Force forgejo to use static SSH keys from secret

data-restorer.yaml

@@ -14,4 +14,4 @@ spec:
   volumes:
   - name: target-volume
     persistentVolumeClaim:
-      claimName: calibre-web-config-pvc
+      claimName: forgejo-data

keel/keel.yaml

@@ -65,8 +65,6 @@ spec:
               value: "true"
             - name: SCHEDULER_FREQUENCY
               value: "1h"
-            - name: AUTO_UPDATE_EVERYTHING
-              value: "false"
           ports:
             - containerPort: 9300
               name: keel

services/forgejo/forgejo-deployment.yaml

@@ -18,6 +18,8 @@ spec:
       labels:
         app: forgejo
     spec:
+      securityContext:
+        fsGroup: 1000
       containers:
         - name: forgejo
           image: codeberg.org/forgejo/forgejo:10
@@ -46,6 +48,8 @@ spec:
               value: "true"
             - name: FORGEJO__server__SSH_DOMAIN
               value: "ssh.weaver.mynest.love"
+            - name: FORGEJO__server__SSH_SERVER_HOST_KEYS
+              value: "/etc/forgejo/ssh/ssh_host_ed25519_key,/etc/forgejo/ssh/ssh_host_rsa_key,/etc/forgejo/ssh/ssh_host_ecdsa_key"
 
             # DB Config
             - name: FORGEJO__database__DB_TYPE
@@ -99,10 +103,17 @@ spec:
           volumeMounts:
             - name: forgejo-data
               mountPath: /data
+            - name: forgejo-ssh-keys
+              mountPath: /etc/forgejo/ssh
+              readOnly: true
       volumes:
         - name: forgejo-data
           persistentVolumeClaim:
             claimName: forgejo-data
+        - name: forgejo-ssh-keys
+          secret:
+            secretName: forgejo-ssh-keys
+            defaultMode: 0444
 ---
 apiVersion: apps/v1
 kind: Deployment

services/forgejo/forgejo-external-secrets.yaml

@@ -35,3 +35,29 @@ spec:
       remoteRef:
         key: forgejo
         property: db-name
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: forgejo-ssh-keys
+spec:
+  refreshInterval: "1h"
+  secretStoreRef:
+    name: vault-external-secrets-store
+    kind: ClusterSecretStore
+  target:
+    name: forgejo-ssh-keys
+    creationPolicy: Owner
+  data:
+    - secretKey: ssh_host_ed25519_key
+      remoteRef:
+        key: forgejo
+        property: ed25519_key
+    - secretKey: ssh_host_rsa_key
+      remoteRef:
+        key: forgejo
+        property: rsa_key
+    - secretKey: ssh_host_ecdsa_key
+      remoteRef:
+        key: forgejo
+        property: ecdsa_key