Added forgejo deployment

helm/forgejo-db-cluster.yaml

@@ -0,0 +1,31 @@
+---
+# CNPG cluster for Forgejo (railiance01 production forge).
+# Managed by railiance-platform (S3). Operator: cnpg-system.
+#
+# Apply: KUBECONFIG=~/.kube/config-hosteurope make forgejo-db-deploy
+# Status: make forgejo-db-status
+#
+# Pre-condition: forgejo-db-credentials Secret in databases namespace.
+# See helm/forgejo-db-secret.sops.yaml.template
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: forgejo-db
+  namespace: databases
+  labels:
+    app.kubernetes.io/name: forgejo-db
+    app.kubernetes.io/component: database
+    app.kubernetes.io/managed-by: manual
+    railiance.io/layer: s3-platform
+    railiance.io/consumer: forgejo
+spec:
+  instances: 1
+  imageName: ghcr.io/cloudnative-pg/postgresql:16
+  storage:
+    size: 10Gi
+  bootstrap:
+    initdb:
+      database: forgejo
+      owner: forgejo
+      secret:
+        name: forgejo-db-credentials

helm/forgejo-db-networkpolicies.yaml

@@ -0,0 +1,61 @@
+---
+# NetworkPolicies for forgejo-db CNPG cluster on railiance01.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-egress-kube-api-forgejo-db
+  namespace: databases
+spec:
+  podSelector:
+    matchLabels:
+      cnpg.io/cluster: forgejo-db
+  policyTypes:
+    - Egress
+  egress:
+    - ports:
+        - port: 6443
+          protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-from-cnpg-operator-forgejo-db
+  namespace: databases
+spec:
+  podSelector:
+    matchLabels:
+      cnpg.io/cluster: forgejo-db
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: cnpg-system
+      ports:
+        - port: 5432
+          protocol: TCP
+        - port: 8000
+          protocol: TCP
+        - port: 9187
+          protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-from-forgejo-forgejo-db
+  namespace: databases
+spec:
+  podSelector:
+    matchLabels:
+      cnpg.io/cluster: forgejo-db
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: forgejo
+      ports:
+        - port: 5432
+          protocol: TCP

helm/forgejo-db-secret.sops.yaml.template

@@ -0,0 +1,13 @@
+# Template for forgejo-db-credentials (databases namespace).
+# Encrypt: sops -e -i helm/forgejo-db-secret.sops.yaml
+# Apply:   KUBECONFIG=~/.kube/config-hosteurope kubectl apply -f <(sops -d helm/forgejo-db-secret.sops.yaml)
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: forgejo-db-credentials
+  namespace: databases
+type: kubernetes.io/basic-auth
+stringData:
+  username: forgejo
+  password: REPLACE_WITH_PASSWORD