railiance-apps/helm/forgejo-values.yaml

# Non-secret Forgejo Helm values (gitea-charts/gitea chart + Forgejo image).
# Layer helm/forgejo-secrets.sops.yaml for database password and admin credentials.
# Recreate avoids leveldb queue lock fights on the shared RWO PVC during upgrades.
strategy:
  type: Recreate

service:
  http:
    type: ClusterIP

image:
  registry: code.forgejo.org
  repository: forgejo/forgejo
  tag: "11.0.3"
  rootless: true

persistence:
  enabled: true
  size: 10Gi

postgresql:
  enabled: false

postgresql-ha:
  enabled: false

redis-cluster:
  enabled: false

valkey-cluster:
  enabled: false

# File subPath keeps Git from copying ConfigMap projection symlinks.
extraVolumes:
- name: secret-scan-template
  configMap:
    name: forgejo-secret-template-832f6dc6b809
    defaultMode: 365
extraContainerVolumeMounts:
- &id001
  name: secret-scan-template
  mountPath: /opt/forge-secret-template/hooks/pre-receive.d/10-custodian-secret-scan
  subPath: hook
  readOnly: true
extraInitVolumeMounts:
- *id001

# Verify admitted scanner custody after Kubernetes fsGroup volume processing.
# Only the existing security subtree is mounted; no credentials are needed.
preExtraInitContainers:
- name: verify-secret-scanner
  image: code.forgejo.org/forgejo/forgejo@sha256:691657c7e64af7730a2e885e6d022cf16ae60724931c5392bd61838afadcaeba
  imagePullPolicy: IfNotPresent
  command:
  - sh
  - -c
  - "#!/bin/sh\nset +vx\nset -eu\ntest \"$(id -u)\" = 1000\ntest -d /data && test ! -L /data\ntest -d /data/security && test ! -L /data/security\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\ntest -d /data/security/receive-secret-scan/20261012-57a0642b6251 && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan | cut -d \" \" -f 1)\" = 57a0642b625105440fe146fceb4d244fd2dd08a75beb316831675643e6cc27ec\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" in 755|775) ;; *) exit 21;; esac\ntest -f /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\
    \ && test ! -L /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks | cut -d \" \" -f 1)\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" in 755|775) ;; *) exit 21;; esac\nif [ \"${1:-check}\" = apply ]; then\n  chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan\n  test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/receive-secret-scan)\" = 755\n  chmod 755 /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks\n  test \"$(stat -c %a /data/security/receive-secret-scan/20261012-57a0642b6251/gitleaks)\" = 755\nfi\n\n#!/bin/sh\nset +vx\nset -eu\ntest \"$(id -u)\" = 1000\ntest -d /data && test ! -L /data\ntest -d /data/security\
    \ && test ! -L /data/security\ntest -d /data/security/receive-secret-scan && test ! -L /data/security/receive-secret-scan\ntest -d /data/security/receive-secret-scan/20261018-73ee04078786 && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\ntest \"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan | cut -d \" \" -f 1)\" = 73ee04078786801fc74d80d2bef122b7764c93856e403e8de5b078336d7f9e1a\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" in 755|775) ;; *) exit 21;; esac\ntest -f /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks && test ! -L /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\n\
    test \"$(stat -c %u /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\" = 1000\ntest \"$(sha256sum /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks | cut -d \" \" -f 1)\" = 88f91962aa2f93ac6ab281d553b9e125f5197bbbce38f9f2437f7299c32e5509\ncase \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\" in 755|775) ;; *) exit 21;; esac\nif [ \"${1:-check}\" = apply ]; then\n  chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan\n  test \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/receive-secret-scan)\" = 755\n  chmod 755 /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks\n  test \"$(stat -c %a /data/security/receive-secret-scan/20261018-73ee04078786/gitleaks)\" = 755\nfi\n"
  - sh
  - apply
  securityContext:
    runAsUser: 1000
    runAsGroup: 1000
    runAsNonRoot: true
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop:
      - ALL
  resources:
    requests:
      cpu: 10m
      memory: 32Mi
    limits:
      cpu: 100m
      memory: 64Mi
  volumeMounts:
  - name: data
    mountPath: /data/security
    subPath: security
  terminationMessagePath: /dev/termination-log
  terminationMessagePolicy: File

gitea:
  admin:
    username: forgejo_admin
    email: admin@coulomb.social
    passwordMode: initialOnlyRequireReset
  # Mailer password from OpenBao via ExternalSecret forgejo-mailer (not Helm/SOPS).
  additionalConfigFromEnvs:
    - name: GITEA__GIT_0X2E_CONFIG__INIT_0X2E_TEMPLATEDIR
      value: /opt/forge-secret-template
    - name: GITEA__mailer__PASSWD
      valueFrom:
        secretKeyRef:
          name: forgejo-mailer
          key: MAILER_PASSWD
  config:
    database:
      DB_TYPE: postgres
      HOST: forgejo-db-rw.databases.svc.cluster.local:5432
      NAME: forgejo
      USER: forgejo
    server:
      DOMAIN: forgejo.coulomb.social
      SSH_DOMAIN: forgejo.coulomb.social
      SSH_PORT: 22
      SSH_LISTEN_PORT: 2222
      DISABLE_SSH: false
    service:
      DISABLE_REGISTRATION: true
    security:
      INSTALL_LOCK: true
    session:
      COOKIE_SECURE: true
    mailer:
      ENABLED: true
      FROM: forgejo@coulomb.social
      # IONOS submission port 587 uses STARTTLS, not implicit TLS (smtps).
      PROTOCOL: smtp+starttls
      SMTP_ADDR: smtp.ionos.de
      SMTP_PORT: 587
      USER: forgejo@coulomb.social
    actions:
      ENABLED: true