mcimpoesu
fd7c529255
- 3-node HA cluster (k3s v1.36.3+k3s1, embedded etcd) on Hetzner - Netbird VPN mesh (wt0) for all cluster traffic - Longhorn distributed storage (2 replicas, /var/lib/longhorn/) - Traefik ingress (3 replicas, LoadBalancer on all node IPs) - cert-manager with Let's Encrypt (auto-renewing TLS) - Gitea (git + container registry) with SQLite on Longhorn - 4 migrated workloads: wolsey, school-games (3 variants), randomly - All HelmCharts and workload manifests as YAML - deploy.sh for one-shot cluster setup
204 lines
4.6 KiB
YAML
204 lines
4.6 KiB
YAML
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app: gitea
|
|
name: gitea
|
|
namespace: gitea
|
|
spec:
|
|
progressDeadlineSeconds: 600
|
|
replicas: 1
|
|
revisionHistoryLimit: 10
|
|
selector:
|
|
matchLabels:
|
|
app: gitea
|
|
strategy:
|
|
type: Recreate
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: gitea
|
|
spec:
|
|
containers:
|
|
- env:
|
|
- name: GITEA__server__DOMAIN
|
|
value: gitea.imcu.ro
|
|
- name: GITEA__server__SSH_DOMAIN
|
|
value: gitea.imcu.ro
|
|
- name: GITEA__server__ROOT_URL
|
|
value: https://gitea.imcu.ro/
|
|
- name: GITEA__server__SSH_PORT
|
|
value: '30022'
|
|
- name: GITEA__server__SSH_LISTEN_PORT
|
|
value: '2222'
|
|
- name: GITEA__database__DB_TYPE
|
|
value: sqlite3
|
|
- name: GITEA__packages__ENABLED
|
|
value: 'true'
|
|
- name: GITEA__actions__ENABLED
|
|
value: 'true'
|
|
- name: GITEA__security__INSTALL_LOCK
|
|
value: 'true'
|
|
- name: GITEA__service__DISABLE_REGISTRATION
|
|
value: 'true'
|
|
- name: GITEA__service__REQUIRE_SIGNIN_VIEW
|
|
value: 'false'
|
|
- name: GITEA__service__DEFAULT_ALLOW_CREATE_ORGANIZATION
|
|
value: 'true'
|
|
- name: GITEA__service__SHOW_REGISTRATION_BUTTON
|
|
value: 'false'
|
|
- name: GITEA__service__ENABLE_CAPTCHA
|
|
value: 'true'
|
|
- name: GITEA__service__EMAIL_DOMAIN_ALLOWLIST
|
|
value: imcu.ro,danubian.io,gmail.com
|
|
- name: GITEA__admin__DEFAULT_EMAIL_NOTIFICATIONS
|
|
value: disabled
|
|
- name: GITEA__oauth2__ENABLED
|
|
value: 'true'
|
|
image: gitea/gitea:1.27.2-rootless
|
|
imagePullPolicy: IfNotPresent
|
|
livenessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /api/healthz
|
|
port: 3000
|
|
scheme: HTTP
|
|
initialDelaySeconds: 60
|
|
periodSeconds: 10
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
name: gitea
|
|
ports:
|
|
- containerPort: 3000
|
|
name: http
|
|
protocol: TCP
|
|
- containerPort: 2222
|
|
name: ssh
|
|
protocol: TCP
|
|
readinessProbe:
|
|
failureThreshold: 3
|
|
httpGet:
|
|
path: /api/healthz
|
|
port: 3000
|
|
scheme: HTTP
|
|
initialDelaySeconds: 30
|
|
periodSeconds: 5
|
|
successThreshold: 1
|
|
timeoutSeconds: 1
|
|
resources:
|
|
limits:
|
|
cpu: '1'
|
|
memory: 1Gi
|
|
requests:
|
|
cpu: 100m
|
|
memory: 256Mi
|
|
terminationMessagePath: /dev/termination-log
|
|
terminationMessagePolicy: File
|
|
volumeMounts:
|
|
- mountPath: /var/lib/gitea
|
|
name: gitea-data
|
|
- mountPath: /etc/gitea
|
|
name: gitea-data
|
|
subPath: config
|
|
dnsPolicy: ClusterFirst
|
|
restartPolicy: Always
|
|
schedulerName: default-scheduler
|
|
securityContext: {}
|
|
terminationGracePeriodSeconds: 30
|
|
volumes:
|
|
- name: gitea-data
|
|
persistentVolumeClaim:
|
|
claimName: gitea-data
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea
|
|
namespace: gitea
|
|
spec:
|
|
clusterIP: 10.43.169.153
|
|
clusterIPs:
|
|
- 10.43.169.153
|
|
internalTrafficPolicy: Cluster
|
|
ipFamilies:
|
|
- IPv4
|
|
ipFamilyPolicy: SingleStack
|
|
ports:
|
|
- name: http
|
|
port: 3000
|
|
protocol: TCP
|
|
targetPort: 3000
|
|
- name: ssh
|
|
port: 2222
|
|
protocol: TCP
|
|
targetPort: 2222
|
|
selector:
|
|
app: gitea
|
|
sessionAffinity: None
|
|
type: ClusterIP
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: gitea-ssh
|
|
namespace: gitea
|
|
spec:
|
|
clusterIP: 10.43.220.233
|
|
clusterIPs:
|
|
- 10.43.220.233
|
|
externalTrafficPolicy: Cluster
|
|
internalTrafficPolicy: Cluster
|
|
ipFamilies:
|
|
- IPv4
|
|
ipFamilyPolicy: SingleStack
|
|
ports:
|
|
- name: ssh
|
|
nodePort: 30022
|
|
port: 2222
|
|
protocol: TCP
|
|
targetPort: 2222
|
|
selector:
|
|
app: gitea
|
|
sessionAffinity: None
|
|
type: NodePort
|
|
---
|
|
apiVersion: v1
|
|
kind: PersistentVolumeClaim
|
|
metadata:
|
|
finalizers:
|
|
- kubernetes.io/pvc-protection
|
|
name: gitea-data
|
|
namespace: gitea
|
|
spec:
|
|
accessModes:
|
|
- ReadWriteOnce
|
|
resources:
|
|
requests:
|
|
storage: 10Gi
|
|
storageClassName: longhorn
|
|
volumeMode: Filesystem
|
|
volumeName: pvc-6949d930-c76f-4bd8-9bd1-13fbad019d37
|
|
---
|
|
apiVersion: networking.k8s.io/v1
|
|
kind: Ingress
|
|
metadata:
|
|
name: gitea
|
|
namespace: gitea
|
|
spec:
|
|
ingressClassName: traefik
|
|
rules:
|
|
- host: gitea.imcu.ro
|
|
http:
|
|
paths:
|
|
- backend:
|
|
service:
|
|
name: gitea
|
|
port:
|
|
number: 3000
|
|
path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- hosts:
|
|
- gitea.imcu.ro
|
|
secretName: gitea-tls
|