Mukul SharmaandClaude Opus 5
f703f0b55a
Each of these now answers on <name>.infra.deployshed.com alongside the nip.io name it already had. Both are kept on purpose: nothing that currently references the old name breaks, and the new one can be proved before anything depends on it. Removing nip.io is a separate step, and a larger one, because Harbor's name is embedded in every running app's image reference. TLS covers the real domain only. Let's Encrypt cannot issue for nip.io — it is not on the public suffix list and every *.nip.io certificate shares one rate limit — so a tls block naming both would request one certificate spanning them and receive nothing for either. Each tls block therefore lists exactly the one new hostname, which is why they are written out rather than derived from the host list beside them. The charts disagree about how to express a second host, so each is done the way its own chart supports: gitea, grafana, vault, victoria-metrics-single take host lists, so the new name joins the existing one on a single Ingress. jenkins' primary ingress accepts exactly one hostName, so the new name goes on secondaryingress — a whole second Ingress object at the same backend. paths must be set explicitly there; left at the chart's default of [] it renders zero routes and the hostname answers nothing. argo-cd takes extraHosts natively, but its ingress.tls is a boolean bound to one fixed secret covering every host at once. Turning it on would request a certificate including nip.io and fail, and there is no extraTls to scope it. So ArgoCD gains the hostname now and its certificate when nip.io goes. Harbor is untouched here. It has no multi-host mechanism at all, so its second hostname needs a standalone Ingress, and its externalURL is what docker clients are handed — both deserve their own change rather than riding along with a hostname tidy-up. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01LEsTefWWifp4ikvhHF5s6N
109 lines
4.1 KiB
YAML
109 lines
4.1 KiB
YAML
gitea:
|
|
# GKE counterpart of helm-overrides/k8s-admin-prd-ase1/gitea — same
|
|
# SQLite/no-cache shape, with what differs on GKE called out inline.
|
|
#
|
|
# Installed once by hand with `helm install gitea` (release "gitea",
|
|
# namespace "gitea"), then adopted by ArgoCD via the nameOverride in
|
|
# devops-infra-argo-config-gcp's values file. Gitea has to exist before
|
|
# ArgoCD can read anything, since both config repos live inside it.
|
|
|
|
# Recreate for a different reason than the homelab's LevelDB lock: on
|
|
# three nodes with a ReadWriteOnce persistent disk, the chart's default
|
|
# RollingUpdate (maxUnavailable: 0) starts the new pod first, and if it
|
|
# lands on another node it waits forever on Multi-Attach.
|
|
strategy:
|
|
type: Recreate
|
|
|
|
persistence:
|
|
size: 10Gi
|
|
# GKE's default class (pd-balanced), in place of the homelab's
|
|
# local-path. Counts against the project's 250GB SSD quota.
|
|
storageClass: standard-rwo
|
|
|
|
postgresql:
|
|
enabled: false
|
|
postgresql-ha:
|
|
enabled: false
|
|
valkey:
|
|
enabled: false
|
|
valkey-cluster:
|
|
enabled: false
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 100m
|
|
memory: 300Mi
|
|
limits:
|
|
memory: 500Mi
|
|
|
|
gitea:
|
|
config:
|
|
database:
|
|
DB_TYPE: sqlite3
|
|
actions:
|
|
ENABLED: true
|
|
server:
|
|
ROOT_URL: http://gitea.35.238.248.203.nip.io/
|
|
service:
|
|
# The homelab sat on a LAN; this Gitea is on a public IP. Open
|
|
# registration would let anyone on the internet create an account.
|
|
DISABLE_REGISTRATION: true
|
|
security:
|
|
# The homelab allowed "*" because every host was on a private LAN.
|
|
# Here "*" would also allow webhooks to the node metadata server, so
|
|
# this stays narrowed to private ranges — which covers every
|
|
# in-cluster Service (Jenkins included) reached over cluster DNS.
|
|
#
|
|
# The one public entry is toolshed's own dashboard host, and it is a
|
|
# STOPGAP. toolshed builds each app's webhook target from the
|
|
# hostname the dashboard was browsed on (internal/api/apps.go's
|
|
# queueRepo), with no override, so an app registered through the
|
|
# public URL gets a public webhook target and Gitea refuses to call
|
|
# it: "webhook can only call allowed HTTP servers".
|
|
#
|
|
# The cost is real but bounded: this permits exactly one hostname,
|
|
# which happens to be our own load balancer, so the callback
|
|
# hairpins out and back in rather than staying pod-to-pod. It does
|
|
# not re-expose the metadata server, which is why "*" was rejected.
|
|
#
|
|
# The proper fix is a configurable webhook base URL in toolshed
|
|
# pointing at toolshed-api.toolshed.svc.cluster.local:8080, after
|
|
# which this entry should be removed.
|
|
ALLOWED_HOST_LIST: private,toolshed.35.238.248.203.nip.io
|
|
admin:
|
|
username: gitadmin
|
|
# Created by hand with kubectl at bootstrap, because Vault and ESO
|
|
# are not running yet. Same Secret name as the homelab so the
|
|
# ExternalSecret (secretstores/gitea-admin-credentials.yaml) can take
|
|
# it over unchanged once Vault is up.
|
|
existingSecret: gitea-admin-credentials
|
|
email: "admin@local.lab"
|
|
|
|
# Contour does not exist yet at bootstrap — the Ingress just sits unused
|
|
# until ArgoCD installs it.
|
|
#
|
|
# Two hosts while the deployment moves onto its own domain. The nip.io one
|
|
# stays until everything that references it has been repointed — ROOT_URL
|
|
# below, and any git remote anyone has configured.
|
|
ingress:
|
|
enabled: true
|
|
className: contour
|
|
annotations:
|
|
# Issues the certificate named in tls below. Only the real domain is
|
|
# listed there: Let's Encrypt cannot issue for nip.io, and asking for
|
|
# one certificate spanning both names returns nothing for either.
|
|
cert-manager.io/cluster-issuer: letsencrypt-prod
|
|
hosts:
|
|
- host: gitea.35.238.248.203.nip.io
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
- host: gitea.infra.deployshed.com
|
|
paths:
|
|
- path: /
|
|
pathType: Prefix
|
|
tls:
|
|
- secretName: gitea-tls
|
|
hosts:
|
|
- gitea.infra.deployshed.com
|