homeprod/kubernetes/dev/gitea/values.yaml

image:
    tag: 1.27.1
ingress:
    enabled: true
    hosts:
        - host: git.vhaudiquet.fr
          paths:
            - path: /
              pathType: Prefix
# Disable HA, we are on a 1-node cluster
redis-cluster:
    enabled: false
# Valkey cluster is the new default in chart 12.x - must be explicitly disabled
valkey-cluster:
    enabled: false
# Use standalone Valkey (replaces 'redis' in chart 12.x)
valkey:
    enabled: true
    master:
        resources:
            requests:
                cpu: 100m
                memory: 128Mi
            limits:
                cpu: 500m
                memory: 256Mi
        tolerations:
            - key: ENC[AES256_GCM,data:SFv3lpRbF8sX,iv:xozFtxGpodpZ9QG5gucoBxmJ8Cu4TkFXZywU1e/488U=,tag:idAeFTfPJH1wl2kKW4aLig==,type:str]
              operator: Equal
              value: ENC[AES256_GCM,data:3RXsp5auTeg=,iv:eQzkLeio1n4kmvXoimMT5YEJDYT1cMBU9NpR558Jiwc=,tag:BB1fUeY/qJViLdfh04CyMg==,type:str]
              effect: NoSchedule
            - key: ENC[AES256_GCM,data:1pdkAgV1W9Y3Fae/U0Lhq3lJLh5j8avMNfp2emLrjvouHpru5Q==,iv:AtBbyceXKB3FPeDKmBEXUp9xbyyvxlGt/gdvxj5L/8Y=,tag:t6fAnHCBCAV9UtyiCARCyw==,type:str]
              operator: Exists
              effect: NoSchedule
        affinity:
            nodeAffinity:
                preferredDuringSchedulingIgnoredDuringExecution:
                    - weight: 100
                      preference:
                        matchExpressions:
                            - key: ENC[AES256_GCM,data:mZNTHOEDdvYI6hpOuYFi1QFB6GM=,iv:+Nz8tY24FnGtqaTBPs/J98Hn1L8lpffR9XvgP/J8R2U=,tag:RzGbwhYwnXHlVCyhuLFdsw==,type:str]
                              operator: NotIn
                              values:
                                - "true"
postgresql:
    enabled: true
    global:
        postgresql:
            auth:
                postgressPassword: ENC[AES256_GCM,data:LafuIhcNlPAKXw==,iv:dDihjursPeP5mvvuZVAP1R0Hrrdnojz/8uy2dPz2IM4=,tag:Rdw4wKQpI+lz9fR0o7vmiw==,type:str]
                password: ENC[AES256_GCM,data:nvqNIlrPsEzZPQ==,iv:ckzx6wH/OPC2Nekrma+WfzXC4T9Ug4C6Evb0XuRAt08=,tag:8sCkuUmFVYb9J9cNNahXQw==,type:str]
                database: gitea
                username: ENC[AES256_GCM,data:9jHp0/A=,iv:b6sWbWilGwYfijC/f4OXSwOWAyo/ruP9trzZAIIQlCA=,tag:UN+1WrCIZS7N6uBe5mzHAg==,type:str]
    volumePermissions:
        enabled: true
    primary:
        resources:
            requests:
                cpu: 250m
                memory: 256Mi
            limits:
                cpu: 1000m
                memory: 1Gi
        tolerations:
            - key: ENC[AES256_GCM,data:JxPW+KNLVUdC,iv:23k8zL4LKPvU6/EDmQbD/ThUx88y1A5zlqHASB7L9Gs=,tag:/ZmhUVoy0GEBr+JO8X4jAw==,type:str]
              operator: Equal
              value: ENC[AES256_GCM,data:WY8Eg4L16Ho=,iv:CUpovvAD8H/lhaxWHVNrknP1n+kjzk9Rez64Blr+3Wc=,tag:8/woLbZWK8JU0lbKUBohBw==,type:str]
              effect: NoSchedule
            - key: ENC[AES256_GCM,data:p8XpksWE9tkog9Yq5XhRkLEJ2ATl+wOCuNla96dat/X8Pugjdg==,iv:dP770WZMMP3bg0DYrOQIDBFNemNtvOPdgc5zrcoiyIY=,tag:oJzJEBGie7cYjrXASmELlw==,type:str]
              operator: Exists
              effect: NoSchedule
        affinity:
            nodeAffinity:
                preferredDuringSchedulingIgnoredDuringExecution:
                    - weight: 100
                      preference:
                        matchExpressions:
                            - key: ENC[AES256_GCM,data:Q19OYDlgAVAvt3W9O1tqIt54G/E=,iv:5bG3htMLsKkwKsz0UF7vhwkYsM6e2JeogSgw10PAZNY=,tag:jeaf3HemngVVXbn+6CYSvw==,type:str]
                              operator: NotIn
                              values:
                                - "true"
        livenessProbe:
            enabled: true
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 10
            successThreshold: 1
            failureThreshold: 10
        readinessProbe:
            enabled: true
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 10
            successThreshold: 1
            failureThreshold: 6
postgresql-ha:
    enabled: false
persistence:
    enabled: true
    subPath: data
extraVolumes:
    - name: git
      nfs:
        server: truenas.lan
        path: /mnt/fast_app_data/git
extraContainerVolumeMounts:
    - name: git
      mountPath: /git
clusterDomain: cluster.local
gitea:
    oauth:
        - name: Authentik
          provider: openidConnect
          key: ENC[AES256_GCM,data:mUThisHz3Br6MdyvZGNhUqLIJzbzcwSUq1CuQRlRWJw1b/ilxxpmOQ==,iv:gS+6jOTTF0EoIC4eCXQLryUZUaQ+4PqHbKGT/Ytdsqo=,tag:lNyTx4S5Z63HLd4vK9DxhA==,type:str]
          secret: ENC[AES256_GCM,data:23fi2dZcNBmKHYnBbx46S+IBEXm73RqxGaA5GEmtpU6KvcfN7BLi+CVQd+pqsXtthXapxsl7RyT18vCDxnLbyRmz8zAMpEfdKP/XePL+T9uM/dykKoEokXCFsVQZ5GpAg12lWnngXp62zhRk3lCZCPT46dOSxilHxF6KjOrfj/M=,iv:cGzGudwz/kcvV/rfk1bZrm6oGgS+59d5r6y33eiiRPA=,tag:K5yf0Q6WVl16mVWwNLwiww==,type:str]
          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
    config:
        APP_NAME: Gitea
        server:
            ROOT_URL: https://git.vhaudiquet.fr
        lfs:
            STORAGE_TYPE: local
            PATH: /git/lfs
        repository:
            ROOT: /git/repo
        database:
            DB_TYPE: postgres
        service:
            ALLOW_ONLY_EXTERNAL_REGISTRATION: true
        actions:
            ENABLED: true
        oauth2_client:
            ENABLE_AUTO_REGISTRATION: true
            ACCOUNT_LINKING: login
        openid:
            ENABLE_OPENID_SIGNIN: false
            ENABLE_OPENID_SIGNUP: false
        indexer:
            ISSUE_INDEXER_TYPE: bleve
            REPO_INDEXER_ENABLED: true
# Resource limits for Gitea container
resources:
    requests:
        cpu: 250m
        memory: 512Mi
    limits:
        cpu: 1000m
        memory: 1Gi
# Increase replica count is not useful for 1-node cluster
replicaCount: 1
# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
tolerations:
    - key: ENC[AES256_GCM,data:SMRwovsyI8o2,iv:jjtzBiNCE+/zQP7dIuYjdSeIVpPuQfX1vAoFw79AUTY=,tag:hGT4g9/iDc7se3AmpB4U6Q==,type:str]
      operator: Equal
      value: ENC[AES256_GCM,data:xhjxi4UiARg=,iv:Eoh+GFW/zC8CYNa7kM2L/1zDdZO1B3MhUR8Pousvg/4=,tag:1XCO2YmQtU8lER4jf5G1OA==,type:str]
      effect: NoSchedule
    - key: ENC[AES256_GCM,data:R43SkzLa1CcQmUsW0IaXOtvOxyBM6QAoA2Ww7ymCX3YwFJOiHg==,iv:fs1zpX1MSjhRFttgiCycApgWaHvP5VvSlYGw/VsfwAM=,tag:A9Q7FJ6/426HcUyJd2E6WA==,type:str]
      operator: Exists
      effect: NoSchedule
affinity:
    nodeAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              preference:
                matchExpressions:
                    - key: ENC[AES256_GCM,data:4QLjAevjESSs8WB9EOIYn0RPXPE=,iv:yCAq6UoB/YxB4UVerhEdrIxxCdS1Yu7fh9zCYhBHbWA=,tag:l5nGLEqDanzTq7h9BPwZgA==,type:str]
                      operator: NotIn
                      values:
                        - "true"
# (postgresql and valkey tolerations are set in their respective blocks above)
sops:
    lastmodified: "2026-08-12T16:22:39Z"
    mac: ENC[AES256_GCM,data:BKNUAfPbcxLYtaEzAJYZGluZxrOT938KvofgaIslazpfnengIIu4Fiq9pZ3p6akPTVUfNGNZPA7b20rzmjpcbpDWDQIzivdlp3KIGxzLnx51B3G5RzgeyUp0HRExVcBWOlRWKz1MX4meyEP/kqlUWuYi4blVtQHs15/c3fN7PrQ=,iv:kVIkh4/YVXO0iryezqw9JzuGhNHJp/IlakLvM++oz08=,tag:lseN5ghDoG4vfi4BRLG5mA==,type:str]
    pgp:
        - created_at: "2026-08-12T16:22:39Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiAQ//av9FpScNsTdzIEHdo8wpK16z27efc/ryzjdGg9KT4ig5
            ESEfNiCpvvSAwucM32Vi6phZztssTr8F6mtg+Rj7CGICNIrUbrKB04IU13iFppjp
            9adiRdtGJnVCpPyh2hWgH51QG/3TuOf5bwG0Y6bRttcX2K1EKkSeJFnCkEPXDtCK
            E5H+eGU6TuCrrzWXYfPiER5j2FHz6fXbKyQl0I7yztD2wZMH9UH8zjk8OSrNzJz7
            z6/1di0Z9pYwVA+UjqHTQ9a/JXiGbRtooWu2eksRC/WtMHEEDsPS5BScKY4fwIrO
            mEhM6r+tpy0ME1kpnhMLblBX6e2M6+/Vp3rk6wwixz/L3eJFk20LKeGyNp5B/giP
            nlTL735z0vVcF1hWBXmqHe2zUTJyJNk9TPOr1HKp9GzRacAJoNOAwrGL3ksMWk2y
            XTXsbYh7ODEBSy7fzoNwZ0b8pGrYv8q11lHPk6kST9TyCLzaqgI+rJxaNyN4XubH
            UTHddzYT40cgnISyyR1jMe7FzF681pzzvIo15FS8kKchoJAeRbW0EhWbCWtCQDoN
            FKPj8778WyGwsDFSH2o9ffm9slHBMfUuNXKPfi7UJq3CpegcKn5qDSGR9SoYhNYE
            a50qLRpnFvFwpadQ+vhxm8sZl1TP7LpvclTZe9u7cMbcNqApXZY406nBpv6gq6bS
            XAGuMMHS/GboniA8VtZLy0tvF3WO7uZTR1seN5O2M0yzmfDzIMSpDGGtbytzl1jd
            FcDYQItx3t9pA2Va1pWLWqbpDKcotxH8An60rtcl1mcQrRAujISApC3NPRal
            =L3Jp
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
    version: 3.10.2