# Gitea: git hosting + CI, with repo data on Synology NFS.
apiVersion: v1
kind: Namespace
metadata:
  name: git
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: gitea-data
  namespace: git
spec:
  accessModes: [ReadWriteOnce]
  storageClassName: nfs-synology
  resources:
    requests: {storage: 20Gi}
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gitea
  namespace: git
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels: {app: gitea}
  template:
    metadata:
      labels: {app: gitea}
    spec:
      containers:
        - name: gitea
          image: gitea/gitea:1.24
          env:
            - {name: USER_UID, value: "1000"}
            - {name: USER_GID, value: "1000"}
            - {name: GITEA__database__DB_TYPE, value: sqlite3}
            - {name: GITEA__server__DOMAIN, value: git.carr.pub}
            - {name: GITEA__server__ROOT_URL, value: "https://git.carr.pub/"}
            - {name: GITEA__server__HTTP_PORT, value: "3000"}
            - {name: GITEA__actions__ENABLED, value: "true"}
            - {name: GITEA__service__DISABLE_REGISTRATION, value: "true"}
          ports: [{containerPort: 3000}]
          resources:
            requests: {cpu: 100m, memory: 256Mi}
            limits: {memory: 1Gi}
          volumeMounts:
            - {name: data, mountPath: /data}
      volumes:
        - name: data
          persistentVolumeClaim: {claimName: gitea-data}
---
apiVersion: v1
kind: Service
metadata:
  name: gitea
  namespace: git
spec:
  selector: {app: gitea}
  ports:
    - port: 3000
      targetPort: 3000
---
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: gitea
  namespace: git
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
    # NOTE: intentionally NOT behind the SSO gate - git clients and CI
    # need direct token auth; Gitea has its own accounts
spec:
  tls:
    - hosts: [git.carr.pub]
      secretName: git-carr-pub-tls
  rules:
    - host: git.carr.pub
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service: {name: gitea, port: {number: 3000}}