home/nixos-servers
home/nixos-servers
2
0
Fork 0
Code Issues 8 Pull requests Projects Releases Packages Wiki Activity Actions

migrate forgejo to kubernetes

Browse source
This commit is contained in:
Pim Kunis 2024-03-29 15:49:34 +01:00
parent 31b95c9a49
commit 7106bf5e14
5 changed files with 239 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
docker_swarm/playbooks/stacks.yml
View file

@ -3,6 +3,5 @@
hosts: manager
roles:
- {role: traefik, tags: traefik}
- {role: forgejo, tags: forgejo}
- {role: swarm_dashboard, tags: swarm_dashboard}
- {role: media, tags: media}

6
docker_swarm/roles/traefik/docker-stack.yml.j2
View file

@ -114,6 +114,12 @@ services:
- traefik.http.routers.kitchenowl.rule=Host(`boodschappen.kun.is`)
- traefik.http.routers.kitchenowl.tls=true
- traefik.http.routers.kitchenowl.tls.certresolver=letsencrypt
- traefik.http.routers.forgejo.entrypoints=websecure
- traefik.http.routers.forgejo.service=k3s@file
- traefik.http.routers.forgejo.rule=Host(`git.kun.is`)
- traefik.http.routers.forgejo.tls=true
- traefik.http.routers.forgejo.tls.certresolver=letsencrypt
volumes:
- type: bind
source: /var/run/docker.sock

1
nix/flake/kubenix/default.nix
View file

@ -18,6 +18,7 @@
# ./hedgedoc.nix
./paperless-ngx.nix
./kitchenowl.nix
./forgejo.nix
];
kubernetes.kubeconfig = "~/.kube/config";
kubenix.project = "home";

231
nix/flake/kubenix/forgejo.nix Normal file
View file

@ -0,0 +1,231 @@
{
kubernetes.resources = {
configMaps = {
forgejo-config.data = {
# TODO: Generate from nix code.
config = ''
APP_NAME = Forgejo: Beyond coding. We forge.
RUN_MODE = prod
RUN_USER = git
WORK_PATH=/data/gitea
[repository]
ROOT = /data/git/repositories
DEFAULT_BRANCH = master
[repository.local]
LOCAL_COPY_PATH = /data/gitea/tmp/local-repo
[repository.upload]
TEMP_PATH = /data/gitea/uploads
[server]
APP_DATA_PATH = /data/gitea
DOMAIN = git.kun.is
SSH_DOMAIN = ssh.git.kun.is
HTTP_PORT = 3000
ROOT_URL = https://git.kun.is
DISABLE_SSH = false
SSH_PORT = 56287
SSH_LISTEN_PORT = 22
LFS_START_SERVER = true
LFS_JWT_SECRET = ref+file:///home/pim/.config/home/vals.yaml#/forgejo/lfsJwtSecret
OFFLINE_MODE = false
[database]
PATH = /data/gitea/gitea.db
DB_TYPE = sqlite3
HOST = localhost:3306
NAME = gitea
USER = root
PASSWD =
LOG_SQL = false
SCHEMA =
SSL_MODE = disable
CHARSET = utf8
[indexer]
ISSUE_INDEXER_PATH = /data/gitea/indexers/issues.bleve
ISSUE_INDEXER_TYPE = db
[session]
PROVIDER_CONFIG = /data/gitea/sessions
PROVIDER = file
[picture]
AVATAR_UPLOAD_PATH = /data/gitea/avatars
REPOSITORY_AVATAR_UPLOAD_PATH = /data/gitea/repo-avatars
ENABLE_FEDERATED_AVATAR = false
[attachment]
PATH = /data/gitea/attachments
[log]
MODE = console
LEVEL = info
logger.router.MODE = console
ROOT_PATH = /data/gitea/log
logger.access.MODE=console
[security]
INSTALL_LOCK = true
SECRET_KEY =
REVERSE_PROXY_LIMIT = 1
REVERSE_PROXY_TRUSTED_PROXIES = *
INTERNAL_TOKEN = ref+file:///home/pim/.config/home/vals.yaml#/forgejo/internalToken
PASSWORD_HASH_ALGO = pbkdf2
[service]
DISABLE_REGISTRATION = true
REQUIRE_SIGNIN_VIEW = false
REGISTER_EMAIL_CONFIRM = false
ENABLE_NOTIFY_MAIL = false
ALLOW_ONLY_EXTERNAL_REGISTRATION = false
ENABLE_CAPTCHA = false
DEFAULT_KEEP_EMAIL_PRIVATE = true
DEFAULT_ALLOW_CREATE_ORGANIZATION = true
DEFAULT_ENABLE_TIMETRACKING = true
NO_REPLY_ADDRESS = noreply.localhost
[lfs]
PATH = /data/git/lfs
[mailer]
ENABLED = false
[openid]
ENABLE_OPENID_SIGNIN = true
ENABLE_OPENID_SIGNUP = false
[repository.pull-request]
DEFAULT_MERGE_STYLE = merge
[repository.signing]
DEFAULT_TRUST_MODEL = committer
[ui]
DEFAULT_THEME = forgejo-light
[oauth2]
ENABLE=false
'';
};
forgejo-env.data = {
USER_UID = "1000";
USER_GID = "1000";
};
};
deployments.forgejo = {
metadata.labels.app = "forgejo";
spec = {
selector.matchLabels.app = "forgejo";
template = {
metadata.labels.app = "forgejo";
spec = {
containers.forgejo = {
image = "codeberg.org/forgejo/forgejo:1.20";
envFrom = [{ configMapRef.name = "forgejo-env"; }];
ports = [
{
containerPort = 3000;
protocol = "TCP";
}
{
containerPort = 22;
protocol = "TCP";
}
];
volumeMounts = [
{
name = "data";
mountPath = "/data";
}
{
name = "config";
mountPath = "/data/gitea/conf/app.ini";
subPath = "config";
}
];
};
volumes = [
{
name = "data";
persistentVolumeClaim.claimName = "forgejo";
}
{
name = "config";
configMap.name = "forgejo-config";
}
];
};
};
};
};
persistentVolumes.forgejo.spec = {
capacity.storage = "1Mi";
accessModes = [ "ReadWriteMany" ];
nfs = {
server = "lewis.hyp";
path = "/mnt/data/nfs/forgejo";
};
};
persistentVolumeClaims.forgejo.spec = {
accessModes = [ "ReadWriteMany" ];
storageClassName = "";
resources.requests.storage = "1Mi";
volumeName = "forgejo";
};
services = {
forgejo-web.spec = {
selector.app = "forgejo";
ports = [{
protocol = "TCP";
port = 80;
targetPort = 3000;
}];
};
forgejo-ssh.spec = {
type = "LoadBalancer";
loadBalancerIP = "192.168.30.132";
selector.app = "forgejo";
ports = [{
port = 56287;
targetPort = 22;
}];
};
};
ingresses.foregejo.spec = {
ingressClassName = "traefik";
rules = [{
host = "git.kun.is";
http.paths = [{
path = "/";
pathType = "Prefix";
backend.service = {
name = "forgejo-web";
port.number = 80;
};
}];
}];
};
};
}

1
nix/modules/networking/dmz_services/dnsmasq.nix
View file

@ -46,5 +46,6 @@ in
"/ns.pizzapim.nl/${cfg.dmz.ipv4.services}"
"/ns.pizzapim.nl/${cfg.dmz.ipv6.services}"
"/kms.kun.is/192.168.30.129"
"/ssh.git.kun.is/192.168.30.132"
];
}