upgrade gitea and drop bitnami postgres

gitea.tf

@@ -5,21 +5,26 @@ resource "kubernetes_namespace" "this" {
 }
 
 resource "helm_release" "this" {
-  name      = "gitea"
+  name      = local.instance_name
   namespace = kubernetes_namespace.this.metadata.0.name
 
   repository = "https://dl.gitea.io/charts/"
   chart      = "gitea"
-  version    = "6.0.3"
+  version    = "12.4.0"
 
   create_namespace = false
 
+  set {
+    name  = "clusterDomain"
+    value = "k8s.lawndale"
+  }
+
   values = [
     jsonencode({
       ingress = {
         enabled   = true
+        className = "traefik"
         annotations = {
-          "kubernetes.io/ingress.class"                             = "traefik"
           "traefik.ingress.kubernetes.io/router.entrypoints"        = "websecure"
           "traefik.ingress.kubernetes.io/router.tls"                = "true"
           "traefik.ingress.kubernetes.io/router.tls.domains.0.main" = local.ingress_domain
@@ -45,11 +50,17 @@ resource "helm_release" "this" {
           }
         ]
       }
+      service = {
+        http = {
+          internalTrafficPolicy = "Cluster"
+        }
+      }
     }),
     jsonencode({
       service = {
         ssh = {
           type                  = "LoadBalancer"
+          externalTrafficPolicy = "Local"
         }
       }
     }),
@@ -80,7 +91,7 @@ resource "helm_release" "this" {
             ISSUE_INDEXER_TYPE = "db" # bleve doesn't like 9p filesystems :/
           }
           metrics = {
-            ENABLED = false ## the metrics not really worth it
+            ENABLED = false ## the metrics are not really worth it
           }
           service = {
             DISABLE_REGISTRATION = true
@@ -92,29 +103,83 @@ resource "helm_release" "this" {
         }
       }
     }),
+    jsonencode({
+      gitea = {
+        config = {
+          mailer = {
+            ENABLED   = true
+            FROM      = "gitea@git.thomasklein.me"
+            PROTOCOL  = "smtp"
+            SMTP_ADDR = "nat.lawndale"
+            SMTP_PORT = "25"
+          }
+        }
+      }
+    }),
     jsonencode({
       persistence = {
         enabled   = true
-        existingClaim = module.gitea_persistance.pvc_name
+        create    = false
+        claimName = module.gitea_persistance.pvc_name
       }
     }),
     jsonencode({
       postgresql = {
-        enabled = true
+        enabled = false
-        persistence = {
-          enabled       = true
-          existingClaim = module.postgres_persistance.pvc_name
       }
-        podSecurityContext = {
+      "postgresql-ha" = {
-          enabled = true
+        enabled = false
+      }
+      "redis-cluster" = {
+        enabled = false
+      }
+      "valkey-cluster" = {
+        enabled = false
+      }
+      "valkey" = {
+        enabled = false
+      }
+    }),
+    # Non-HA config base, see https://gitea.com/gitea/helm-chart/src/tag/v10.1.4#single-pod-configurations 
+    jsonencode({
+      gitea = {
+        config = {
+          database = {
+            DB_TYPE = "postgres"
+            NAME = local.postgresql_dbname
+            HOST = "${kubernetes_service.postgresql.metadata.0.name}.${kubernetes_namespace.this.metadata.0.name}.svc.k8s.lawndale"
+          }
+          session = {
+            PROVIDER = "db"
+          }
+          cache = {
+            ADAPTER = "memory"
+          }
+          queue = {
+            TYPE = "level"
+          }
+          indexer = {
+            ISSUE_INDEXER_TYPE   = "bleve"
+            REPO_INDEXER_ENABLED = true
           }
-        volumePermissions = {
-          enabled = true
         }
       }
     }),
   ]
 
+  set_sensitive {
+    name = "gitea.config.database.PASSWD"
+    value = random_password.postgresql.result
+  }
+
+  # set_sensitive {
+  #   name  = "postgresql.global.postgresql.auth.password"
+  #   value = random_password.postgresql_gitea.result
+  # }
+  # set_sensitive {
+  #   name  = "postgresql.global.postgresql.auth.postgresPassword"
+  #   value = random_password.postgresql.result
+  # }
   set_sensitive {
     name  = "gitea.oauth[0].key"
     value = aws_cognito_user_pool_client.gitea.id
@@ -130,6 +195,14 @@ resource "helm_release" "this" {
   }
 }
 
+resource "random_password" "postgresql_gitea" {
+  length = 5
+}
+
+resource "random_password" "postgresql" {
+  length = 10
+}
+
 resource "random_password" "gitea_admin" {
   length  = 16
   special = true

locals.tf

@@ -1,5 +1,6 @@
 locals {
   ingress_domain = "git.thomasklein.me"
+  instance_name = "gitea"
 }
 
 data "aws_region" "current" {}

postgresql.tf

@@ -0,0 +1,186 @@
+locals {
+  postgresql_user    = "gitea"
+  postgresql_version = "18"
+  postgresql_dbname  = "gitea"
+}
+resource "kubernetes_service" "postgresql_headless" {
+  metadata {
+    name      = "${local.instance_name}-postgresql-hl"
+    namespace = kubernetes_namespace.this.metadata.0.name
+    labels = {
+      "app.kubernetes.io/instance"   = local.instance_name
+      "app.kubernetes.io/managed-by" = "terraform"
+      "app.kubernetes.io/version"    = local.postgresql_version
+      "app.kubernetes.io/name"       = "postgresql"
+    }
+  }
+  spec {
+    type       = "ClusterIP"
+    cluster_ip = null
+    selector = {
+      "app.kubernetes.io/instance" = local.instance_name
+      "app.kubernetes.io/name"     = "postgresql"
+    }
+    port {
+      name        = "tcp-postgresql"
+      port        = 5432
+      protocol    = "TCP"
+      target_port = "tcp-postgresql"
+    }
+  }
+}
+
+resource "kubernetes_service" "postgresql" {
+  metadata {
+    name      = "${local.instance_name}-postgresql"
+    namespace = kubernetes_namespace.this.metadata.0.name
+    labels = {
+      "app.kubernetes.io/instance"   = local.instance_name
+      "app.kubernetes.io/managed-by" = "terraform"
+      "app.kubernetes.io/version"    = local.postgresql_version
+      "app.kubernetes.io/name"       = "postgresql"
+    }
+  }
+  spec {
+    type       = "ClusterIP"
+    selector = {
+      "app.kubernetes.io/instance" = local.instance_name
+      "app.kubernetes.io/name"     = "postgresql"
+    }
+    port {
+      name        = "tcp-postgresql"
+      port        = 5432
+      protocol    = "TCP"
+      target_port = "tcp-postgresql"
+    }
+  }
+}
+
+resource "kubernetes_secret" "postgresql" {
+  metadata {
+    namespace = kubernetes_namespace.this.metadata.0.name
+    name      = "${local.instance_name}-postgresql"
+  }
+  data = {
+    password = sensitive(random_password.postgresql.result)
+  }
+}
+
+resource "kubernetes_stateful_set" "postgresql" {
+  metadata {
+    namespace = kubernetes_namespace.this.metadata.0.name
+    name      = "${local.instance_name}-postgresql"
+    labels = {
+      "app.kubernetes.io/instance"   = local.instance_name
+      "app.kubernetes.io/managed-by" = "terraform"
+      "app.kubernetes.io/version"    = local.postgresql_version
+      "app.kubernetes.io/name"       = "postgresql"
+    }
+  }
+  spec {
+    replicas = 1
+    selector {
+      match_labels = {
+        "app.kubernetes.io/instance" = local.instance_name
+        "app.kubernetes.io/name"     = "postgresql"
+      }
+    }
+    service_name = kubernetes_service.postgresql.metadata.0.name
+    
+    template {
+      metadata {
+        labels = {
+          "app.kubernetes.io/instance"   = local.instance_name
+          "app.kubernetes.io/managed-by" = "terraform"
+          "app.kubernetes.io/version"    = local.postgresql_version
+          "app.kubernetes.io/name"       = "postgresql"
+        }
+        name = "${local.instance_name}-postgresql"
+      }
+      spec {
+        automount_service_account_token = false
+        container {
+          name              = "postgresql"
+          image             = "docker.io/library/postgres:${local.postgresql_version}-trixie"
+          image_pull_policy = "IfNotPresent"
+
+          env {
+            name  = "POSTGRES_DB"
+            value = local.postgresql_dbname
+          }
+          env {
+            name  = "POSTGRES_USER"
+            value = local.postgresql_user
+          }
+          env {
+            name = "POSTGRES_PASSWORD"
+            value_from {
+              secret_key_ref {
+                key  = "password"
+                name = kubernetes_secret.postgresql.metadata.0.name
+              }
+            }
+          }
+          port {
+            container_port = 5432
+            protocol       = "TCP"
+            name           = "tcp-postgresql"
+          }
+          volume_mount {
+            name       = "data"
+            mount_path = "/var/lib/postgresql"
+          }
+          # volume_mount {
+          #   name       = "data"
+          #   mount_path = "/var/lib/postgresql/data"
+          #   sub_path   = "data"
+          # }
+          # resources {
+          #   limits = {
+          #     "cpu" = "1"
+          #     "memory" = "1Gi"
+          #   }
+          # }
+          liveness_probe {
+            failure_threshold     = 6
+            initial_delay_seconds = 30
+            period_seconds        = 15
+            timeout_seconds       = 10
+            exec {
+              command = [
+                "/bin/sh",
+                "-c",
+                "exec pg_isready -U ${local.postgresql_user} -d 'dbname=${local.postgresql_dbname}' -h 127.0.0.1 -p 5432"
+              ]
+            }
+          }
+        }
+        volume {
+          name = "data"
+          persistent_volume_claim {
+            claim_name = module.postgres_persistance.pvc_name
+          }
+        }
+      }
+    }
+  }
+}
+
+
+# image = {
+#   tag = "12.20.0-debian-12-r26"
+# }
+# primary = {
+#   persistence = {
+#     enabled       = true
+#     existingClaim = module.postgres_persistance.pvc_name
+#     claimName     = module.postgres_persistance.pvc_name
+#   }
+#   podSecurityContext = {
+#     enabled = true
+#   }
+#   volumePermissions = {
+#     enabled = true
+#   }
+# }
+