apiVersion: apps/v1
kind: Deployment
metadata:
  name: forgejo
  annotations:
    keel.sh/policy: "all"
    keel.sh/match-tag: "true"
    keel.sh/schedule: "0 3 * * *"
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: forgejo
  template:
    metadata:
      labels:
        app: forgejo
    spec:
      containers:
        - name: forgejo
          image: codeberg.org/forgejo/forgejo:10
          ports:
            - containerPort: 3000
              name: http
            - containerPort: 2222
              name: ssh
          env:
            # Core Application Config
            - name: FORGEJO____APP_NAME
              value: "Code Nest"
            - name: FORGEJO__server__DOMAIN
              value: "weaver.mynest.love"
            - name: FORGEJO__server__ROOT_URL
              value: "https://weaver.mynest.love/"
            - name: FORGEJO__server__HTTP_PORT
              value: "3000"
            - name: FORGEJO__server__SSH_PORT
              value: "22"
            - name: FORGEJO__server__SSH_LISTEN_PORT
              value: "2222"

            # DB Config
            - name: FORGEJO__database__DB_TYPE
              value: "postgres"
            - name: FORGEJO__database__HOST
              value: "forgejo-db:5432"
            - name: FORGEJO__database__NAME
              valueFrom:
                secretKeyRef:
                  name: forgejo-secrets
                  key: POSTGRES_DB
            - name: FORGEJO__database__USER
              valueFrom:
                secretKeyRef:
                  name: forgejo-secrets
                  key: POSTGRES_USER
            - name: FORGEJO__database__PASSWD
              valueFrom:
                secretKeyRef:
                  name: forgejo-secrets
                  key: POSTGRES_PASSWORD
            
            # Auth & Registration Controls
            - name: FORGEJO__service__DISABLE_REGISTRATION
              value: "false"
            - name: FORGEJO__service__ALLOW_ONLY_EXTERNAL_REGISTRATION
              value: "true" # Forces OIDC registration
            - name: FORGEJO__service__SHOW_REGISTRATION_BUTTON
              value: "false"

            # Package & Container Registries
            - name: FORGEJO__packages__ENABLED
              value: "true"

            # Secrets from Vault
            - name: FORGEJO__security__SECRET_KEY
              valueFrom:
                secretKeyRef:
                  name: forgejo-secrets
                  key: SECRET_KEY
            - name: OIDC_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: forgejo-secrets
                  key: OIDC_CLIENT_ID
            - name: OIDC_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: forgejo-secrets
                  key: OIDC_CLIENT_SECRET
          volumeMounts:
            - name: forgejo-data
              mountPath: /data
      volumes:
        - name: forgejo-data
          persistentVolumeClaim:
            claimName: forgejo-data
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: forgejo-db
spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: forgejo-db
  template:
    metadata:
      labels:
        app: forgejo-db
    spec:
      containers:
        - name: postgres
          image: postgres:16-alpine
          ports:
            - containerPort: 5432
              name: postgres
          envFrom:
            - secretRef:
                name: forgejo-secrets
          volumeMounts:
            - name: forgejo-db-data
              mountPath: /var/lib/postgresql/data
              subPath: pgdata
      volumes:
        - name: forgejo-db-data
          persistentVolumeClaim:
            claimName: forgejo-db-data