image:
    tag: 1.27.1
ingress:
    enabled: true
    hosts:
        - host: git.vhaudiquet.fr
          paths:
            - path: /
              pathType: Prefix
# Disable HA, we are on a 1-node cluster
redis-cluster:
    enabled: false
# Valkey cluster is the new default in chart 12.x - must be explicitly disabled
valkey-cluster:
    enabled: false
# Use standalone Valkey (replaces 'redis' in chart 12.x)
valkey:
    enabled: true
    master:
        resources:
            requests:
                cpu: 100m
                memory: 128Mi
            limits:
                cpu: 500m
                memory: 256Mi
        tolerations:
            - key: ENC[AES256_GCM,data:Kh2EoXOtUD6x,iv:vx1gWKrAoDfwwFwt6dM8thBo4JnxaYBGtbKuBg5nqnk=,tag:LH4Dxi+XrJ4xpl96RMCKNA==,type:str]
              operator: Equal
              value: ENC[AES256_GCM,data:sY7H5QmDFcU=,iv:J6oTSUu+BZlaQLfCFlKuWx8hbHAwvyMOuZCRpfMh8jU=,tag:4RUPmoPilTeNLFq1olQOmQ==,type:str]
              effect: NoSchedule
            - key: ENC[AES256_GCM,data:kmpQDSATEJJZn81m+0VgbWAsng4x6yVCJhxj6tQLLTIbjLFabQ==,iv:HM+kujLIL7nC+34eXOtKvTNB9BkhAO1NK/TUimbOsFM=,tag:r+gEXue4TDorTv1FF6C6rA==,type:str]
              operator: Exists
              effect: NoSchedule
        affinity:
            nodeAffinity:
                preferredDuringSchedulingIgnoredDuringExecution:
                    - weight: 100
                      preference:
                        matchExpressions:
                            - key: ENC[AES256_GCM,data:YSmBennGx6LJ6C8/YuNkxx43dzo=,iv:sQ865tZPjg9+k+bAz67DUamwm+bZ8X5+jnSonBCbCt4=,tag:KQbd5RSPO6tEYFyUF6ovFg==,type:str]
                              operator: NotIn
                              values:
                                - "true"
postgresql:
    enabled: true
    global:
        postgresql:
            auth:
                postgressPassword: ENC[AES256_GCM,data:ZpClPRs2cWuTnw==,iv:1qPxD6yJp9z9YCZM6UGIub+XiidnE6lCdP+z/SOWCgU=,tag:ORvNODCU5AXAqiCmpERhQg==,type:str]
                password: ENC[AES256_GCM,data:T9Qmu/w7Y5Qehg==,iv:866ivIyr6sSDJCjnA9Q0rUtDscL8zOOy8L6/mCTT0Yg=,tag:8uCLBTuBKgnjBvFcrNgWTA==,type:str]
                database: gitea
                username: ENC[AES256_GCM,data:V5Afr+I=,iv:C32rMzB1XTzfPLdIQO48TNW9V6/Ymw/kpMy4qTfb8Go=,tag:7lxRD7esUeyMJ8ob18avag==,type:str]
    volumePermissions:
        enabled: true
    primary:
        resources:
            requests:
                cpu: 250m
                memory: 256Mi
            limits:
                cpu: 1000m
                memory: 1Gi
        tolerations:
            - key: ENC[AES256_GCM,data:P8I6g275rO09,iv:GrpyFGSWYZL03DEOeNap9lmfxzYMtgi2B7DrTimyuOU=,tag:POPHyJbJYyza3RfIbZ22Uw==,type:str]
              operator: Equal
              value: ENC[AES256_GCM,data:HvQAP7xFuSw=,iv:8neUXtNVEY0A9J+3ut5KPKDp+L4ePNco2/yrrnlwFLk=,tag:gnRHW6GicRlLCNpdMULY5A==,type:str]
              effect: NoSchedule
            - key: ENC[AES256_GCM,data:7an/Ugr3N4WLjmldD7MmNpDIX6M8MzwA+BNFyEXtnOxpZa1dOA==,iv:pDO0iIXVp52VNz1V+bYqEvS1QVN9wXN5DlOgmxgubAU=,tag:crfiLeG1tRNKjNT10Sc9+Q==,type:str]
              operator: Exists
              effect: NoSchedule
        affinity:
            nodeAffinity:
                preferredDuringSchedulingIgnoredDuringExecution:
                    - weight: 100
                      preference:
                        matchExpressions:
                            - key: ENC[AES256_GCM,data:eiY67uSwrV28aTiTmBPhqNe/eKI=,iv:did6Rruc7T0NL/A6Rq3MB3pls+RX0NX0iHuQ3QUxUbU=,tag:JM3Yhqb2qL3eVndZRZ/SwQ==,type:str]
                              operator: NotIn
                              values:
                                - "true"
        livenessProbe:
            enabled: true
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 10
            successThreshold: 1
            failureThreshold: 10
        readinessProbe:
            enabled: true
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 10
            successThreshold: 1
            failureThreshold: 6
postgresql-ha:
    enabled: false
persistence:
    enabled: true
    subPath: data
extraVolumes:
    - name: git
      nfs:
        server: truenas.lan
        path: /mnt/fast_app_data/git
extraContainerVolumeMounts:
    - name: git
      mountPath: /git
clusterDomain: cluster.local
# Fix: git resolves repo/hook paths relative to HOME when it can't stat the
# requested repo.
deployment:
    env:
        - name: HOME
          value: ENC[AES256_GCM,data:IcvPZg==,iv:4KPjTS4uqiv41pMjXK0cFD3cBkqlvQqqP8Ee8IMvPX0=,tag:lbBoXmt2wN7AJSjwNS9pvQ==,type:str]
gitea:
    oauth:
        - name: Authentik
          provider: openidConnect
          key: ENC[AES256_GCM,data:qG2Qrmok46/xeUcNep6wvp/CFFw1yf0lgp1Bpv0zuB9sbQRjMYKFCw==,iv:pcy08Wsd0IUxzeBG+ldWnA2a8Hf7XEgQ+ECkD6hMWGo=,tag:NvnXfGN16aVtxpVT7IgENw==,type:str]
          secret: ENC[AES256_GCM,data:P8vXGIVD+T2rvcHTutfbocW9uZbWresMvvsS3vX7Yu2YSYeNmnOdX6Z8G3cxPUVvwbZERoPfCkLgF5+NvW+TFpnosscglKhzmG+pnY9b5bAF74vv1Qcpmu9/H47tLr/Mp1husSfCJJgQVQ/+e16VJ5lVG2DOJk8tnnQ6UYprzK4=,iv:KNlEmRXORSWSlCdrLOp+VZefKactdMkafnjgmeSpRaI=,tag:2I4GARFP4gPDb3FtffpHqQ==,type:str]
          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
    config:
        APP_NAME: Gitea
        server:
            ROOT_URL: https://git.vhaudiquet.fr
        lfs:
            STORAGE_TYPE: local
            PATH: /git/lfs
        repository:
            ROOT: /git/repo
        database:
            DB_TYPE: postgres
        service:
            ALLOW_ONLY_EXTERNAL_REGISTRATION: true
        actions:
            ENABLED: true
        oauth2_client:
            ENABLE_AUTO_REGISTRATION: true
            ACCOUNT_LINKING: login
        openid:
            ENABLE_OPENID_SIGNIN: false
            ENABLE_OPENID_SIGNUP: false
        indexer:
            ISSUE_INDEXER_TYPE: bleve
            REPO_INDEXER_ENABLED: true
# Resource limits for Gitea container
resources:
    requests:
        cpu: 250m
        memory: 512Mi
    limits:
        cpu: 1000m
        memory: 1Gi
# Increase replica count is not useful for 1-node cluster
replicaCount: 1
# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
tolerations:
    - key: ENC[AES256_GCM,data:PfH6D3U2HWiC,iv:LhkDbcIz0F6fgDYvCJcozVL5U8oriA2BD2tmqJ14lBw=,tag:R9v4hTWByC89Gn5WMCFJ+w==,type:str]
      operator: Equal
      value: ENC[AES256_GCM,data:I+MraE7WlxQ=,iv:aMBhxSmD4VMoLr9S3lUb2E5BF1P7/J3JyAOPZthzpsE=,tag:mFGoKi7ITT9JFdUp0lsGYQ==,type:str]
      effect: NoSchedule
    - key: ENC[AES256_GCM,data:GB5K+PfBE6DjBiT7jNBStC9BOfDiicORtNPTxSKsXgXuG983uQ==,iv:cWBpXW1KVXtkyZP6U2ouKpC2nBGujTTTKGnPqhG9HxM=,tag:wvHdZ5+We3+1CEVeKpCHSg==,type:str]
      operator: Exists
      effect: NoSchedule
affinity:
    nodeAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              preference:
                matchExpressions:
                    - key: ENC[AES256_GCM,data:IRoYV+ZQieF+nNMtqjQ1G5Ke+zM=,iv:iIBl8u/iSOuzpNMs7PJQN0d1L8cMQv6thVZUbOkkfLI=,tag:+LNvkymhwrvoEUI7BqZ77Q==,type:str]
                      operator: NotIn
                      values:
                        - "true"
# (postgresql and valkey tolerations are set in their respective blocks above)
sops:
    lastmodified: "2026-08-12T20:59:54Z"
    mac: ENC[AES256_GCM,data:Avu6vdd+EeQpD+xQdZWYyaxvzatwN0qAS9Vd6orXbGLcAlglJmHREeioCjPOaIsKmsl850mPj1FP5FNO7KEKtvJg5+DQ8r6OzgOHQS7T74Oeh0r7ISqvu4sbAX78UJlqrY0K/5ZaEFkwRNcZy2GzRyxf5CCpw8B6B+nLrLwGJS8=,iv:DTX4D4kSekeI00Cz7CYrUbsG63ASLEhGa+UJHShAp28=,tag:cQfiA5GCID4+dkMfsy6PqQ==,type:str]
    pgp:
        - created_at: "2026-08-12T20:59:54Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiARAAky4a7NkM4dhHtkDMKp/K0vtmWfQw4aPSb/GHrHiUorDL
            gF+pczOUfGOPxFNRh3vdkqwsvBoQ6kW2khImoGIjwIW+XgVLUaUhFvIIk/10nuR0
            fjo3MYBE0fiIWY38DxbbGTtRl1CPKgqabalaINAaJCocGd4bMdj8+pUWYSmzhDge
            FY2rhcxTBiL3s99ebNz+vrK2wfxochQg5xm6Pi7CAQfTwALvwBjqsAEjdB/ag5rg
            hjfnMtBDArmfJ5TwjTnkFTPYYHeiLAv+yoArNYo+MxrsH/NDNTI7bfQqsSkJf3ai
            odkmWHpaFBtda3UfUgDvqN2e2BXuYqyK4R7nlT+gLhsyGnaiKP2rFTQu7NsL3RJa
            SbLdr+WzC4zDsEXZXeotYVC9Cs18/WNBbz8DqbpHrb1doTSVETbcQWJbnqHy0dYV
            O2Hbhz/f0KEcFNbMWzQDKJesMRt3deNQnAijE9gt4bArGNmUSzem9CX7B6k+cesO
            EhKq8GAQ3964Un0KYFNEizD/hckrpO1yFItIzTYgRuOnzrEaSDRIs8EL7sezp5iM
            XQPKTssRlh1KlnuzCRVj1UQF98Beq8s/S+JnXDg+cYpqF+pT3jdY/OA1K5jZxz79
            kIHMQtm54SNR5kfe3xUbZB2699xMVqBIYA91Ttmeotfril1uuFjxrTWo1oeLwAvS
            XgEAtW8y4QZ07AybyCalGcbrgcUoy7c8JRNdfo5xHWtiNYg759tQTOTX4nSpUwd2
            9Oylu4Y717ZPwKGSj/g8oMtpufAUaF8Uz3rN1Bs07rdNI4xZRQY1mX8GkomN3Fk=
            =A28Y
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
    version: 3.10.2