homeprod/kubernetes/dev/gitea/values.yaml

image:
    tag: 1.27.1
    rootless: false
ingress:
    enabled: true
    hosts:
        - host: git.vhaudiquet.fr
          paths:
            - path: /
              pathType: Prefix
# Disable HA, we are on a 1-node cluster
redis-cluster:
    enabled: false
# Valkey cluster is the new default in chart 12.x - must be explicitly disabled
valkey-cluster:
    enabled: false
# Use standalone Valkey (replaces 'redis' in chart 12.x)
valkey:
    enabled: true
    master:
        resources:
            requests:
                cpu: 100m
                memory: 128Mi
            limits:
                cpu: 500m
                memory: 256Mi
        tolerations:
            - key: ENC[AES256_GCM,data:rLGDJE4ONCI5,iv:wTTDf0ZFtDMxWDeKKc+exYtttYOiV+FsEm3XK8QK2Cc=,tag:dQwwhIFWBFboqwA/CHSwHA==,type:str]
              operator: Equal
              value: ENC[AES256_GCM,data:GcuthAN+kRI=,iv:JkXNOi1+yM6erVOsGGQGJHpk0qGW4F9ddWtC6vqLQk8=,tag:Qy2oax6TOYkD21ZVjniG2A==,type:str]
              effect: NoSchedule
            - key: ENC[AES256_GCM,data:0jlwt9EiXv0oJAffz4L7ubpCNW6DWWWrk/gUwwK/jQgufJXliQ==,iv:OF3iwxZKBICPOPyUX10Q1Vo0dQMUGsMP8L37E/5UEXo=,tag:2MEG65UcaWXpKONAO9Up0w==,type:str]
              operator: Exists
              effect: NoSchedule
        affinity:
            nodeAffinity:
                preferredDuringSchedulingIgnoredDuringExecution:
                    - weight: 100
                      preference:
                        matchExpressions:
                            - key: ENC[AES256_GCM,data:DlanHdTDxyfOIymHd8byz0pMK+U=,iv:GsGDUAAE1bSFN+XRUyjp+V3h9df4R+FmMugpYpbHvRI=,tag:RTOYK5F7iLQVPLM7JeF1tQ==,type:str]
                              operator: NotIn
                              values:
                                - "true"
postgresql:
    enabled: true
    global:
        postgresql:
            auth:
                postgressPassword: ENC[AES256_GCM,data:UBOnOe2IVGwZGw==,iv:ntiX+Kw/00e4WF8bZJzkW/OyANR674/AqRxXuotbPDk=,tag:gyK5ViQRMDIlfKK2ULP+1A==,type:str]
                password: ENC[AES256_GCM,data:LPfuGk4/lpMGTQ==,iv:5DlJX6pk8m34Z+p+YC8E0P1bwykBs9VV0ysYX++wPQc=,tag:l5oyZ9tJakhX9csUayMDoQ==,type:str]
                database: gitea
                username: ENC[AES256_GCM,data:tng9lqY=,iv:N1JM+afD2vC5vx7g/rLQ68CNzd0ryZ29zl5bgOeLj7I=,tag:s9G2Q8zym77n2eBw8/SB1A==,type:str]
    volumePermissions:
        enabled: true
    primary:
        resources:
            requests:
                cpu: 250m
                memory: 256Mi
            limits:
                cpu: 1000m
                memory: 1Gi
        tolerations:
            - key: ENC[AES256_GCM,data:EzKdAqRC6+2n,iv:BW54BgwMVb3Xf6IyvsWreCBhSGBj1txG2O78nMRA6KU=,tag:YO86fwb74ybEo4nskDhzPA==,type:str]
              operator: Equal
              value: ENC[AES256_GCM,data:RxQQx4fCcWY=,iv:1QpSRFscYAkwSJPyGLdkm3pKxjO9cb3fqLe12BmzYQM=,tag:YDivIrdVTvpXNntHQqvjFg==,type:str]
              effect: NoSchedule
            - key: ENC[AES256_GCM,data:keOI17VbBeQC3uts6Z+O7SqoOGe2V0qyGYKDkmIRvzHD4BgLag==,iv:KozRBiD4QgP8f61wi+FXyVYM0fu64x5O9Xugl6fY7As=,tag:eZ6LEzEG0BZVWfCTgnmo6w==,type:str]
              operator: Exists
              effect: NoSchedule
        affinity:
            nodeAffinity:
                preferredDuringSchedulingIgnoredDuringExecution:
                    - weight: 100
                      preference:
                        matchExpressions:
                            - key: ENC[AES256_GCM,data:8yiv5tamZacncPTWR0Yxzg+C99w=,iv:ebzUmoyTX58bQRAYG5pFGEbQV9mCvunj3gs/4mEqeNI=,tag:zcg+onPMicZ90K65JhPLIw==,type:str]
                              operator: NotIn
                              values:
                                - "true"
        livenessProbe:
            enabled: true
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 10
            successThreshold: 1
            failureThreshold: 10
        readinessProbe:
            enabled: true
            initialDelaySeconds: 5
            periodSeconds: 10
            timeoutSeconds: 10
            successThreshold: 1
            failureThreshold: 6
postgresql-ha:
    enabled: false
persistence:
    enabled: true
    subPath: data
extraVolumes:
    - name: git
      nfs:
        server: truenas.lan
        path: /mnt/fast_app_data/git
extraContainerVolumeMounts:
    - name: git
      mountPath: /git
clusterDomain: cluster.local
gitea:
    oauth:
        - name: Authentik
          provider: openidConnect
          key: ENC[AES256_GCM,data:OjjKl7y27KPg6HNc8ymBVlReSYtKYSpl6NbedO63nW6awbmZAYxbqA==,iv:cuEfrAtiOZf0cyAl4fh/sghoRQYfkRvBqXQymUW4TtA=,tag:jqmhUg5BET9/kVCUUN09lg==,type:str]
          secret: ENC[AES256_GCM,data:IJPolqAVYueWdMBrr/DXZtAo4SzR6LoM4uTNxMt/6jwkq22nkNReClmkjDnYmkwa6MVRHVgK5huTtw6nhoESsEl3RhgYcukodY1stXuBazMODPEHK8MaWzT7gBsMxDQPoE41v1/1k7EminpvyLo7pS30/Wzm+9gs3ZHJnDpTco0=,iv:gp2t91ghTXqXlo4kJkyxcRdHn0Pgr4Y5NDIhAgskPrM=,tag:ACrD1upk8M0aCdOfiqDYZw==,type:str]
          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
    config:
        APP_NAME: Gitea
        server:
            ROOT_URL: https://git.vhaudiquet.fr
        lfs:
            STORAGE_TYPE: local
            PATH: /git/lfs
        repository:
            ROOT: /git/repo
        database:
            DB_TYPE: postgres
        service:
            ALLOW_ONLY_EXTERNAL_REGISTRATION: true
        actions:
            ENABLED: true
        oauth2_client:
            ENABLE_AUTO_REGISTRATION: true
            ACCOUNT_LINKING: login
        openid:
            ENABLE_OPENID_SIGNIN: false
            ENABLE_OPENID_SIGNUP: false
        indexer:
            ISSUE_INDEXER_TYPE: bleve
            REPO_INDEXER_ENABLED: true
# Resource limits for Gitea container
resources:
    requests:
        cpu: 250m
        memory: 512Mi
    limits:
        cpu: 1000m
        memory: 1Gi
# Increase replica count is not useful for 1-node cluster
replicaCount: 1
# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
tolerations:
    - key: ENC[AES256_GCM,data:N9KYPjyJBeR/,iv:ItqbmbczPVIa8hp3t1tpXnCkF1YqOztbsDABDRT6/B8=,tag:PqYQWxtbMsHl/JkPf9YhvA==,type:str]
      operator: Equal
      value: ENC[AES256_GCM,data:NIQxICcKZhM=,iv:KBVZreLdt+dOHwXNO4M783FnsEkzCF+IuUj7OFDzp+8=,tag:id/941eMKYOEHle0jpbBnA==,type:str]
      effect: NoSchedule
    - key: ENC[AES256_GCM,data:F+56TT1RDYqa2W+/hH4F2DLZN0z9ntIUotJs5z6Evbrk0HyOYQ==,iv:EDGCRlpBbu5Tge39BZSSbahTHQkehdsx1OxD6taknsY=,tag:hFazsCqLW8t8Ut6q7NekJg==,type:str]
      operator: Exists
      effect: NoSchedule
affinity:
    nodeAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              preference:
                matchExpressions:
                    - key: ENC[AES256_GCM,data:gdaarsrSby77GChUo3RX6cP/JOQ=,iv:dvibQUx66AjVQIe2K0WkpbE2ZPK65kvC2RdFe6XkwgU=,tag:DF9vNygJ+tRCL+5mZ0KOIg==,type:str]
                      operator: NotIn
                      values:
                        - "true"
# (postgresql and valkey tolerations are set in their respective blocks above)
sops:
    lastmodified: "2026-08-12T21:24:09Z"
    mac: ENC[AES256_GCM,data:eXx1gMTmhafxsGePLcA6jpzAiCA5rHc22l7SkN9FOFQN/Jy+OIq1ronyqkzIgqNHsfAmVCwCfWCAOKKorI7O+X72DkjhX/aqfws9PjAedvPEjlRYsZLJ8k2dtXtQTt5mVumowH99EjiGMImYGQL9AAyRqBOh3sY7wByQuP6AIdE=,iv:UgewnkPcVTZwXHDgMU4nFD3SaU/Fd0eI9B9WucJSAiI=,tag:gIt+I+I4vPu6PfJW32jn2Q==,type:str]
    pgp:
        - created_at: "2026-08-12T21:24:09Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

            hQIMA7uy4qQr71wiAQ//Y2Rc1x2sKbvozcgdgF8WW7FHHBnazaRVd9exQ7Bvl2qd
            71v3vV/wn9+Dj4WOm5/gufNqoX7hh5Z4hb3lSFgTWcclCw9Yt6ZbcXzYg+1+wiu1
            pi29DVQ+G1+x2NZSjQMReI6jooKZHT07gL88ypzEb538qsWA9lqz3D40guBeYA1M
            zzhgYh1rFN5ziUv0zpXOy3fMiCvS3pM1UNOLksaWVsH65iAxcfaS+//L4Jorddix
            aB7PAX0YdYRU8x9yC1DjO1kodJHmFS4n3awvTl6sWM6gxyLZrA4OnYECsTfnfZZa
            ssgADXTUSnpRgXfqyuMUAGNlavUwBBggAVGN2tXTc8wtlO6ZwW5f6P9oKbIVY8hp
            NOfuO81Rib/YfOan07n1phtNJ4mmGrp38VorqJRTwl8o4HERXL8nXXrhg816QzXb
            SDpgNQWHNq8KIDtLcvCfpGCmC8vE1N9dFu4f6U3kWnfkfqIpykK4L9jijUS2LutI
            pYOGqcVo23QdRAqMzjRhKwJIqvcswGEMzgfzdc2iAVujo0ZI3Ez6ku5PTf2EEsKq
            3p4RMqZlLSBiU+oHhAU50aowrcqnPp3QNyvYRX8jwpo/x0lsDcPUbqGFVJzmNLTf
            su3h1PD4a6c9ucmCgZ4FJR0qrR0Dv8hlWUA3XCCv67jIlwuBp84AOy/Rp/vKgtvS
            XgFnHuKEBL6BkJ2RUWTxfe7r5dBmWANawMsaKYSwKhiGoYsYIOXS0XGANXSW7ivx
            ASLCpF30X5UpHtRfUIVMItzAxm2QEa6HplKlFEvMLhHhxyCL2Kuk/At/wRURUIo=
            =iWv9
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
    version: 3.10.2