From e4b1c856ac50149bae292215fa52947afbaa8949 Mon Sep 17 00:00:00 2001 From: Roy Dumblauskas Date: Mon, 24 Aug 2026 15:38:30 -0500 Subject: [PATCH] add gitea k3s declarations --- homelab-services/gitea/flake.nix | 2 +- homelab-services/gitea/k3s/deployment.yaml | 62 +++++++++++++++++++ homelab-services/gitea/k3s/kustomization.yaml | 6 ++ homelab-services/gitea/k3s/namespace.yaml | 5 ++ homelab-services/gitea/k3s/pvc.yaml | 12 ++++ homelab-services/gitea/k3s/service.yaml | 24 +++++++ nixos/configuration.nix | 28 +++++++++ nixos/flake.nix | 3 + nixos/secrets/gitea.yaml | 43 +++++++++++++ nixos/secrets/seaweed.yaml | 43 ------------- 10 files changed, 184 insertions(+), 44 deletions(-) create mode 100644 homelab-services/gitea/k3s/deployment.yaml create mode 100644 homelab-services/gitea/k3s/kustomization.yaml create mode 100644 homelab-services/gitea/k3s/namespace.yaml create mode 100644 homelab-services/gitea/k3s/pvc.yaml create mode 100644 homelab-services/gitea/k3s/service.yaml create mode 100644 nixos/secrets/gitea.yaml delete mode 100644 nixos/secrets/seaweed.yaml diff --git a/homelab-services/gitea/flake.nix b/homelab-services/gitea/flake.nix index c1ae877..3a2eb2b 100644 --- a/homelab-services/gitea/flake.nix +++ b/homelab-services/gitea/flake.nix @@ -100,7 +100,7 @@ ]; locations."/" = { - proxyPass = "http://127.0.0.1:30080"; + proxyPass = "http://127.0.0.1:30081"; extraConfig = '' proxy_set_header Host $host; diff --git a/homelab-services/gitea/k3s/deployment.yaml b/homelab-services/gitea/k3s/deployment.yaml new file mode 100644 index 0000000..b216579 --- /dev/null +++ b/homelab-services/gitea/k3s/deployment.yaml @@ -0,0 +1,62 @@ +# Define how gitea pod operates +apiVersion: apps/v1 +kind: Deployment +metadata: + name: gitea + namespace: gitea +spec: + replicas: 1 + + selector: + matchLabels: + app: gitea + + template: + metadata: + labels: + app: gitea + + spec: + containers: + - name: gitea + image: docker.gitea.com/gitea:1.27.2 + + ports: + - name: http + containerPort: 3000 + protocol: TCP + + - name: ssh + containerPort: 2222 + protocol: TCP + + env: + - name: GITEA__database__DB_TYPE + value: postgres + + - name: GITEA__database__HOST + value: '{{ (datasource "dbhostname") }}' + + - name: GITEA__database__NAME + value: '{{ (datasource "credentials").GITEA_DB_NAME }}' + + - name: GITEA__database__USER + value: '{{ (datasource "credentials").GITEA_DB_USER }}' + + - name: GITEA__database__PASSWD + value: '{{ (datasource "credentials").GITEA_DB_PASS}}' + + - name: GITEA__server__HTTP_PORT + value: "3000" + + - name: GITEA__server__SSH_PORT + value: "2222" + + volumeMounts: + - name: gitea-data + mountPath: /var/lib/gitea + + volumes: + - name: gitea-data + persistentVolumeClaim: + claimName: gitea-persistent-data diff --git a/homelab-services/gitea/k3s/kustomization.yaml b/homelab-services/gitea/k3s/kustomization.yaml new file mode 100644 index 0000000..05ad5f3 --- /dev/null +++ b/homelab-services/gitea/k3s/kustomization.yaml @@ -0,0 +1,6 @@ +namespace: gitea +resources: + - deployment.yaml + - namespace.yaml + - pvc.yaml + - service.yaml diff --git a/homelab-services/gitea/k3s/namespace.yaml b/homelab-services/gitea/k3s/namespace.yaml new file mode 100644 index 0000000..9006dcf --- /dev/null +++ b/homelab-services/gitea/k3s/namespace.yaml @@ -0,0 +1,5 @@ +# Provide gitea its own namespace (gitea) +apiVersion: v1 +kind: Namespace +metadata: + name: gitea diff --git a/homelab-services/gitea/k3s/pvc.yaml b/homelab-services/gitea/k3s/pvc.yaml new file mode 100644 index 0000000..1ef6262 --- /dev/null +++ b/homelab-services/gitea/k3s/pvc.yaml @@ -0,0 +1,12 @@ +# All persistent storage not directed to DB will live in this claim +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: gitea-persistent-data + namespace: gitea +spec: + accessModes: + - ReadWriteOnce + resources: + requests: + storage: 20Gi diff --git a/homelab-services/gitea/k3s/service.yaml b/homelab-services/gitea/k3s/service.yaml new file mode 100644 index 0000000..eb9924a --- /dev/null +++ b/homelab-services/gitea/k3s/service.yaml @@ -0,0 +1,24 @@ +# point to the deployment +apiVersion: v1 +kind: Service +metadata: + name: gitea + namespace: gitea +spec: + selector: + app: gitea + + ports: + - name: http + port: 3000 + targetPort: http + nodePort: 30081 + protocol: TCP + + - name: ssh + port: 2222 + targetPort: ssh + nodePort: 30222 + protocol: TCP + + type: NodePort diff --git a/nixos/configuration.nix b/nixos/configuration.nix index 332fff1..e71ccfe 100755 --- a/nixos/configuration.nix +++ b/nixos/configuration.nix @@ -48,6 +48,14 @@ owner = "postgres"; group = "postgres"; }; + + "gitea-credentials" = { + sopsFile = ./secrets/gitea.yaml; + key = "credentials"; + format = "yaml"; + owner = "root"; + group = "root"; + }; }; }; @@ -99,12 +107,32 @@ enable = true; disable = [ "traefik" ]; role = "server"; + + extraFlags = [ + "--data-dir=/var/lib/rancher/k3s" + ]; }; # ================================ # # END K3S SERVICE # # ================================ # + # ================================ # + # GITEA SERVICE # + # ================================ # + services.gitea = { + enable = false; + credentialsFile = config.sops.secrets."minio-credentials".path; + database-hostname = "127.0.0.1:5432"; # whatever port I host psql on below + + default-nginx = { + enable = true; + hostname = "roypository.com"; + }; + }; + # ================================ # + # GITEA SERVICE # + # ================================ # # ================================ # # BLOG SERVICE # # ================================ # diff --git a/nixos/flake.nix b/nixos/flake.nix index f5f4552..87b2a56 100755 --- a/nixos/flake.nix +++ b/nixos/flake.nix @@ -30,6 +30,7 @@ # minio-service.url = "path:../homelab-services/minio-service"; mc-service.url = "path:../homelab-services/mc-service"; postgresql-db.url = "path:../homelab-services/postgresql-db"; + gitea.url = "path:../homelab-services/gitea"; }; outputs = @@ -46,6 +47,7 @@ nimh-static, mc-service, postgresql-db, + gitea, }@inputs: let nodes = [ @@ -79,6 +81,7 @@ nimh-static.nixosModules.nimh-static mc-service.nixosModules.mc-service postgresql-db.nixosModules.postgresql-db + gitea.nixosModules.gitea home-manager.nixosModules.home-manager { home-manager.useGlobalPkgs = true; diff --git a/nixos/secrets/gitea.yaml b/nixos/secrets/gitea.yaml new file mode 100644 index 0000000..fad4c08 --- /dev/null +++ b/nixos/secrets/gitea.yaml @@ -0,0 +1,43 @@ +credentials: ENC[AES256_GCM,data:oSxjy68PyelfcKJG2JF9jDa0N2UumCTnhUvNULkJJ5YesQGsH4gyIdxXrq7ZKyqjhkB/J5wH01VhmvsgvNnq7A2DmgonDw==,iv:454zX4ZYqrE5b5bYyKLfWu/gKL8OqK4v9BFyU+VV3Bg=,tag:Jl1fN3kLg9Q8PXZQglcR2g==,type:str] +sops: + age: + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoOFhEOHBWWmI5YVBBYW1a + NzZ5QkxXMVR1TkVmYWRJYStOeElSSWRUWHdzClpDM25wK3d4WmEwbW54L29saGVQ + ZXMwMHVaMmtWLzVmVUVNekJ6ZzNacWsKLS0tIHo5cHJhcnJ2WnhUUTFyVlVRVFpI + SmNLOHBUZ3AyZVJhM2E1alZNMXJBSjgKXIBghssU7gEbsuNyh1x8iO1xZSKEKpTD + JQTLP5PFeLBJcQTRYP9ZapgXJA6ED5gAaD1D1JXvDM6WWeReG0fqNg== + -----END AGE ENCRYPTED FILE----- + recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4eEtlRmFNVG1zcGo4T3ZJ + YkR2Q0p3VnNGRzJ1VEVLTkRON2d2YUdVTEdzCjh1NFdJSVhCUklFU2JCN2ZnRHVV + MTJONnYzZG8wRFROcWdaTGNJUmN2Q1kKLS0tIHI5QnJOcWU3ZjhkdFQxV3JtUTFi + SkxwMmJNUHRaOGx2VUlOT0trUHA2eW8KCYVHpV6vqSAaECqbJQDvJfA5fvUX9wWn + 8V0wy+WRWcjcWVkoHiJSp43CAORAicG4exTGRAhAdoTE1ejB1+cneQ== + -----END AGE ENCRYPTED FILE----- + recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3bmJ0endUbnlOMHd4dmlw + WE10TXk3VVZHSng2dEI3bWp1alZuK2NMTW5rCmNLTCtzTjJkNVFCWm04eHMxcGtw + Zm9ONHdaeERTL05IWXFmMVJyQnBoWjAKLS0tIHNrQUI0Tm1mNXRyRjlXN2xFbUx4 + dWxZUXVVYVlRc2t4VjdCVEVodzAzc2sKZcyrKOkXbcWDgWL8CLJFL8ESeixrIp6b + u91Gy5BfQNOuvNEijr7JhjJi34zTpdfBjHAtCh9RZ0uGjIE4IE/tZQ== + -----END AGE ENCRYPTED FILE----- + recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml + - enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzd0xHY0EyOGFZNldtUlpV + YXAwNmh4d1dnRENPS2Q5Y0ZNZU9VSVN6ZW5ZCmMzZVJ5eEx4UEZMcXJCaE01dzVX + UkdYcDFMYXRyL0w2cVo3WUdnakYwaGsKLS0tIHlXVEpXdXlTcXNrc09FWEk1eDFi + UTBpc2ZPcmFTeVdIVkcweHdMYmpaaGcKdQpQzuS3h3926/4e4rvp/nGA7dO0kDr1 + o+m9XdwX6u7OaazWx7J9tWOS+O1sJoNGMpAj/K5N6OjoNGT4Lu8t+w== + -----END AGE ENCRYPTED FILE----- + recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7 + lastmodified: "2026-08-24T20:37:01Z" + mac: ENC[AES256_GCM,data:6xnOUECA2Ge72v5e1IkY1uLTQRxvWJv5ca82aNq1JDnwIevvWOb+ofiHV6G9oC8ZdozbSrfGAXUWuF/QLC/zchQaPAw164BRdGW/ay3k9pnreBez7YJTnIL2nXOl32INIh3GMgGamoGsiIAX5m9TIj57lEWH6BW1lSpzC3OWG34=,iv:mGmHW9aWkInZ1dkKPlX96ml0TQ9t8sxGhWUlpZz+L6A=,tag:v0IbYxwKLw//Fe8B1StKHw==,type:str] + unencrypted_suffix: _unencrypted + version: 3.13.3 diff --git a/nixos/secrets/seaweed.yaml b/nixos/secrets/seaweed.yaml deleted file mode 100644 index e446525..0000000 --- a/nixos/secrets/seaweed.yaml +++ /dev/null @@ -1,43 +0,0 @@ -seaweedCredentials: ENC[AES256_GCM,data:/piXMLqpb9GkvSxnKFkHMQVWsPk2uYNKu8sjPodbwRPlbGcKzZYcJ4wUwg==,iv:mLJBVCGv/VM6Mh7gktplTcd94obWRnCjgKqNH4jGCQM=,tag:tVC+v+k2ZAv7ap/yscXDNA==,type:str] -sops: - age: - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvRmswMVMxVkRsa0N6V0NM - Qy9VUmtyZC9BbGw2SXZUSDBURUtkYVU5aWtzClJJZy8xTEg4b0hjSTFSM3hBOC9U - cW9Kd24yeUNmRS9LNWl4SkJ1aVZSOTgKLS0tIGc3ck9ZbkZaMWtsdVcwY05JVWxJ - ZXphenAyUVc2eXZDd1cxZVptTjMvOHMKGHJchsnOU0YIThRzzjFpaiYh3rLaZMM2 - Cr1ChgypHvrYQFcbM9gm1N5tfB24jdwtfnqHIhT5upwf0v7QfLgGNA== - -----END AGE ENCRYPTED FILE----- - recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNZWJXa3BEb3BRU01ueWxH - a2F6MjR6YnU5bmJYYkM5eDNDUzBoRUR3dDM0CmZ6endhRy9tWHVBbDRQdzdTRVdC - RkEySnRKa0pmVGlKdmhIOHE4SWhvRlkKLS0tIHpVeE1DUEh6UWtxdzQ5VU1oKzFG - a1NSWVk4NHhGZFNNRCtoazl5NDU0cncKY1bzev4i6eYaES6KvjQV0hcCn0i438Q/ - tUhstFuDD1CwYAU7JoLxjTk+/XClY2DU7EEmWFOTNBhmoSmix1oapw== - -----END AGE ENCRYPTED FILE----- - recipient: age1rwugh86469664fwhgrj9xuhjxs9vpflx3r0ftuvd0glphf2gecfs8thxsj - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0emRuVDR3TXJPRU1wYVNH - eThCWjVucWdUYTJDVjE2RVl1ZXVKMkJOYWkwCnFLcy9aQ0Nnbk84TVhZdVlsM0JO - Z1pyQ1FBY0NIT2M2WWR0S2lLd0RjUHMKLS0tIG9VRUxpU2FKc0g1c2hWZ3dXWk5E - cGdqZnQ3NlNHQVlUOU9Bc2Y1MU8yUjQKK8fAyg9lcaGLOvofCfgx8k8d3ACK3chB - Ly5ANzayidycn0FBvTHIqbvQ7y/sL266G378XUzzlV+k0wU8m27VNQ== - -----END AGE ENCRYPTED FILE----- - recipient: age16ht8xkm70pmhl28m6g5fr3gl7xtsec37y57wauee6jqu06678ctqfw87ml - - enc: | - -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBDR0pObEZaRUpWNndDOWND - T1Z0YllKbUJucjNHcUdTMXQ2UE5ZOUVpcFZ3CmR2ZlA2eXVKb214RnhmdnBZcFd5 - TFNyT3BLbFJBQVlMMUl2RENaT29tYjgKLS0tIGJ5TklXY3ZCYittd1FWd3JJdTh5 - ZUdyK1pHSm96bFlwQXR6NkZsZnZTdlkKGy/Tj+yldqPM5Q86V8oKQoOe3C18VBZ3 - YD4ad9KB3IJ0PG9GFCq5iN90bZBkY/1XeNPZzsOvkZKhAyIj9QLNMw== - -----END AGE ENCRYPTED FILE----- - recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7 - lastmodified: "2026-08-19T02:32:09Z" - mac: ENC[AES256_GCM,data:3iCi9UB5INgZsIHtVhF+YjjIe/QrB86xR/pidWxt0Qj/m4vyR7fIP4uDFF/RjKQ2PtZ0tab0h3ALsWAMaRdnl/AvSJ0jROw2ZQtfAbL6pin6kZYsuBiDlXCDCBkBXVLdzH0vt0Tv31x+nDc3zTGOKB3JSPg6d5cFfidt3c38Tdw=,iv:t+67QNsIvQAGHkpMYiu6v/NRU2Xwt8Wvrk8/GLXZ7hI=,tag:y0vIrJYaOsYYHELWsiU18A==,type:str] - unencrypted_suffix: _unencrypted - version: 3.13.3