From 2142c654cb5646062c0b74c7981bb497e730b535 Mon Sep 17 00:00:00 2001
From: Astra Logical <booksandpi@gmail.com>
Date: Wed, 22 Jul 2026 07:58:34 -0400
Subject: [PATCH] Force forgejo to use static SSH keys from secret

---
 keel/keel.yaml                                |  2 --
 services/forgejo/forgejo-deployment.yaml      | 22 ++++++----------
 .../forgejo/forgejo-external-secrets.yaml     | 26 +++++++++++++++++++
 3 files changed, 34 insertions(+), 16 deletions(-)

diff --git a/keel/keel.yaml b/keel/keel.yaml
index 0dba801..e8c5cd0 100644
--- a/keel/keel.yaml
+++ b/keel/keel.yaml
@@ -65,8 +65,6 @@ spec:
               value: "true"
             - name: SCHEDULER_FREQUENCY
               value: "1h"
-            - name: AUTO_UPDATE_EVERYTHING
-              value: "false"
           ports:
             - containerPort: 9300
               name: keel
diff --git a/services/forgejo/forgejo-deployment.yaml b/services/forgejo/forgejo-deployment.yaml
index 8a22db9..fce7abd 100644
--- a/services/forgejo/forgejo-deployment.yaml
+++ b/services/forgejo/forgejo-deployment.yaml
@@ -20,19 +20,6 @@ spec:
     spec:
       securityContext:
         fsGroup: 1000
-      initContainers:
-        - name: fix-ssh-permissions
-          image: busybox:latest
-          command:
-            - sh
-            - -c
-            - |
-              mkdir -p /data/ssh
-              chown -R 1000:1000 /data/ssh
-              chmod 700 /data/ssh
-          volumeMounts:
-            - name: forgejo-data
-              mountPath: /data
       containers:
         - name: forgejo
           image: codeberg.org/forgejo/forgejo:10
@@ -62,7 +49,7 @@ spec:
             - name: FORGEJO__server__SSH_DOMAIN
               value: "ssh.weaver.mynest.love"
             - name: FORGEJO__server__SSH_SERVER_HOST_KEYS
-              value: "/data/ssh/ssh_host_ed25519_key, /data/ssh/ssh_host_rsa_key, /data/ssh/ssh_host_ecdsa_key"
+              value: "/etc/forgejo/ssh/ssh_host_ed25519_key,/etc/forgejo/ssh/ssh_host_rsa_key,/etc/forgejo/ssh/ssh_host_ecdsa_key"
 
             # DB Config
             - name: FORGEJO__database__DB_TYPE
@@ -116,10 +103,17 @@ spec:
           volumeMounts:
             - name: forgejo-data
               mountPath: /data
+            - name: forgejo-ssh-keys
+              mountPath: /etc/forgejo/ssh
+              readOnly: true
       volumes:
         - name: forgejo-data
           persistentVolumeClaim:
             claimName: forgejo-data
+        - name: forgejo-ssh-keys
+          secret:
+            secretName: forgejo-ssh-keys
+            defaultMode: 0444
 ---
 apiVersion: apps/v1
 kind: Deployment
diff --git a/services/forgejo/forgejo-external-secrets.yaml b/services/forgejo/forgejo-external-secrets.yaml
index 550100f..48475e1 100644
--- a/services/forgejo/forgejo-external-secrets.yaml
+++ b/services/forgejo/forgejo-external-secrets.yaml
@@ -35,3 +35,29 @@ spec:
       remoteRef:
         key: forgejo
         property: db-name
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: forgejo-ssh-keys
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: forgejo-ssh-keys
+    creationPolicy: Owner
+  data:
+    - secretKey: ssh_host_ed25519_key
+      remoteRef:
+        key: forgejo
+        property: ed25519_key
+    - secretKey: ssh_host_rsa_key
+      remoteRef:
+        key: forgejo
+        property: rsa_key
+    - secretKey: ssh_host_ecdsa_key
+      remoteRef:
+        key: forgejo
+        property: ecdsa_key