gitea:
  # GKE counterpart of helm-overrides/k8s-admin-prd-ase1/gitea — same
  # SQLite/no-cache shape, with what differs on GKE called out inline.
  #
  # Installed once by hand with `helm install gitea` (release "gitea",
  # namespace "gitea"), then adopted by ArgoCD via the nameOverride in
  # devops-infra-argo-config-gcp's values file. Gitea has to exist before
  # ArgoCD can read anything, since both config repos live inside it.

  # Recreate for a different reason than the homelab's LevelDB lock: on
  # three nodes with a ReadWriteOnce persistent disk, the chart's default
  # RollingUpdate (maxUnavailable: 0) starts the new pod first, and if it
  # lands on another node it waits forever on Multi-Attach.
  strategy:
    type: Recreate

  persistence:
    size: 10Gi
    # GKE's default class (pd-balanced), in place of the homelab's
    # local-path. Counts against the project's 250GB SSD quota.
    storageClass: standard-rwo

  postgresql:
    enabled: false
  postgresql-ha:
    enabled: false
  valkey:
    enabled: false
  valkey-cluster:
    enabled: false

  resources:
    requests:
      cpu: 100m
      memory: 300Mi
    limits:
      memory: 500Mi

  gitea:
    config:
      database:
        DB_TYPE: sqlite3
      actions:
        ENABLED: true
      server:
        ROOT_URL: http://gitea.35.238.248.203.nip.io/
      service:
        # The homelab sat on a LAN; this Gitea is on a public IP. Open
        # registration would let anyone on the internet create an account.
        DISABLE_REGISTRATION: true
      security:
        # The homelab allowed "*" because every host was on a private LAN.
        # Here "*" would also allow webhooks to the node metadata server,
        # so this is narrowed to private ranges — which still covers every
        # in-cluster Service (Jenkins included) reached over cluster DNS.
        ALLOWED_HOST_LIST: private
    admin:
      username: gitadmin
      # Created by hand with kubectl at bootstrap, because Vault and ESO
      # are not running yet. Same Secret name as the homelab so the
      # ExternalSecret (secretstores/gitea-admin-credentials.yaml) can take
      # it over unchanged once Vault is up.
      existingSecret: gitea-admin-credentials
      email: "admin@local.lab"

  # Contour does not exist yet at bootstrap — the Ingress just sits unused
  # until ArgoCD installs it. One host only: no Tailscale on GKE.
  ingress:
    enabled: true
    className: contour
    hosts:
      - host: gitea.35.238.248.203.nip.io
        paths:
          - path: /
            pathType: Prefix