Gitea + CI: git.carr.pub, NFS storage class, 3 runners

manifests/git/gitea.yaml

@@ -0,0 +1,86 @@
+# Gitea: git hosting + CI, with repo data on Synology NFS.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: git
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-data
+  namespace: git
+spec:
+  accessModes: [ReadWriteOnce]
+  storageClassName: nfs-synology
+  resources:
+    requests: {storage: 20Gi}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea
+  namespace: git
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels: {app: gitea}
+  template:
+    metadata:
+      labels: {app: gitea}
+    spec:
+      containers:
+        - name: gitea
+          image: gitea/gitea:1.24
+          env:
+            - {name: USER_UID, value: "1000"}
+            - {name: USER_GID, value: "1000"}
+            - {name: GITEA__database__DB_TYPE, value: sqlite3}
+            - {name: GITEA__server__DOMAIN, value: git.carr.pub}
+            - {name: GITEA__server__ROOT_URL, value: "https://git.carr.pub/"}
+            - {name: GITEA__server__HTTP_PORT, value: "3000"}
+            - {name: GITEA__actions__ENABLED, value: "true"}
+            - {name: GITEA__service__DISABLE_REGISTRATION, value: "true"}
+          ports: [{containerPort: 3000}]
+          resources:
+            requests: {cpu: 100m, memory: 256Mi}
+            limits: {memory: 1Gi}
+          volumeMounts:
+            - {name: data, mountPath: /data}
+      volumes:
+        - name: data
+          persistentVolumeClaim: {claimName: gitea-data}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea
+  namespace: git
+spec:
+  selector: {app: gitea}
+  ports:
+    - port: 3000
+      targetPort: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea
+  namespace: git
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    # NOTE: intentionally NOT behind the SSO gate - git clients and CI
+    # need direct token auth; Gitea has its own accounts
+spec:
+  tls:
+    - hosts: [git.carr.pub]
+      secretName: git-carr-pub-tls
+  rules:
+    - host: git.carr.pub
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service: {name: gitea, port: {number: 3000}}