Force forgejo to use static SSH keys from secret

keel/keel.yaml

@@ -65,8 +65,6 @@ spec:
               value: "true"
             - name: SCHEDULER_FREQUENCY
               value: "1h"
-            - name: AUTO_UPDATE_EVERYTHING
-              value: "false"
           ports:
             - containerPort: 9300
               name: keel

services/forgejo/forgejo-deployment.yaml

@@ -20,19 +20,6 @@ spec:
     spec:
       securityContext:
         fsGroup: 1000
-      initContainers:
-        - name: fix-ssh-permissions
-          image: busybox:latest
-          command:
-            - sh
-            - -c
-            - |
-              mkdir -p /data/ssh
-              chown -R 1000:1000 /data/ssh
-              chmod 700 /data/ssh
-          volumeMounts:
-            - name: forgejo-data
-              mountPath: /data
       containers:
         - name: forgejo
           image: codeberg.org/forgejo/forgejo:10
@@ -62,7 +49,7 @@ spec:
             - name: FORGEJO__server__SSH_DOMAIN
               value: "ssh.weaver.mynest.love"
             - name: FORGEJO__server__SSH_SERVER_HOST_KEYS
-              value: "/data/ssh/ssh_host_ed25519_key, /data/ssh/ssh_host_rsa_key, /data/ssh/ssh_host_ecdsa_key"
+              value: "/etc/forgejo/ssh/ssh_host_ed25519_key,/etc/forgejo/ssh/ssh_host_rsa_key,/etc/forgejo/ssh/ssh_host_ecdsa_key"
 
             # DB Config
             - name: FORGEJO__database__DB_TYPE
@@ -116,10 +103,17 @@ spec:
           volumeMounts:
             - name: forgejo-data
               mountPath: /data
+            - name: forgejo-ssh-keys
+              mountPath: /etc/forgejo/ssh
+              readOnly: true
       volumes:
         - name: forgejo-data
           persistentVolumeClaim:
             claimName: forgejo-data
+        - name: forgejo-ssh-keys
+          secret:
+            secretName: forgejo-ssh-keys
+            defaultMode: 0444
 ---
 apiVersion: apps/v1
 kind: Deployment

services/forgejo/forgejo-external-secrets.yaml

@@ -35,3 +35,29 @@ spec:
       remoteRef:
         key: forgejo
         property: db-name
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: forgejo-ssh-keys
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: forgejo-ssh-keys
+    creationPolicy: Owner
+  data:
+    - secretKey: ssh_host_ed25519_key
+      remoteRef:
+        key: forgejo
+        property: ed25519_key
+    - secretKey: ssh_host_rsa_key
+      remoteRef:
+        key: forgejo
+        property: rsa_key
+    - secretKey: ssh_host_ecdsa_key
+      remoteRef:
+        key: forgejo
+        property: ecdsa_key