    existingSecret: gitea-admin-secret
+    email: "${GITEA_ADMIN_EMAIL}"
+  config:
+    actions:
+      ENABLED: true
+    federation:
+      ENABLED: true
+    database:
+      DB_TYPE: postgres
+    session:
+      PROVIDER: db
+    cache:
+      ADAPTER: memory
+    queue:
+      TYPE: channel
+    server:
+      BUILTIN_SSH_SERVER_USER: git
+      ROOT_URL: https://${GITEA_DOMAIN}
+      DOMAIN: ${GITEA_DOMAIN}
+      SSH_CREATE_AUTHORIZED_KEYS_FILE: false
+      LANDING_PAGE: explore
+    service:
+      REGISTER_MANUAL_CONFIRM: true
+    indexer:
+      ISSUE_INDEXER_TYPE: bleve
+      REPO_INDEXER_ENABLED: true
+
+service:
+  http:
+    type: ClusterIP
+    port: 3000
+    clusterIP:
+  ssh:
+    type: ClusterIP
+    port: 22
+
+podSecurityContext:
+  fsGroup: 1001
+
+containerSecurityContext:
+  runAsGroup: 1001
+  runAsNonRoot: true
+  runAsUser: 1001
+
+test:
+  enabled: false