Gitea + CI: git.carr.pub, NFS storage class, 3 runners

manifests/git/act-runner.yaml

@@ -0,0 +1,75 @@
+# act_runner x3 with docker-in-docker sidecars, so Gitea Actions jobs
+# run as containers on the worker nodes (ARM64).
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: act-runner
+  namespace: git
+spec:
+  replicas: 3
+  selector:
+    matchLabels: {app: act-runner}
+  template:
+    metadata:
+      labels: {app: act-runner}
+    spec:
+      containers:
+        - name: runner
+          image: gitea/act_runner:latest
+          env:
+            - {name: GITEA_INSTANCE_URL, value: "http://gitea.git.svc:3000"}
+            - {name: GITEA_RUNNER_REGISTRATION_TOKEN, value: "eEsa5oEXUCQyTM6Gj9iAqDzofDj0TmoTYftyPOLd"}
+            - {name: DOCKER_HOST, value: "tcp://127.0.0.1:2375"}
+            - {name: CONFIG_FILE, value: /config/config.yaml}
+          resources:
+            requests: {cpu: 50m, memory: 64Mi}
+            limits: {memory: 256Mi}
+          volumeMounts:
+            - {name: work, mountPath: /data}
+            - {name: config, mountPath: /config}
+        - name: dind
+          image: docker:27-dind
+          securityContext:
+            privileged: true
+          env:
+            - {name: DOCKER_TLS_CERTDIR, value: ""}
+          resources:
+            requests: {cpu: 100m, memory: 256Mi}
+            limits: {memory: 1Gi}
+          volumeMounts:
+            - {name: work, mountPath: /data}
+      volumes:
+        - name: work
+          emptyDir: {}
+        - name: config
+          configMap: {name: act-runner-config}
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                  matchLabels: {app: act-runner}
+                topologyKey: kubernetes.io/hostname
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: act-runner-config
+  namespace: git
+data:
+  config.yaml: |
+    runner:
+      capacity: 4
+      timeout: 30m
+      insecure: false
+      fetch_timeout: 5s
+      labels:
+        - "arm64:host"
+        - "ubuntu-latest:docker://node:22-bookworm"
+    cache:
+      enabled: false
+    container:
+      privileged: false
+      options: ""
+      valid_volumes: []

manifests/git/gitea.yaml

@@ -0,0 +1,86 @@
+# Gitea: git hosting + CI, with repo data on Synology NFS.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: git
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-data
+  namespace: git
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: nfs-synology
+  resources:
+    requests: {storage: 20Gi}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea
+  namespace: git
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels: {app: gitea}
+  template:
+    metadata:
+      labels: {app: gitea}
+    spec:
+      containers:
+        - name: gitea
+          image: gitea/gitea:1.24
+          env:
+            - {name: USER_UID, value: "1000"}
+            - {name: USER_GID, value: "1000"}
+            - {name: GITEA__database__DB_TYPE, value: sqlite3}
+            - {name: GITEA__server__DOMAIN, value: git.carr.pub}
+            - {name: GITEA__server__ROOT_URL, value: "https://git.carr.pub/"}
+            - {name: GITEA__server__HTTP_PORT, value: "3000"}
+            - {name: GITEA__actions__ENABLED, value: "true"}
+            - {name: GITEA__service__DISABLE_REGISTRATION, value: "true"}
+          ports: [{containerPort: 3000}]
+          resources:
+            requests: {cpu: 100m, memory: 256Mi}
+            limits: {memory: 1Gi}
+          volumeMounts:
+            - {name: data, mountPath: /data}
+      volumes:
+        - name: data
+          persistentVolumeClaim: {claimName: gitea-data}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea
+  namespace: git
+spec:
+  selector: {app: gitea}
+  ports:
+    - port: 3000
+      targetPort: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea
+  namespace: git
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    # NOTE: intentionally NOT behind the SSO gate - git clients and CI
+    # need direct token auth; Gitea has its own accounts
+spec:
+  tls:
+    - hosts: [git.carr.pub]
+      secretName: git-carr-pub-tls
+  rules:
+    - host: git.carr.pub
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service: {name: gitea, port: {number: 3000}}