Deploy Forgejo on railiance01 using gitea-charts/gitea 12.5.0

Pin chart to 12.5.0 because 12.6+ calls `gitea config edit-ini`, which
Forgejo 11 lacks. Ingress targets forgejo-gitea-http (Helm release naming).
Smoke test uses GET for /v2/ registry challenge (HEAD returns 405).

helm/forgejo-registry-values.yaml

@@ -0,0 +1,14 @@
+# Public endpoint and package registry settings for Forgejo on railiance01.
+service:
+  http:
+    type: ClusterIP
+
+gitea:
+  config:
+    packages:
+      ENABLED: true
+      LIMIT_SIZE_CONTAINER: -1
+    repository:
+      DISABLED_REPO_UNITS: ""
+    server:
+      ROOT_URL: "https://forgejo.coulomb.social/"

helm/forgejo-secrets.sops.yaml.template

@@ -0,0 +1,15 @@
+# Encrypt as helm/forgejo-secrets.sops.yaml before production deploy.
+# Contains database PASSWD and admin password consumed by the gitea chart.
+#
+# gitea:
+#   admin:
+#     password: <generated>
+#   config:
+#     database:
+#       PASSWD: <same as forgejo-db-credentials>
+gitea:
+  admin:
+    password: REPLACE_WITH_ADMIN_PASSWORD
+  config:
+    database:
+      PASSWD: REPLACE_WITH_DB_PASSWORD

helm/forgejo-values.yaml

@@ -0,0 +1,47 @@
+# Non-secret Forgejo Helm values (gitea-charts/gitea chart + Forgejo image).
+# Layer helm/forgejo-secrets.sops.yaml for database password and admin credentials.
+service:
+  http:
+    type: ClusterIP
+
+image:
+  registry: code.forgejo.org
+  repository: forgejo/forgejo
+  tag: "11.0.3"
+  rootless: true
+
+persistence:
+  enabled: true
+  size: 10Gi
+
+postgresql:
+  enabled: false
+
+postgresql-ha:
+  enabled: false
+
+redis-cluster:
+  enabled: false
+
+valkey-cluster:
+  enabled: false
+
+gitea:
+  admin:
+    username: forgejo_admin
+    email: admin@coulomb.social
+    passwordMode: initialOnlyRequireReset
+  config:
+    database:
+      DB_TYPE: postgres
+      HOST: forgejo-db-rw.databases.svc.cluster.local:5432
+      NAME: forgejo
+      USER: forgejo
+    server:
+      DOMAIN: forgejo.coulomb.social
+      SSH_DOMAIN: forgejo.coulomb.social
+      SSH_PORT: 22
+      SSH_LISTEN_PORT: 2222
+      DISABLE_SSH: false
+    service:
+      DISABLE_REGISTRATION: true