Stub out semaphore. Set up forgejo

services/ansible/ansible-deployment.yaml

@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: semaphore
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: semaphore
+  template:
+    metadata:
+      labels:
+        app: semaphore
+    spec:
+      initContainers:
+        - name: fix-volume-permissions
+          image: busybox
+          command: ["sh", "-c", "chown -R 1001:1001 /etc/semaphore && chmod 775 /etc/semaphore"]
+          volumeMounts:
+            - name: semaphore-data
+              mountPath: /etc/semaphore
+      containers:
+        - name: semaphore
+          image: semaphoreui/semaphore:latest
+          ports:
+            - containerPort: 3000
+          envFrom:
+            - secretRef:
+                name: ansible-secret
+          env:
+            - name: SEMAPHORE_DB_DIALECT
+              value: sqlite
+            - name: SEMAPHORE_DB_PATH
+              value: /etc/semaphore/semaphore.sqlite
+            - name: SEMAPHORE_ADMIN
+              value: "admin"
+          volumeMounts:
+            - name: semaphore-data
+              mountPath: /etc/semaphore
+      volumes:
+        - name: semaphore-data
+          persistentVolumeClaim:
+            claimName: semaphore-pvc

services/ansible/ansible-external-secrets.yaml

@@ -0,0 +1,26 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: ansible-secret
+  namespace: default
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: ansible-secret
+    creationPolicy: Owner
+  data:
+  - secretKey: SEMAPHORE_ADMIN_PASSWORD
+    remoteRef:
+      key: ansible
+      property: admin-pass
+  - secretKey: SEMAPHORE_ADMIN_NAME
+    remoteRef:
+      key: ansible
+      property: admin-user
+  - secretKey: SEMAPHORE_ADMIN_EMAIL
+    remoteRef:
+      key: ansible
+      property: admin-email

services/ansible/ansible-ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: semaphore-ingress
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: semaphore.k3s.home.nest
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: semaphore-svc
+                port:
+                  number: 80

services/ansible/ansible-pvcs.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: semaphore-pvc
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  storageClassName: longhorn
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

services/ansible/ansible-service.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: semaphore-svc
+spec:
+  ports:
+    - port: 80
+      targetPort: 3000
+  selector:
+    app: semaphore

services/forgejo/forgejo-deployment.yaml

@@ -0,0 +1,133 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: forgejo
+  annotations:
+    keel.sh/policy: "all"
+    keel.sh/match-tag: "true"
+    keel.sh/schedule: "0 3 * * *"
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: forgejo
+  template:
+    metadata:
+      labels:
+        app: forgejo
+    spec:
+      containers:
+        - name: forgejo
+          image: codeberg.org/forgejo/forgejo:10
+          ports:
+            - containerPort: 3000
+              name: http
+            - containerPort: 2222
+              name: ssh
+          env:
+            # Core Application Config
+            - name: FORGEJO____APP_NAME
+              value: "Code Nest"
+            - name: FORGEJO__server__DOMAIN
+              value: "weaver.mynest.love"
+            - name: FORGEJO__server__ROOT_URL
+              value: "https://weaver.mynest.love/"
+            - name: FORGEJO__server__HTTP_PORT
+              value: "3000"
+            - name: FORGEJO__server__SSH_PORT
+              value: "22"
+            - name: FORGEJO__server__SSH_LISTEN_PORT
+              value: "2222"
+
+            # DB Config
+            - name: FORGEJO__database__DB_TYPE
+              value: "postgres"
+            - name: FORGEJO__database__HOST
+              value: "forgejo-db:5432"
+            - name: FORGEJO__database__NAME
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-secrets
+                  key: POSTGRES_DB
+            - name: FORGEJO__database__USER
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-secrets
+                  key: POSTGRES_USER
+            - name: FORGEJO__database__PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-secrets
+                  key: POSTGRES_PASSWORD
+            
+            # Auth & Registration Controls
+            - name: FORGEJO__service__DISABLE_REGISTRATION
+              value: "false"
+            - name: FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION
+              value: "true" # Forces OIDC registration
+            - name: FORGEJO__service__SHOW_REGISTRATION_BUTTON
+              value: "false"
+
+            # Package & Container Registries
+            - name: FORGEJO__packages__ENABLED
+              value: "true"
+
+            # Secrets from Vault
+            - name: FORGEJO__security__SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-secrets
+                  key: SECRET_KEY
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-secrets
+                  key: OIDC_CLIENT_ID
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: forgejo-secrets
+                  key: OIDC_CLIENT_SECRET
+          volumeMounts:
+            - name: forgejo-data
+              mountPath: /data
+      volumes:
+        - name: forgejo-data
+          persistentVolumeClaim:
+            claimName: forgejo-data
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: forgejo-db
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: forgejo-db
+  template:
+    metadata:
+      labels:
+        app: forgejo-db
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:16-alpine
+          ports:
+            - containerPort: 5432
+              name: postgres
+          envFrom:
+            - secretRef:
+                name: forgejo-secrets
+          volumeMounts:
+            - name: forgejo-db-data
+              mountPath: /var/lib/postgresql/data
+              subPath: pgdata
+      volumes:
+        - name: forgejo-db-data
+          persistentVolumeClaim:
+            claimName: forgejo-db-data

services/forgejo/forgejo-external-secrets.yaml

@@ -0,0 +1,37 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: forgejo-secrets
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: forgejo-secrets
+    creationPolicy: Owner
+  data:
+    - secretKey: OIDC_CLIENT_ID
+      remoteRef:
+        key: forgejo
+        property: oidc_client_id
+    - secretKey: OIDC_CLIENT_SECRET
+      remoteRef:
+        key: forgejo
+        property: oidc_client_secret
+    - secretKey: SECRET_KEY
+      remoteRef:
+        key: forgejo
+        property: secret_key
+    - secretKey: POSTGRES_USER
+      remoteRef:
+        key: forgejo
+        property: db-user
+    - secretKey: POSTGRES_PASSWORD
+      remoteRef:
+        key: forgejo
+        property: db-pass
+    - secretKey: POSTGRES_DB
+      remoteRef:
+        key: forgejo
+        property: db-name

services/forgejo/forgejo-ingress.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: forgejo
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+spec:
+  ingressClassName: traefik
+  tls:
+  - hosts:
+    - weaver.mynest.love
+    secretName: forgejo-tls
+  rules:
+    - host: weaver.mynest.love
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: forgejo
+                port:
+                  name: http

services/forgejo/forgejo-pvcs.yaml

@@ -0,0 +1,29 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: forgejo-data
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 20Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: forgejo-db-data
+  labels:
+    recurring-job.longhorn.io/source: "enabled"
+    recurring-job-group.longhorn.io/app-config-group: "enabled"
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 10Gi

services/forgejo/forgejo-service.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: forgejo
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3000
+      targetPort: http
+      name: http
+    - port: 22
+      targetPort: ssh
+      name: ssh
+  selector:
+    app: forgejo
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: forgejo-db
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5432
+      targetPort: postgres
+      name: postgres
+  selector:
+    app: forgejo-db